On Mon, Dec 12, 2011 at 12:07 PM, Galen Charlton <gmc@esilibrary.com> wrote:
Hi,

Such an attack may be more theoretical than real, but my preference would be that if a script's logic should be accessible from the command line and the web interface, to put the logic in the API and have the CGI and CLI scripts just be thin wrappers.


I agree with this concern particularly, but also agree that scripts should be light-weight and "vanilla" as possible.

So +1 for having the logic in C4 and separate scripts to call it from there.

Kind Regards,
Chris