[wp-hackers] "commenter" user role

[Dougal Campbell]

On Mar 5 2010 5:39 PM, scribu wrote:
> On Sat, Mar 6, 2010 at 12:23 AM, Otto<otto at ottodestruct.com>  wrote:
>
>    
>> As long as this has a master off-switch, because there's no way I'd
>> ever implement such a thing on my sites.
>>
>> My users table contains one user: me. It will never contain another.
>>
>>      
> There's a word for that: irrational fear.
>    

I very much disagree with that -- it's not irrational, and it's not 
necessarily fear.

  * It's a security concern: by keeping commenters out of the regular 
users table, you eliminate a class of security violations: unauthorized 
privilege escalation. If the commenter doesn't have any "real" user 
credentials, there are whole swathes of the core code paths that become 
inaccessible. An example of a privilege escalation can be as simple as 
the recent buglet that allowed unauthorized registered users to peek 
into the Trash. But it obviously, there *could* be more serious 
implications, if somebody forgets to put a capability check into place 
somewhere else.
  * It complicates the ability to support Anonymous commenters.
  * It opens the door to "dirty" the users table with tons of useless 
rows. I had open registration on one of my sites for a while, in order 
to support a plugin for a third-party login system, and in no time, I 
had tons of bogus user registrations. Quite annoying.

Now, the idea of moving comments to the post table is a separate 
discussion. There are pros and cons, for sure. On the pro side, you 
would eliminate a table, and you could replace most of the comment 
manipulation code with the existing post manipulation functions. On the 
con side you'll replace relational queries with sub-selects, and I think 
it wouldn't be as efficient. As far as the commenter data goes, 
obviously it could move to postmeta. So, sure, it *could* be done. I 
just don't think that any gains that we *might* get would be worth it. 
What are we trying to do, recreate Drupal's "everything is a node" 
structure?

-- 
Dougal Campbell <dougal at gunters.org>
http://dougal.gunters.org/
http://twitter.com/dougal
http://twitual.com/