[TikiWiki-commits] [Git][tikiwiki/tiki][master] [ENH] Redefine tracker permissions level to prevent anonymous access by default

Adrien Mbuya Maloba pushed to branch master at Tiki Wiki CMS Groupware / Tiki


Commits:
50caaddf by Moïse Nturubika at 2026-04-27T19:38:51+03:00
[ENH] Redefine tracker permissions level to prevent anonymous access by default
---
* [FIX] Fixx phpcs errors

* [ENH][REF] Refactor DB connection for DRYness and update tracker permission level to Risky

* [REF] Revert feature.php QuickPerms toggle to align with intended basic behavior

* [ENH] Refine tracker permissions and add check warnings

* [ENH] Redefine tracker permissions level to prevent anonymous access by default

See merge request tikiwiki/tiki!9674

- - - - -


2 changed files:

- lib/userslib.php
- tiki-check.php


Changes:

=====================================
lib/userslib.php
=====================================
@@ -5512,7 +5512,7 @@ class UsersLib extends TikiLib
             [
                 'name' => 'tiki_p_comment_tracker_items',
                 'description' => tra('Can post tracker item comments'),
-                'level' => 'basic',
+                'level' => 'registered',
                 'type' => 'trackers',
                 'admin' => false,
                 'prefs' => ['feature_trackers'],
@@ -5521,7 +5521,7 @@ class UsersLib extends TikiLib
             [
                 'name' => 'tiki_p_tracker_view_comments',
                 'description' => tra('Can view tracker item comments'),
-                'level' => 'basic',
+                'level' => 'registered',
                 'type' => 'trackers',
                 'admin' => false,
                 'prefs' => ['feature_trackers'],
@@ -5539,7 +5539,7 @@ class UsersLib extends TikiLib
             [
                 'name' => 'tiki_p_list_trackers',
                 'description' => tra('Can list trackers'),
-                'level' => 'basic',
+                'level' => 'registered',
                 'type' => 'trackers',
                 'admin' => false,
                 'prefs' => ['feature_trackers'],
@@ -5602,7 +5602,7 @@ class UsersLib extends TikiLib
             [
                 'name' => 'tiki_p_tracker_view_ratings',
                 'description' => tra('Can view rating result for tracker items'),
-                'level' => 'basic',
+                'level' => 'registered',
                 'type' => 'trackers',
                 'admin' => false,
                 'prefs' => ['feature_trackers'],
@@ -5638,7 +5638,7 @@ class UsersLib extends TikiLib
             [
                 'name' => 'tiki_p_view_trackers',
                 'description' => tra('Can view trackers'),
-                'level' => 'basic',
+                'level' => 'registered',
                 'type' => 'trackers',
                 'admin' => false,
                 'prefs' => ['feature_trackers'],


=====================================
tiki-check.php
=====================================
@@ -178,38 +178,60 @@ if (isset($_REQUEST['ajax']) && $_REQUEST['ajax'] === 'dashboard') {
     }
 
     // Check database connection if available
-    if (file_exists('./db/local.php')) {
-        require_once './db/local.php';
-        if (isset($host_tiki) && isset($user_tiki) && isset($pass_tiki) && isset($dbs_tiki)) {
-            $connection = mysqli_connect($host_tiki, $user_tiki, $pass_tiki, $dbs_tiki);
-            if ($connection) {
-                $mysql_properties['Database Connection'] = array(
-                    'fitness' => tra('good'),
-                    'fitness_status' => FITNESS_STATUS_GOOD,
-                    'setting' => 'Connected',
-                    'message' => tra('Database connection successful.')
-                );
-                mysqli_close($connection);
-            } else {
-                $mysql_properties['Database Connection'] = array(
-                    'fitness' => tra('bad'),
-                    'fitness_status' => FITNESS_STATUS_BAD,
-                    'setting' => 'Failed',
-                    'message' => tra('Database connection failed.')
-                );
-            }
-        }
+    $connection = get_tiki_check_db_connection();
+    if ($connection) {
+        $mysql_properties['Database Connection'] = array(
+            'fitness' => tra('good'),
+            'fitness_status' => FITNESS_STATUS_GOOD,
+            'setting' => 'Connected',
+            'message' => tra('Database connection successful.')
+        );
+    } else {
+        $mysql_properties['Database Connection'] = array(
+            'fitness' => tra('bad'),
+            'fitness_status' => FITNESS_STATUS_BAD,
+            'setting' => 'Failed',
+            'message' => tra('Database connection failed.')
+        );
     }
 
     // Run enhanced security checks for AJAX
     $db_permissions = check_database_config_permissions();
+    $tracker_perms = check_tracker_anonymous_permissions();
     $phpmyadmin_check = check_phpmyadmin_installations();
     $adminer_check = check_adminer_installations();
     $backup_config_check = check_backup_configuration_files();
     $directory_listing_check = check_directory_listing_vulnerabilities();
     $ssl_check = check_ssl_configuration();
 
