[TYPO3-dev] Extension manager

[Jan-Hendrik Heuing [DD]]

It depends on what you want to do. I'd probably go the other way, if you 
want to have users being able to edit templates, change 'admin' to 
'user,group' in the ts-module, change sys_template-settings to add it to the 
excludefields. Same for setting up users and groups, change settings in TCA 
including it's position in page0, you can technically host them in a 
sysfolder without any problems..

JH

"Bernhard Kraft" <kraftb at kraftb.at> schrieb im Newsbeitrag 
news:mailman.1.1152396322.13737.typo3-dev at lists.netfielders.de...
> Ingmar Schlecht wrote:
>
>>>So is there another way of gaining access to an extension (or 
>>>installing/uninstalling one)
>>>except typo3/mod/tools/em/index.php
>>
>>
>> Of course there is. Every TYPO3 admin is able to upload PHP files as
>> *.inc and execute them in the Frontend by inserting something like:
>> page.includeLibs.myHack = fileadmin/myhack.inc.
>>
>> That means with some custom PHP code you can gain access to the whole
>> installation including its PHP code if you're a TYPO3 admin.
>
> thanks ... one thing I didn't think about :)
>
> do you think there is another "workaround" if I disbale file-uploads 
> completely.
> (Simply by setting $_FILES to false in typo3/init.php)
>
>
> greets,
> Bernhard
> -- 
> ----------------------------------------------------------------------
> "Freiheit ist immer auch die Freiheit des Andersdenkenden"
> Rosa Luxemburg, 1871 - 1919
> ----------------------------------------------------------------------
> [[ http://think-open.at | Open source company ]]