Re: Missing access checks in CreatePage and AppendText plugins
"Marc-Etienne Vargenau \(Nokia\) via Phpwiki-talk" <[email protected]> Wed, 30 Jul 2025 07:59:01 +0000
| Newsgroups | gmane.comp.web.wiki.phpwiki.talk |
|---|---|
| Message-ID | <PR3PR07MB8183DB2332A56A66922C1FF5AC24A@PR3PR07MB8183.eurprd07.prod.outlook.com> |
--===============5540399708447605812== Content-Language: fr-FR Content-Type: multipart/alternative; boundary="_000_PR3PR07MB8183DB2332A56A66922C1FF5AC24APR3PR07MB8183eurp_" --_000_PR3PR07MB8183DB2332A56A66922C1FF5AC24APR3PR07MB8183eurp_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hi Christof, Thank you for your patches. I have published them in Subversion. Best regards, Marc-Etienne -- Marc-Etienne Vargenau [email protected]<mailto:marc-etienne.v= [email protected]> Nokia, 12, rue Jean-Bart, 91300 Massy, FRANCE Mobile: +33 6 24 49 78 68<tel:+33624497868> Senior Specialist Open Source Planned absence: 4-22 August De : Christof Meerwald via Phpwiki-talk <[email protected]= > Date : mardi, 29 juillet 2025 =E0 23:24 =C0 : Phpwiki-talk <[email protected]> Cc : Christof Meerwald <[email protected]> Objet : Re: [Phpwiki-talk] Missing access checks in CreatePage and AppendTe= xt plugins CAUTION: This is an external email. Please be very careful when clicking li= nks or opening attachments. See the URL nok.it/ext for additional informati= on. On Tue, Jul 29, 2025 at 11:04:24PM +0200, Christof Meerwald wrote: > Noticed that the CreatePage and AppendText plugins let unauthenticated > users create pages or let them append text to pages, e.g. Actually, WikiAdminDeleteAcl is also missing an access check, patch attached. Christof -- https://eur03.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fcmeerw.= org%2F&data=3D05%7C02%7Cmarc-etienne.vargenau%40nokia.com%7C4e796218c09f47f= e61f408ddcee6362f%7C5d4717519675428d917b70f44f9630b0%7C0%7C0%7C638894210508= 983458%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIs= IlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=3Dw%2B9= pGigz7tN%2BhTJYA2nrg%2FgQ34nH6B59h0smjnzcheg%3D&reserved=3D0<https://cmeerw= .org/> sip:cmeerw at cmeerw.org mailto:cmeerw at cmeerw.org xmpp:cmeerw at cmeerw.org --_000_PR3PR07MB8183DB2332A56A66922C1FF5AC24APR3PR07MB8183eurp_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable <html xmlns:o=3D"urn:schemas-microsoft-com:office:office" xmlns:w=3D"urn:sc= hemas-microsoft-com:office:word" xmlns:m=3D"http://schemas.microsoft.com/of= fice/2004/12/omml" xmlns=3D"http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Diso-8859-= 1"> <meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)"> <style><!-- /* Font Definitions */ @font-face {font-family:"Cambria Math"; panose-1:2 4 5 3 5 4 6 3 2 4;} @font-face {font-family:Calibri; panose-1:2 15 5 2 2 2 4 3 2 4;} @font-face {font-family:Aptos; panose-1:2 11 0 4 2 2 2 2 2 4;} /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0cm; font-size:12.0pt; font-family:"Aptos",sans-serif;} a:link, span.MsoHyperlink {mso-style-priority:99; color:blue; text-decoration:underline;} span.EmailStyle19 {mso-style-type:personal-reply; font-family:"Aptos",sans-serif; color:windowtext;} .MsoChpDefault {mso-style-type:export-only; font-size:10.0pt; mso-ligatures:none;} @page WordSection1 {size:612.0pt 792.0pt; margin:70.85pt 70.85pt 70.85pt 70.85pt;} div.WordSection1 {page:WordSection1;} --></style> </head> <body lang=3D"FR" link=3D"blue" vlink=3D"purple" style=3D"word-wrap:break-w= ord"> <div class=3D"WordSection1"> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;mso-fareast-language= :EN-US">Hi Christof,<o:p></o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;mso-fareast-language= :EN-US"><o:p> </o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;mso-fareast-language= :EN-US">Thank you for your patches.<o:p></o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;mso-fareast-language= :EN-US">I have published them in Subversion.<o:p></o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;mso-fareast-language= :EN-US"><o:p> </o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;mso-fareast-language= :EN-US">Best regards,<o:p></o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;mso-fareast-language= :EN-US"><o:p> </o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;mso-fareast-language= :EN-US">Marc-Etienne<o:p></o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;mso-fareast-language= :EN-US"><o:p> </o:p></span></p> <div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Co= urier New";color:#212121">-- <br> Marc-Etienne Vargenau <a href=3D"mailto:marc-etienne.vargenau@nok= ia.com" title=3D"mailto:[email protected]"><span style=3D"col= or:#0078D7;text-decoration:none">marc-etienne</span><span style=3D"color:#0= 078D7">[email protected]</span></a><br> Nokia, 12, rue Jean-Bart, 91300 Massy, FRANCE<br> Mobile: <a href=3D"tel:+33624497868"><span style=3D"color:#0078D7">+33= 6 24 49 78 68</span></a></span><span style=3D"font-size:11.0pt;font-family= :"Calibri",sans-serif;color:#212121"><o:p></o:p></span></p> </div> </div> <p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Co= urier New";color:#212121;mso-fareast-language:EN-US">Senior Specialist= Open Source<br> Planned absence:</span><b><span style=3D"font-size:11.0pt;font-family:"= ;Courier New";color:#212121;mso-fareast-language:EN-US"> 4-22 August</= span></b><span style=3D"font-size:11.0pt;mso-fareast-language:EN-US"><o:p><= /o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;mso-fareast-language= :EN-US"><o:p> </o:p></span></p> <div id=3D"mail-editor-reference-message-container"> <div> <div> <div style=3D"border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm = 0cm 0cm"> <p class=3D"MsoNormal" style=3D"margin-bottom:12.0pt"><b><span style=3D"col= or:black">De : </span></b><span style=3D"color:black">Christof Meerwald via Phpwiki-talk &= lt;[email protected]><br> <b>Date : </b>mardi, 29 juillet 2025 =E0 23:24<br> <b>=C0 : </b>Phpwiki-talk <[email protected]><b= r> <b>Cc : </b>Christof Meerwald <[email protected]><br> <b>Objet : </b>Re: [Phpwiki-talk] Missing access checks in CreatePage = and AppendText plugins<o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt"><br> CAUTION: This is an external email. Please be very careful when clicking li= nks or opening attachments. See the URL nok.it/ext for additional informati= on.<br> <br> <br> <br> On Tue, Jul 29, 2025 at 11:04:24PM +0200, Christof Meerwald wrote:<br> > Noticed that the CreatePage and AppendText plugins let unauthenticated= <br> > users create pages or let them append text to pages, e.g.<br> <br> Actually, WikiAdminDeleteAcl is also missing an access check, patch<br> attached.<br> <br> <br> Christof<br> <br> --<br> <a href=3D"https://cmeerw.org/">https://eur03.safelinks.protection.outlook.= com/?url=3Dhttps%3A%2F%2Fcmeerw.org%2F&data=3D05%7C02%7Cmarc-etienne.va= rgenau%40nokia.com%7C4e796218c09f47fe61f408ddcee6362f%7C5d4717519675428d917= b70f44f9630b0%7C0%7C0%7C638894210508983458%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0= eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjo= yfQ%3D%3D%7C0%7C%7C%7C&sdata=3Dw%2B9pGigz7tN%2BhTJYA2nrg%2FgQ34nH6B59h0= smjnzcheg%3D&reserved=3D0</a> = &nb= sp; sip:cmeerw at cmeerw.org<br> <a href=3D"mailto:cmeerw">mailto:cmeerw</a> at cmeerw.org = &nb= sp; xmpp:cmeerw at cmeerw.org<o:p></o:p></span></p> </div> </div> </div> </div> </div> </body> </html> --_000_PR3PR07MB8183DB2332A56A66922C1FF5AC24APR3PR07MB8183eurp_-- --===============5540399708447605812== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============5540399708447605812== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Phpwiki-talk mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/phpwiki-talk --===============5540399708447605812==--