Re: Missing access checks in CreatePage and AppendText plugins

--VCbNm37/k2pqLR3v
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

On Tue, Jul 29, 2025 at 11:04:24PM +0200, Christof Meerwald wrote:
> Noticed that the CreatePage and AppendText plugins let unauthenticated
> users create pages or let them append text to pages, e.g.

Actually, WikiAdminDeleteAcl is also missing an access check, patch
attached.


Christof

-- 
https://cmeerw.org                             sip:cmeerw at cmeerw.org
mailto:cmeerw at cmeerw.org                   xmpp:cmeerw at cmeerw.org

--VCbNm37/k2pqLR3v
Content-Type: text/x-diff; charset=utf-8
Content-Disposition: attachment; filename="add-access-check-2.diff"
Content-Transfer-Encoding: quoted-printable

Index: lib/plugin/WikiAdminDeleteAcl.php
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
--- lib/plugin/WikiAdminDeleteAcl.php	(revision 11199)
+++ lib/plugin/WikiAdminDeleteAcl.php	(working copy)
@@ -50,20 +50,25 @@
         $perm->sanify();
         foreach ($pages as $pagename) {
             // check if unchanged? we need a deep array_equal
-            $page =3D $dbi->getPage($pagename);
-            setPagePermissions($page, $perm);
-            $result->setAttr('class', 'feedback');
-            $result->pushContent(HTML::p(fmt("ACL deleted for page =E2=80=
=9C%s=E2=80=9D", $pagename)));
-            $current =3D $page->getCurrentRevision();
-            $version =3D $current->getVersion();
-            $meta =3D $current->_data;
-            $text =3D $current->getPackedContent();
-            $meta['summary'] =3D sprintf(_("ACL deleted for page =E2=80=9C=
%s=E2=80=9D"), $pagename);
-            $meta['is_minor_edit'] =3D 1;
-            $meta['author'] =3D $request->_user->UserName();
-            unset($meta['mtime']); // force new date
-            $page->save($text, $version + 1, $meta);
-            $count++;
+            if (mayAccessPage('change', $pagename)) {
+                $page =3D $dbi->getPage($pagename);
+                setPagePermissions($page, $perm);
+                $result->setAttr('class', 'feedback');
+                $result->pushContent(HTML::p(fmt("ACL deleted for page =E2=
=80=9C%s=E2=80=9D", $pagename)));
+                $current =3D $page->getCurrentRevision();
+                $version =3D $current->getVersion();
+                $meta =3D $current->_data;
+                $text =3D $current->getPackedContent();
+                $meta['summary'] =3D sprintf(_("ACL deleted for page =E2=
=80=9C%s=E2=80=9D"), $pagename);
+                $meta['is_minor_edit'] =3D 1;
+                $meta['author'] =3D $request->_user->UserName();
+                unset($meta['mtime']); // force new date
+                $page->save($text, $version + 1, $meta);
+                $count++;
+            } else {
+                $result->setAttr('class', 'error');
+                $result->pushContent(HTML::p(fmt("Access denied to change =
page =E2=80=9C%s=E2=80=9D.", $pagename)));
+            }
         }
         if ($count) {
             $dbi->touch();

--VCbNm37/k2pqLR3v
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


--VCbNm37/k2pqLR3v
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Phpwiki-talk mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/phpwiki-talk

--VCbNm37/k2pqLR3v--