That's why (mostly) static sites should be delivered as static HTML.
The only significant thing lost of comments, but they have been getting more spammy over the years. Its actually better now too in many ways and I fixed various issues during the move.
Having static site generator still require an admin endpoint that end users can use to author, publish or otherwise manage the content. Pushing that to a local tool means now you need to somehow synchronize that content across all of the end users devices without git. Not to mention if there is no server side component that means the client needs to have full permission to publish content on the server. Until recently ssh was the only option. Maybe someone could vibe an iroh app that gives you a vpn'd server side app without that now.
The first site I put up professionally was a handrolled static generator written in PHP for a state website. Users just edited text files, triggered a rebuild, and then there was a sync to prod if staging looked fine. They could even add new sections by creating new subdirectories, and Imagemagick would automatically conjure new menu buttons and the code would put them in the right place.
> Pushing that to a local tool means now you need to somehow synchronize that content across all of the end users devices without git.
This is not hard. Rsync? Rsyncd?
> Not to mention if there is no server side component
Why would there be no server-side component? What does that even mean? Just give them a script to trigger if you don't want them to have permission to do anything. Give them another script to revert if you don't want to get any emergency calls.
This is not advanced technology. Weird to talk about it like it's impossible.
> never useful or actually serious
So strange. That site was so simple to deal with that it stayed up for a decade after I left. Ancient technology.
Thanks for proving my point.
> This is not hard. Rsync? Rsyncd?
How do I do that on an iPad or an Android?
> Just give them a script to trigger if you don't want them to have permission to do anything.
uhhh, what permissions does that "script" have? or is that your /wp-admin equivilent?
> So strange.
Indeed.
(So old.....)
Unfortunately my static HTML is pre-rendered by a PHP engine before being served.
It's a static web site generator, powered by php :)
These particular vulnerabilities affect PHP scripts accepting POST requests as far as I've been able to gather so far.