[TikiWiki-commits] [Git][tikiwiki/tiki][29.x] [BP][FIX] Plugin Diagram: permission to edit the wiki page wasn't considered

Joel Mpunga pushed to branch 29.x at Tiki Wiki CMS Groupware / Tiki


Commits:
f1d4d253 by Joel Mpunga at 2025-10-04T20:00:46+00:00
[BP][FIX] Plugin Diagram: permission to edit the wiki page wasn't considered
---
* [FIX] Plugin Diagram: permission to edit the wiki page wasn't considered
---
* [FIX] Plugin Diagram: permission to edit the wiki page wasn't considered

See merge request tikiwiki/tiki!5406

See merge request tikiwiki/tiki!8501

- - - - -


2 changed files:

- lib/wiki-plugins/wikiplugin_diagram.php
- tiki-editdiagram.php


Changes:

=====================================
lib/wiki-plugins/wikiplugin_diagram.php
=====================================
@@ -204,19 +204,14 @@ function wikiplugin_diagram($data, $params)
     }
 
     //checking if user has edit permissions on the wiki page/file using the current permission library to obey global/categ/object perms
-    if (! empty($galleryId)) {
-        if (is_numeric($galleryId)) {
-            $type = 'file gallery';
-            $objectId = $_REQUEST['fileId'] ?? null;
-        } else {
-            Feedback::error(tr('Invalid %0%1%2: must be numeric', '<code>', 'galleryId', '</code>'));
-            return '';
-        }
+    if (! empty($galleryId) && is_numeric($galleryId)) {
+        $type = 'file gallery';
+        $objectId = $_REQUEST['fileId'] ?? null;
     } elseif (! empty($page)) {
         $type = 'wiki page';
         $objectId = $page;
     } else {
-        throw new \RuntimeException('Missing parameters: either galleryId or page is required.');
+        throw new \RuntimeException('Missing or invalid galleryId and/or page');
     }
 
     $objectperms = Perms::get([


=====================================
tiki-editdiagram.php
=====================================
@@ -34,19 +34,9 @@ $backLocation = '';
 $baseUrl = (isset($_SERVER['HTTPS']) ? "https://" : "http://") . $_SERVER['HTTP_HOST'] . dirname($_SERVER['SCRIPT_NAME']) . '/';
 $referer = $_SERVER['HTTP_REFERER'] ?? '';
 
-if (! empty($galleryId)) {
-    if (is_numeric($galleryId)) {
-        $type = 'file gallery';
-        $objectId = $_REQUEST['fileId'] ?? null;
-    } else {
-        if (strpos($referer, $baseUrl) === 0) {
-            header('Location: ' . $referer);
-        } else {
-            header("Location: " . $baseUrl . "tiki-list_file_gallery.php");
-        }
-        Feedback::error(tr('Invalid %0%1%2: must be numeric', '<code>', 'galleryId', '</code>'));
-        return '';
-    }
+if (! empty($galleryId) && is_numeric($galleryId)) {
+    $type = 'file gallery';
+    $objectId = $_REQUEST['fileId'] ?? null;
 } elseif (! empty($page)) {
     $type = 'wiki page';
     $objectId = $page;
@@ -56,7 +46,7 @@ if (! empty($galleryId)) {
     } else {
         header("Location: " . $baseUrl . "tiki-list_file_gallery.php");
     }
-    Feedback::error(tr('Missing parameters: either %0%1%2 or %0%3%2 is required.', '<code>', 'galleryId', '</code>', 'page'));
+    Feedback::error(tr('Missing or invalid %0%1%2 and/or %0%3%2', '<code>', 'galleryId', '</code>', 'page'));
     return '';
 }
 



View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/f1d4d2536e509bcc996f7552c9ed10a390ac1bf8

-- 
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/f1d4d2536e509bcc996f7552c9ed10a390ac1bf8
You're receiving this email because of your account on gitlab.com.

_______________________________________________
TikiWiki-cvs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs