CMS App Framework Isolation via Segmented Runtime
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing content management systems (CMS) face issues with plugin integration, where plugins become hardwired to specific versions, making upgrades difficult, and lack isolation between components, leading to security threats and compatibility problems.
Innovation Solution
An application framework that develops APPs as agents running within a CMS in a well-defined environment, allowing for independent updates and isolation from the CMS platform, with a security process to manage API calls and permissions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If plugins are directly integrated into the CMS code base, then customization functionality is achieved, but system upgradeability deteriorates
Solution Approach 1:
The system divides the CMS into separate independent components: the core CMS platform and the plugins. Each plugin runs in its own isolated environment (iframe with sandbox attribute), preventing direct integration into the CMS code base. This segmentation allows the CMS to be upgraded independently without affecting plugins, while plugins remain customizable and functional.
Solution Approach 2:
The patent introduces an intermediary communication mechanism between the CMS and plugins through standardized API interfaces and message passing via postMessage API. This intermediary layer enables customization functionality without direct code integration, allowing the CMS to maintain its integrity and upgradeability while still providing extensive customization through plugins that communicate through the defined interface.
2Ease of operation
If plugins are merged with the CMS code base, then integration is achieved, but security deteriorates
Solution Approach 1:
The system segments the execution environment by running each plugin in a separate iframe with sandbox attributes, isolating plugin code from the main CMS code base. This physical separation maintains secure integration while preventing security threats from propagating to the core system.
Solution Approach 2:
The patent applies different security characteristics to different parts of the system. The CMS core operates with full privileges, while plugins operate with restricted privileges within their sandboxed environments. This local differentiation of security properties allows integration while containing security risks to specific plugin contexts.
3Adaptability or versatility
If plugins are directly integrated into the CMS, then functionality extension is achieved, but fault isolation deteriorates
Solution Approach 1:
The system segments plugin execution into isolated iframe environments, allowing functionality extension while preventing faults from propagating between plugins or to the core CMS. Each plugin operates independently with its own execution context.
Solution Approach 2:
The patent uses iframes as flexible isolation shells that contain plugin execution environments. These iframe shells provide boundary enforcement while allowing controlled communication through the postMessage API, enabling functionality extension with maintained fault isolation.
4Ease of operation
If plugins are merged with the CMS code base, then seamless operation is achieved, but permission control deteriorates
Solution Approach 1:
The patent implements a universal permission control mechanism that works across all plugins through standardized API interfaces. The same permission checking logic and authentication mechanisms apply uniformly to all plugins, providing consistent permission control without requiring separate complex systems for each plugin.
Solution Approach 2:
The system introduces an intermediary permission checking layer that mediates all communications between plugins and the CMS. This intermediary enforces permission rules uniformly across all plugins while maintaining seamless operation through standardized interfaces, avoiding the need for complex individual permission systems.
Data Source
AI summary
Systems and methods for integrating applications with a content management system (CMS) are provided. One method includes providing access to the CMS via a web editor executed on a client browser, which enables creating and editing content associated with each of a plurality of content types of a content project. The method includes receiving selection of an APP to add functionality of the APP to the web editor, and in response, a separate runtime environment for the APP is launched that causes assignment of an identity to the APP. A unique access token is assigned to the APP for making content management API calls to the CMS for creating and editing content of the content project. The separate runtime environment provides for separation of code used for executing the web editor and used for executing the APP, such that a fault, error or malfunction caused by execution of the APP is not attributed to the web editor.