Quick fix for Windows-specific vulnerability before PmWiki 2.7.5

Petko Yotov <[email protected]>
Newsgroups gmane.comp.web.wiki.pmwiki.announce,gmane.comp.web.wiki.pmwiki.user
Message-ID <[email protected]>
This is a quick update to provide a manual fix for a recently reported 
vulnerability.

PmWiki 2.7.5 closed a vulnerability in PmWikis on Windows servers, 
reported by Michael Engelke. It potentially allows a person with edit 
access to a page, to retrieve the full source text of another page in a 
read-protected group where the person should not have access. All wikis 
versions 2.0.0 to 2.7.4 on Windows servers may be vulnerable.

If your PmWiki installation:
* runs on a Windows server, and
* your wiki allows editing for untrusted users, even only WikiSandbox, 
and
* you may have sensitive information in restricted wikigroups, such as 
SiteAdmin.Notify, and
* you cannot immediately upgrade to 2.7.5,

If your wiki meets all the conditions above, to close the vulnerability 
before you've had the chance to upgrade, you can add this to 
farmconfig.php or config.php:

if(!empty($_REQUEST['template']))
   $_REQUEST['template'] = preg_replace('![./\\\\]+!', '.', 
$_REQUEST['template']);

Petko
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.