2462: Must enable extension to configure

smacleod
Feb. 1, 2014 
What's the URL of the page containing the problem?
/admin/extensions/

What steps will reproduce the problem?
1.Visit page
2.Cannot configure (no link shown, and visiting link will error)
3.Enable extension
4.Can now configure

What operating system are you using? What browser?
N/A

Please provide any additional information below.
This seems like a possible security/privacy flaw (also annoyance). In order to configure an extension it must currently be running. This leaves a window between when an extension is enabled, and when it is configured properly. If the extension comes with default configuration which could expose information, or allow abuse of the system, it would be possible to exploit during this time.

This seems to be done for a technical reason. Currently the admin configuration pages won't be loaded or accessible unless the extension is enabled. Fixing this issue might require a large change to the way extensions are structured or executed.
david
#1 david
  • +Fixed
david
#2 david 
Oops, not quite.
  • -Fixed
    +New
david
#3 david
  • +Component-Extensions
david
#4 david 
While this is a little annoying, I don't see any way we can make a change to handle this that doesn't make things worse. The alternative is that extension code would run just from having the extension installed, which seems like a bigger source of problems. If there's some extension that opens additional ports or is otherwise problematic wrt security, that extension could implement a second-level enable itself.
  • -New
    +WontFix