[TikiWiki-commits] [Git][tikiwiki/tiki][master] [FIX] wikiplugin_diagram: Incorrect permission and format detection logic in...

Benoit Grégoire pushed to branch master at Tiki Wiki CMS Groupware / Tiki


Commits:
653d1311 by Benoit Grégoire at 2026-02-19T18:38:25+00:00
[FIX] wikiplugin_diagram:  Incorrect permission and format detection logic in...
---
* [FIX] wikiplugin_diagram:  Incorrect permission and format detection logic in diagrams broke indexing.

See merge request tikiwiki/tiki!9607

- - - - -


2 changed files:

- lib/core/File/DiagramHelper.php
- lib/wiki-plugins/wikiplugin_diagram.php


Changes:

=====================================
lib/core/File/DiagramHelper.php
=====================================
@@ -77,24 +77,23 @@ class DiagramHelper
     {
         if (is_int($identifier)) {
             $diagramRoot = self::getDiagramsFromFileID($identifier, $page);
-        } else {
+        } elseif (is_string($identifier)) {
             $diagramRoot = self::getDiagramsFromXmlString($identifier, $page);
         }
 
-        if ($diagramRoot === false && ! empty($identifier)) {
-            Feedback::error(tr('The provided diagram XML is not valid. Please check and validate the diagram structure.'));
-        }
-
         $diagrams = [];
+        if ($diagramRoot !== false) {
+            foreach ($diagramRoot->diagram as $diagram) {
+                $diagramName = (string) $diagram->attributes()->name;
 
-        foreach ($diagramRoot->diagram as $diagram) {
-            $diagramName = (string) $diagram->attributes()->name;
+                if (! empty($page) && $page != $diagramName) {
+                    continue;
+                }
 
-            if (! empty($page) && $page != $diagramName) {
-                continue;
+                $diagrams[] = $diagram->asXML();
             }
-
-            $diagrams[] = $diagram->asXML();
+        } elseif (! empty($identifier)) { //We ignore a completely empty DIAGRAM plugin tag
+            Feedback::error(tr('The provided diagram XML is not valid. Please check and validate the diagram structure.'));
         }
 
         return $diagrams;
@@ -107,9 +106,13 @@ class DiagramHelper
      * @param string $page (optional) Name of the specific diagram page to return. If empty, all diagrams will be returned.
      * @return object
      */
-    public static function getDiagramsFromXmlString(string $rawXmlContent, string $page = '')
+    public static function getDiagramsFromXmlString(string $rawXmlContent, string $page = ''): \SimpleXMLElement|false
     {
-        return $diagramRoot = simplexml_load_string($rawXmlContent);
+        if ($rawXmlContent) {
+            return $diagramRoot = simplexml_load_string($rawXmlContent);
+        } else {
+            return false;
+        }
     }
 
     /**
@@ -119,7 +122,7 @@ class DiagramHelper
      * @param string $page (optional) Name of the specific diagram page to return. If empty, all diagrams will be returned.
      * @return false|object
      */
-    public static function getDiagramsFromFileID(int $identifier, string $page = '')
+    public static function getDiagramsFromFileID(int $identifier, string $page = ''): \SimpleXMLElement|false
     {
         $file = File::id($identifier);
 


=====================================
lib/wiki-plugins/wikiplugin_diagram.php
=====================================
@@ -101,11 +101,12 @@ function wikiplugin_diagram_info()
 function wikiplugin_diagram($data, $params)
 {
     global $user, $page, $wikiplugin_included_page, $prefs;
+    $pageName = $params['page'] ?? ''; //Important note:  you cannot rely on page being present (during indexing among other things).  I corrected a few related bugs, but there are most likely remaining incorrect assumptions in the plugin code. - benoitg - 2026-02-18
+
     $template = $params['template'];
     $galleryId = $params['galleryId'] ?? (! is_null($params['fileName']) ? 1 : '');
     $fileName = $params['fileName'] ?? 'Diagram %page% %date%.drawio' ;
-    $escapedPage = htmlentities($page, ENT_COMPAT);
-    $fileName = preg_replace('/\%page\%/', $page, $fileName);
+    $fileName = preg_replace('/\%page\%/', $pageName, $fileName);
     $fileName = preg_replace('/\%date\%/', date('Y-m-d'), $fileName);
 
     $compressXml = ! (($prefs['fgal_use_diagram_compression_by_default'] !== 'y'));
@@ -125,9 +126,9 @@ function wikiplugin_diagram($data, $params)
     }
 
