[TikiWiki-commits] [Git][tikiwiki/tiki][27.x] [FIX] Realtime: prevent empty WebSocket token from reusing admin Perms

Alfred Syatsukwa pushed to branch 27.x at Tiki Wiki CMS Groupware / Tiki


Commits:
83d945b4 by Alfred Syatsukwa at 2026-08-18T12:28:42+00:00
[FIX] Realtime: prevent empty WebSocket token from reusing admin Perms
---
* [FIX] Realtime: prevent empty WebSocket token from reusing admin Perms
---

See merge request tikiwiki/tiki!10948

(cherry picked from commit fa9aaa02f7a09c9e86c98c862398f9a502bfe9f9)

See merge request tikiwiki/tiki!10950

- - - - -


2 changed files:

- lib/core/Realtime/Console.php
- lib/core/Realtime/SessionAwareApp.php


Changes:

=====================================
lib/core/Realtime/Console.php
=====================================
@@ -78,6 +78,9 @@ class Console extends SessionAwareApp
 
     protected function formatHtml($text)
     {
+        if (! class_exists(\TikiManager\Config\App::class)) {
+            return htmlspecialchars((string) $text, ENT_QUOTES, 'UTF-8');
+        }
         $formatter = \TikiManager\Config\App::get('ConsoleHtmlFormatter');
         return $formatter->format($text);
     }


=====================================
lib/core/Realtime/SessionAwareApp.php
=====================================
@@ -32,7 +32,7 @@ class SessionAwareApp implements MessageComponentInterface
         global $user;
 
         parse_str($conn->httpRequest->getUri()->getQuery(), $queryParameters);
-        $this->sessions->attach($conn, $queryParameters['token']);
+        $this->sessions->attach($conn, $queryParameters['token'] ?? '');
 
         // TODO: divide session switch and user retrival with a new preference
         $this->switchSession($conn);
@@ -63,6 +63,9 @@ class SessionAwareApp implements MessageComponentInterface
 
         $session_id = $this->sessions[$conn];
         if (empty($session_id)) {
+            $user = null;
+            $_permissionContext = new Perms_Context($user, false);
+            $_permissionContext->activatePermanently();
             return;
         }
 



View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/83d945b491eff57a7bf70780f2af15f52112d791

-- 
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/83d945b491eff57a7bf70780f2af15f52112d791
You're receiving this email because of your account on gitlab.com. Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help

_______________________________________________
TikiWiki-cvs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs