Missing access checks in CreatePage and AppendText plugins

--MJcBdVwc+ajssIX4
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

Noticed that the CreatePage and AppendText plugins let unauthenticated
users create pages or let them append text to pages, e.g.

https://wikiurl.example.com/CreatePage?s=Test&template=Template/Example&initial_content=Hello

or

https://wikiurl.example.com/AppendText?page=HomePage&s=Test


Patch attached.


Christof

-- 
https://cmeerw.org                             sip:cmeerw at cmeerw.org
mailto:cmeerw at cmeerw.org                   xmpp:cmeerw at cmeerw.org

--MJcBdVwc+ajssIX4
Content-Type: text/x-diff; charset=utf-8
Content-Disposition: attachment; filename="add-access-check.diff"
Content-Transfer-Encoding: quoted-printable

Index: lib/plugin/AppendText.php
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
--- lib/plugin/AppendText.php	(revision 11199)
+++ lib/plugin/AppendText.php	(working copy)
@@ -106,6 +106,13 @@
             return HTML();
         }
=20
+        if (!mayAccessPage('change', $pagename)) {
+            $message =3D HTML::div();
+            $message->setAttr('class', 'error');
+            $message->pushContent(HTML::p(fmt("Access denied to change pag=
e =E2=80=9C%s=E2=80=9D.", $pagename)));
+            return $message;
+        }
+
         $page =3D $dbi->getPage($pagename);
         $message =3D HTML();
=20
Index: lib/plugin/CreatePage.php
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
--- lib/plugin/CreatePage.php	(revision 11199)
+++ lib/plugin/CreatePage.php	(working copy)
@@ -85,6 +85,13 @@
             return $this->error(_("Page name too long"));
         }
=20
+        if (!mayAccessPage('create', $s)) {
+            $message =3D HTML::div();
+            $message->setAttr('class', 'error');
+            $message->pushContent(HTML::p(fmt("Access denied to change pag=
e =E2=80=9C%s=E2=80=9D.", $s)));
+            return $message;
+        }
+
         $param =3D array('action' =3D> 'edit');
         if ($template and $dbi->isWikiPage($template)) {
             $param['template'] =3D $template;

--MJcBdVwc+ajssIX4
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


--MJcBdVwc+ajssIX4
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Phpwiki-talk mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/phpwiki-talk

--MJcBdVwc+ajssIX4--