[TikiWiki-commits] [Git][tikiwiki/tiki][master] [FIX] Add feature checks for access control in multiple files

Rodriguez Nyiringabo pushed to branch master at Tiki Wiki CMS Groupware / Tiki


Commits:
7c56c24e by Rodriguez Nyiringabo at 2026-01-28T23:32:09+00:00
[FIX] Add feature checks for access control in multiple files
---
* [FIX] Add feature checks for access control in multiple files

See merge request tikiwiki/tiki!9407

- - - - -


6 changed files:

- doc/devtools/securitycheck.php
- installer/schema/20130513_convert_tracker_field_parameters_tiki.php
- tiki-carddav.php
- tiki-tracker_view_history.php
- tiki-xmpp-auth.php
- tiki-xmpp-rooms.php


Changes:

=====================================
doc/devtools/securitycheck.php
=====================================
@@ -50,6 +50,12 @@ $safePaths = [
     '\./' . DEPRECATED_DEVTOOLS_PATH . '/.*',
     '\./' . TIKI_CONFIG_FILE_PATH,
     '\./' . TIKI_CONFIG_PATH . '/virtuals.inc',
+    '\./node_modules/.*',
+    '\./_custom_dist/.*',
+    '\./_custom/.*',
+
+    '\./public/generated/.*', // generated files
+
 
     /* The following are DELIBERATELY PUBLIC. */
     '\./tiki-cookie-jar.php',


=====================================
installer/schema/20130513_convert_tracker_field_parameters_tiki.php
=====================================
@@ -1,5 +1,10 @@
 <?php
 
+if (str_contains($_SERVER["SCRIPT_NAME"], basename(__FILE__))) {
+    header("location: index.php");
+    exit;
+}
+
 require_once __DIR__ . '/../../lib/core/Cache/NoCache.php';
 
 use Tiki\Cache\NoCache;


=====================================
tiki-carddav.php
=====================================
@@ -12,6 +12,7 @@ use Tiki\SabreDav\BasicAuth;
 use Tiki\SabreDav\Utilities;
 
 require_once 'tiki-setup.php';
+$access->check_feature('feature_contacts');
 TikiLib::setExternalContext(true);
 
 $authBackend = new BasicAuth();


=====================================
tiki-tracker_view_history.php
=====================================
@@ -20,6 +20,8 @@ $inputConfiguration = [[
 ];
 $section = 'trackers';
 require_once('tiki-setup.php');
+$access->check_feature('feature_trackers');
+
 if (empty($_REQUEST["itemId"])) {
     Feedback::errorAndDie(tra("No tracker item indicated"), \Laminas\Http\Response::STATUS_CODE_400);
 }


=====================================
tiki-xmpp-auth.php
=====================================
@@ -10,6 +10,8 @@
 // - Also supports JSON POST for manual curl/debug
 
 require_once __DIR__ . '/tiki-setup.php';
+$access->check_feature('xmpp_feature');
+
 
 $prefslib = TikiLib::lib('prefs');
 $userslib = TikiLib::lib('user');


=====================================
tiki-xmpp-rooms.php
=====================================
@@ -1,6 +1,7 @@
 <?php
 
 require_once 'tiki-setup.php';
+$access->check_feature('xmpp_feature');
 
 header('Content-Type: application/json; charset=utf-8');
 



View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/7c56c24e0cc5f99a668480fb2b1f1d0742625502

-- 
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/7c56c24e0cc5f99a668480fb2b1f1d0742625502
You're receiving this email because of your account on gitlab.com.

_______________________________________________
TikiWiki-cvs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs