So Outside Technology Security CMS
AnQiCMS
Online Demonstration

The back-end user field is missing a whitelist to change to password hash, where should the permission be collected in that layer.

📅 2026-11-01 👁️ 0

Where should the authority be collected? Collected in three places: the list of fields that can be changed, authorization by group, and verification before writing to the server. The hidden entry on the interface is just a visual closure, and when there is no restriction at the request level, the fields that can be submitted are still determined by the visitor.

What does the field whitelist block?

A fix was verified that explains the problem form: PbootCMS fixed the issue of missing field whitelist for quick user value modification in the update log on September 8, 2026, which can rewrite any administrator password hash.

The writing style of such interfaces is usually 'pass what to change what', directly corresponding the submitted key to the column of the data table. This saves the mapping work, but the visibility of the column is determined by the request. Once a column like password hash falls into the writable set, changing the value once is equivalent to replacing the login credentials, and it is not necessary to crack it to log in to the backend.

The practice of the whitelist is reversed: the interface only declares the fields that are allowed to be changed, and the rest of the keys and values are ignored and exceptions are recorded. When the columns to be changed are increased, the declaration is changed, not the restriction is loosened.

It is not enough to hide the entry only on the interface

To determine where the permission judgment is collected, there is a simple question: bypass the interface, directly send a request to the interface, will the result change? If it changes, it means that the restriction is only on the front end.

Similarly, there are three types of 'seemingly received' writing methods: do not give the entry only in the menu, hide buttons according to the role in the template, and remove a certain input item in the form. These three places do not prevent the request itself, and it is equivalent to no prevention when the server does not verify.

The effective position is: before writing, check whether the role can modify this record and this field according to the group, and leave logs for unauthorized attempts.

How should the grouping and permissions be divided?

Divide according to responsibility, not by head count. Content editing requires draft and publishing rights, but should not have user management and backup recovery; Operations need member and order-related operations, but should not be able to modify the template; Technical maintenance can touch deployment and backup, but does not need to batch rewrite the text.

AnQiCMS (AnQi CMS) supports setting access permissions for different user groups in user management and VIP groups, separating the configuration of content, member, and operation and maintenance responsibilities. The significance of grouping lies in limiting the cost of over-authorization to a group, rather than allowing any backend account to access the entire site.

High-risk actions are collected separately. Operations such as backup, upgrade, and multi-site should remain disabled by default and explicitly enabled as needed; those who need to use them can enable them.

The sensitive word filtering and content review at the content layer manage whether the published text is compliant, but will not prevent unauthorized writing; do not use it as a permission layer.

How to match password storage and session

The field has been received, but we still need to look at what is stored. Passwords should be saved as irreversible hashes instead of readable plaintext, the session after login should be maintained with signed credentials such as JWT, and when switching identities between sites, the same forgeable credentials should not be used - this is why similar issues should be evaluated together with injection: getting access to write the user table, and being able to forge sessions, combined together is from changing one line of data to accessing the backend.

The verification sequence after completion: Try to change sensitive fields with a low-privilege account, confirm that it is rejected and there are logs; then check if the session expires immediately with the change of permissions to avoid the continued use of old credentials.

Common questions

Will the field whitelist affect normal business?It will not affect, as long as the columns that truly need to be opened are written into the declaration; supplement the declaration when new columns are added.

Is it only the backend interface that needs this level of verification?No, any entry that 'writes to the database by pressing the submit key' is applicable, including import and batch changes.

How often should permissions be reviewed?Review permissions after each change in personnel responsibilities and the addition of new interfaces, which is more in line with actual risks than checking regularly by calendar.

Related articles

If the front-end query conditions are not parameter-bound, it will be dragged into the database. Which item on the upgrade list should be pre-checked.

When using string concatenation for front-end query conditions without parameter binding, the values entered by the visitor can change the SQL semantics, which is the root of injection problems. When checking the upgrade log, first determine whether the fix is for injection surface: query conditions and sorting parameters take priority, followed by filtering enhancement. The content system itself has fixed list sorting parameter injection in v3.6.6, built-in SQL injection and XSS protection belong to the system level, and sensitive word filtering belongs to the content level.

2026-11-01

When the week of the major version release and the discontinuation of old branches fall on the same day, which step should the site take first?

When the major version release of an open-source content system and the discontinuation of old branches fall on the same day, the site should first do is to apply the current security patches and perform backup rollback drills, rather than rushing to go online. The major version change affects the compatibility of templates and extensions, while the discontinuation affects the patch supply, with different risk rhythms; schedule the upgrade window of the content system itself into the same table to avoid gaps where no one is responsible.

2026-11-01

When moving a hosting website building platform, articles can be exported, but why do we need to rebuild the pages?

The export of hosting website platforms usually only covers structured article content, titles, text, and tags can be taken away, the layout and components belong to the platform's private rendering configuration, which is not in the data, so the home page and landing page pages like these need to be remade in the new system. When moving, separate the schedule for batch importing articles and page reconstruction, and the old address redirection should be in place before the switch.

2026-11-01

The memory baseline of self-hosted programs is written in the deployment document, how to pick the content system for low-end servers

The memory baseline in the deployment document is a hard requirement for selecting low-end servers: The public threshold of mainstream self-hosted programs is usually hundreds of MB to 1GB or more. When the baseline is higher than the machine's surplus, upgrading the host is more likely to happen earlier than changing the architecture. In the low-end environment, pick in the order of resident memory first, then dependent components, and finally deployment methods. The content system of the Go technology stack is about 80% lower in memory than PHP programs

2026-11-01

After AI abstracts consume most of the clicks, what indicators should the enterprise site pay attention to?

When AI abstracts appear, the click-through rate of traditional results decreases significantly. At this time, the enterprise station should not focus on total traffic, but on three indicators: brand word search volume and direct visits, visitor quality brought by AI citations, and the conversion rate of inquiries and leads. AnQiCMS's keyword library is maintained by question, and is supported by LLMs.txt and AI writing capabilities, so that each group of data has a verifiable source.

2026-11-01

If the search exposure is increasing but the clicks are not, first distinguish between zero clicks or rankings dropping.

The exposure increases while the clicks do not, first use question keywords to split the two sets of data: if the decline is concentrated in question queries, it is mostly caused by zero clicks due to generative abstracts; if the exposure of brand words and model words declines synchronously, it is a ranking issue. Confirm and then check the site map, link push, static rules and 301 redirect one after another, these four steps are about being discovered and seen as soon as possible, not solving the abstract interception.

2026-11-01

How much of the AI crawling proportion in the log needs to be limited separately

There is no universal proportion number that can directly trigger speed limit, the judgment depends on which layer the crawling pressure falls. First, use the log to separate the AI crawler from the search engine crawler and count separately, when the proportion increases but the server load is stable, only need to manage the robots instructions; only when the concurrent crawling really slows down the page loading speed, do you need to limit the bandwidth and frequency level, interference code solves another matter.

2026-11-01

How should the section be cut when AI answers extract content by paragraph?

The section should be divided according to 'a paragraph that can independently answer a question', not by word count or visual layout. The smallest unit taken away is a paragraph, so each section should only discuss a sub-question, provide a conclusion in the first sentence, and use references that do not depend on the previous text; the section title should be written as the question itself. The AI writing output of AnQiCMS still needs to be manually reviewed for facts, and then content review and TDK configuration are used to unify the口径.

2026-11-01