     $diagramIdentifier = ! empty($params['fileId']) ? $params['fileId'] : $data;
+    $diagrams = DiagramHelper::getDiagramsFromIdentifier($diagramIdentifier, $pageName);  //This seems incorrect, there is no reason to believe multi-page diagrams would correspond to the current wiki page name. - benoitg - 2026-02-18
+
     $info = wikiplugin_diagram_info();
-    $pageName = $params['page'] ?? '';
-    $diagrams = DiagramHelper::getDiagramsFromIdentifier($diagramIdentifier, $pageName);
 
     if (! empty($params['align']) && in_array($params['align'], ['left', 'center', 'right'])) {
         $alignment = $params['align'];
@@ -183,17 +184,18 @@ function wikiplugin_diagram($data, $params)
     $fileId = intval($params['fileId'] ?? 0);
     $annotate = intval($params['annotate'] ?? 0);
 
+    $diagramString = $data; //There is really no reason this logic cannot be shared with the TIKI_PRINTING_PDF logic above - benoitg - 2026-02-18
     if ($fileId) {
         $file = \Tiki\FileGallery\File::id($fileId);
-        $data = $file->getContents();
+        $diagramString = $file->getContents();
 
-        if ($data === false) {
+        if ($diagramString === false) {
             Feedback::error(tr("Tiki wasn't able to find the file with id %0.", $fileId));
             return '';
         }
     }
 
-    $diagramXmlString = DiagramHelper::parseData($data);
+    $diagramXmlString = DiagramHelper::parseData($diagramString);
     static $diagramIndex = 0;
     ++$diagramIndex;
 
@@ -217,25 +219,30 @@ function wikiplugin_diagram($data, $params)
         $type = 'wiki page';
         $objectId = $page;
     } else {
-        throw new \RuntimeException('Missing parameters: either galleryId or page is required.');
+        //Diagram in the body of the plugin ($data), and we are not in a page global context (ex indexing, template using wikiplugin).  Not an error
+        $type = null;
+        $objectId = null;
     }
 
-    $objectperms = Perms::get([
-        'type' => $type,
-        'object' => $objectId,
-    ]);
+    $objectperms = null;
+    if ($objectId) {
+        $objectperms = Perms::get([
+            'type' => $type,
+            'object' => $objectId,
+        ]);
+    }
 
     if ($type === 'file gallery' && empty($galleryId)) {
         throw new LogicException("Invalid state: type is 'file gallery' but galleryId is empty.");
     }
 
-    if ($objectperms->edit) {
+    if ($objectperms?->edit) {
         $allowEdit = true;
     } else {
         $allowEdit = false;
     }
 
-    if ($objectperms->view) {
+    if ($objectperms?->view) {
         $allowView = true;
     } else {
         $allowView = false;
@@ -243,12 +250,12 @@ function wikiplugin_diagram($data, $params)
 
     //checking if the user has permissions on the wikipage to view the diagram
     if ((! empty($page) && ! $allowView )) {
-        Feedback::error(tr('Tiki wasn\'t able to display the Diagram on page %1%0%3. Please check the %1%2%3 permission on this %4.', $escapedPage, '<code>', 'tiki_p_view', '</code>', '<a href="tiki-objectpermissions.php#contenttabs_objectpermissions-1">permission page</a>'));
+        Feedback::error(tr('Tiki wasn\'t able to display the Diagram on page %1%0%3. Please check the %1%2%3 permission on this %4.', htmlentities($page, ENT_COMPAT), '<code>', 'tiki_p_view', '</code>', '<a href="tiki-objectpermissions.php#contenttabs_objectpermissions-1">permission page</a>'));
         return '';
     }
 
     if (function_exists('simplexml_load_string')) {
-        $doc = simplexml_load_string($diagramXmlString);
+        $doc = DiagramHelper::getDiagramsFromXmlString($diagramXmlString);
         if ($doc !== false && ($doc->getName() != 'mxGraphModel' && $doc->getName() != 'mxfile')) {
             Feedback::error(tr("Tiki wasn't able to parse the Diagram. Please check the diagram XML data and structure."));
             return '';
@@ -280,6 +287,7 @@ function wikiplugin_diagram($data, $params)
                 }
             }
 
+            $diagramXmlStringEncoded = '';
             if ($annotate && $infoImg = loadImageAnnotate($annotate)) {
                 $diagramXmlString = <<<XML
 <mxGraphModel grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="850" pageHeight="1100" background="#ffffff">



View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/653d13117ac763f9e3edfee07c9fe0afb8fd4150

-- 
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/653d13117ac763f9e3edfee07c9fe0afb8fd4150
You're receiving this email because of your account on gitlab.com. Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help

_______________________________________________
TikiWiki-cvs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs