{"action":"created","issue":{"url":"https://api.github.com/repos/wiremod/wire/issues/929","labels_url":"https://api.github.com/repos/wiremod/wire/issues/929/labels{/name}","comments_url":"https://api.github.com/repos/wiremod/wire/issues/929/comments","events_url":"https://api.github.com/repos/wiremod/wire/issues/929/events","html_url":"https://github.com/wiremod/wire/issues/929","id":96899985,"number":929,"title":"Updating somone elses E2 doesn't change owner","user":{"login":"adosikas","id":3721366,"avatar_url":"https://avatars.githubusercontent.com/u/3721366?v=3","gravatar_id":"","url":"https://api.github.com/users/adosikas","html_url":"https://github.com/adosikas","followers_url":"https://api.github.com/users/adosikas/followers","following_url":"https://api.github.com/users/adosikas/following{/other_user}","gists_url":"https://api.github.com/users/adosikas/gists{/gist_id}","starred_url":"https://api.github.com/users/adosikas/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/adosikas/subscriptions","organizations_url":"https://api.github.com/users/adosikas/orgs","repos_url":"https://api.github.com/users/adosikas/repos","events_url":"https://api.github.com/users/adosikas/events{/privacy}","received_events_url":"https://api.github.com/users/adosikas/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":22,"created_at":"2015-07-23T20:35:05Z","updated_at":"2015-07-28T23:43:18Z","closed_at":null,"body":"Which is kinda bad if you open someones e2 and put stuff like concmd() inside, which can get exploited with something like concmd(\"say !rank EvilGuy Admin\"), even if you were paranoid about your concmd whitelist, \"say\" is probably on it.\r\nGiven it requries an admin to give you PP rights and having a e2 out, but this is a kinda common situation. Say an admin want to share a e2 with you, but instead of rightlclicking it and just pressing save, you put in your code and upload it. I was not aware of that possibility and i don't even see the friendwrite option anymore to block it, nor any other way (exept of not trusting people at all).\r\n\r\nSome ideas on how to fix it:\r\n\r\n* Run that code as the uploads user\r\n* Add back friendwrite option\r\n* Don't run E2 when others upload it, just let it sit idle, so one can still see the edits, but they don't get run\r\n* Show a message like: \"E2 uploaded by EvilGuy.  [Execute E2] [Open in editor] [Block upload] [checkbox] Remember choice\""},"comment":{"url":"https://api.github.com/repos/wiremod/wire/issues/comments/125783226","html_url":"https://github.com/wiremod/wire/issues/929#issuecomment-125783226","issue_url":"https://api.github.com/repos/wiremod/wire/issues/929","id":125783226,"user":{"login":"adosikas","id":3721366,"avatar_url":"https://avatars.githubusercontent.com/u/3721366?v=3","gravatar_id":"","url":"https://api.github.com/users/adosikas","html_url":"https://github.com/adosikas","followers_url":"https://api.github.com/users/adosikas/followers","following_url":"https://api.github.com/users/adosikas/following{/other_user}","gists_url":"https://api.github.com/users/adosikas/gists{/gist_id}","starred_url":"https://api.github.com/users/adosikas/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/adosikas/subscriptions","organizations_url":"https://api.github.com/users/adosikas/orgs","repos_url":"https://api.github.com/users/adosikas/repos","events_url":"https://api.github.com/users/adosikas/events{/privacy}","received_events_url":"https://api.github.com/users/adosikas/received_events","type":"User","site_admin":false},"created_at":"2015-07-28T23:43:18Z","updated_at":"2015-07-28T23:43:18Z","body":"A potential problem OR feature i see with that solution would be that the popup comes up every time. \r\nBad for users who don't know about wire or E2 and just want to paste cool stuff, and may be put off by a warning. \r\nGood for the dupe author who gets his id (and additionally the name too?) embedded into dupes so everyone who spawns them sees the credit.\r\n\r\nOfcourse the popup would stop in both cases when one restarts the E2 with their own id and re-saves the dupe, right?"}}