-    $tiki_security['Database Configuration Permissions'] = $db_permissions;
+    if (! empty($db_permissions)) {
+        $tiki_security['Database Configuration Permissions'] = array(
+            'fitness' => tra('bad'),
+            'fitness_status' => FITNESS_STATUS_BAD,
+            'message' => tr('Database configuration file has insecure permissions: %0', implode(', ', $db_permissions))
+        );
+    } else {
+        $tiki_security['Database Configuration Permissions'] = array(
+            'fitness' => tra('safe'),
+            'fitness_status' => FITNESS_STATUS_SAFE,
+            'message' => tra('Database configuration file permissions are secure')
+        );
+    }
+
+    if (! empty($tracker_perms)) {
+        $tiki_security['Anonymous Tracker Permissions'] = array(
+            'fitness' => tra('risky'),
+            'fitness_status' => FITNESS_STATUS_RISKY,
+            'message' => tr('Anonymous group has global tracker permissions or dangerous defaults: %0', implode(', ', $tracker_perms))
+        );
+    } else {
+        $tiki_security['Anonymous Tracker Permissions'] = array(
+            'fitness' => tra('safe'),
+            'fitness_status' => FITNESS_STATUS_SAFE,
+            'message' => tra('Anonymous tracker permissions are secure')
+        );
+    }
+
     $tiki_security['phpMyAdmin Security'] = $phpmyadmin_check;
     $tiki_security['Adminer Security'] = $adminer_check;
     $tiki_security['Backup Configuration Files'] = $backup_config_check;
@@ -3573,6 +3595,22 @@ if (! empty($db_config_issues)) {
     );
 }
 
+// Check tracker anonymous permissions
+$tracker_perms_issues = check_tracker_anonymous_permissions();
+if (! empty($tracker_perms_issues)) {
+    $tiki_security['Anonymous Tracker Permissions'] = array(
+        'fitness' => tra('risky'),
+        'fitness_status' => FITNESS_STATUS_RISKY,
+        'message' => tr('Anonymous group has global tracker permissions or dangerous defaults: %0', implode(', ', $tracker_perms_issues))
+    );
+} else {
+    $tiki_security['Anonymous Tracker Permissions'] = array(
+        'fitness' => tra('safe'),
+        'fitness_status' => FITNESS_STATUS_SAFE,
+        'message' => tra('Anonymous tracker permissions are secure')
+    );
+}
+
 // Check for phpMyAdmin installations
 $phpmyadmin_issues = check_phpmyadmin_installations();
 if (! empty($phpmyadmin_issues)) {
@@ -5670,6 +5708,73 @@ function check_database_config_permissions()
     return $issues;
 }
 
+/**
+ * Get or establish a database connection for security checks
+ * Handles both standalone mode and integrated admin mode
+ *
+ * @return mysqli|null
+ */
+function get_tiki_check_db_connection()
+{
+    static $connection = null;
+
+    if ($connection !== null) {
+        return $connection;
+    }
+
+    global $standalone;
+
+    if ($standalone === false && class_exists('\TikiDb')) {
+        $tikiDb = \TikiDb::get();
+        if ($tikiDb && isset($tikiDb->db) && $tikiDb->db instanceof \mysqli) {
+            $connection = $tikiDb->db;
+            return $connection;
+        }
+    }
+
+    // Fallback to standalone logic or if TikiDb is not available/not mysqli
+    global $host_tiki, $user_tiki, $pass_tiki, $dbs_tiki;
+
+    if (! isset($host_tiki) || ! isset($user_tiki)) {
+        if (file_exists('db/local.php')) {
+            include 'db/local.php';
+        }
+    }
+
+    if (isset($host_tiki) && isset($user_tiki) && isset($pass_tiki) && isset($dbs_tiki)) {
+        $connection = @mysqli_connect($host_tiki, $user_tiki, $pass_tiki, $dbs_tiki);
+    }
+
+    return $connection;
+}
+
+/**
+ * Check for anonymous tracker permissions and dangerous defaults
+ * @return array Array of security issues found
+ */
+function check_tracker_anonymous_permissions()
+{
+    $issues = array();
+    $connection = get_tiki_check_db_connection();
+
+    if ($connection) {
+        $query = "SELECT permName FROM users_grouppermissions WHERE groupName = 'Anonymous' AND permName IN ('tiki_p_list_trackers', 'tiki_p_view_trackers')";
+        $result = mysqli_query($connection, $query);
+        $permsFound = array();
+        if ($result) {
+            while ($row = mysqli_fetch_array($result)) {
+                $permsFound[] = $row['permName'];
+            }
+        }
+
+        if (! empty($permsFound)) {
+            $issues[] = tr('Anonymous group has global tracker permissions (%0). Trackers may be publicly discoverable.', implode(', ', $permsFound));
+        }
+    }
+
+    return $issues;
+}
+
 /**
  * Check for phpMyAdmin installations
  * @return array Array of security issues found



View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/50caaddfe62c113fa4f48f028ec9f595d4eccc9f

-- 
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/50caaddfe62c113fa4f48f028ec9f595d4eccc9f
You're receiving this email because of your account on gitlab.com. Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help

_______________________________________________
TikiWiki-cvs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs