[TikiWiki-commits] [Git][tikiwiki/tiki][30.x] [FIX] Realtime: prevent empty WebSocket token from reusing admin Perms

Alfred Syatsukwa pushed to branch 30.x at Tiki Wiki CMS Groupware / Tiki


Commits:
c6ec5b17 by Alfred Syatsukwa at 2026-08-18T11:21:41+00:00
[FIX] Realtime: prevent empty WebSocket token from reusing admin Perms
---
* [FIX] Realtime: prevent empty WebSocket token from reusing admin Perms
---

See merge request tikiwiki/tiki!10945

(cherry picked from commit 1f91b9c0f1d9e25ebab5537d15acac3386bfaf0e)

See merge request tikiwiki/tiki!10946

- - - - -


2 changed files:

- lib/core/Realtime/Console.php
- lib/core/Realtime/SessionAwareApp.php


Changes:

=====================================
lib/core/Realtime/Console.php
=====================================
@@ -78,7 +78,10 @@ class Console extends SessionAwareApp
 
     protected function formatHtml($text)
     {
-        $formatter = \TikiManager\Config\App::get('ConsoleHtmlFormatter'); // @phpstan-ignore class.notFound (depends on TikiManager, which isn't installed by default)
+        if (! class_exists(\TikiManager\Config\App::class)) {
+            return htmlspecialchars((string) $text, ENT_QUOTES, 'UTF-8');
+        }
+        $formatter = \TikiManager\Config\App::get('ConsoleHtmlFormatter');
         return $formatter->format($text);
     }
 


=====================================
lib/core/Realtime/SessionAwareApp.php
=====================================
@@ -32,7 +32,7 @@ class SessionAwareApp implements MessageComponentInterface
         global $user;
 
         parse_str($conn->httpRequest->getUri()->getQuery(), $queryParameters);
-        $this->sessions->attach($conn, $queryParameters['token']);
+        $this->sessions->attach($conn, $queryParameters['token'] ?? '');
 
         // TODO: divide session switch and user retrival with a new preference
         $this->switchSession($conn);
@@ -63,6 +63,9 @@ class SessionAwareApp implements MessageComponentInterface
 
         $session_id = $this->sessions[$conn];
         if (empty($session_id)) {
+            $user = null;
+            $_permissionContext = new Perms_Context($user, false);
+            $_permissionContext->activatePermanently();
             return;
         }
 



View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/c6ec5b1715e5231bcd83a6dc86a89e1fcaf8336c

-- 
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/c6ec5b1715e5231bcd83a6dc86a89e1fcaf8336c
You're receiving this email because of your account on gitlab.com. Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help

_______________________________________________
TikiWiki-cvs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs