Re: [Phpwiki-talk] Missing access checks in CreatePage and AppendText plugins

[Marc-Etienne V. (Nokia) <mar...@no...>]

Hi Harold,

Normally, you should not be able to create a page with a blank name.
I would be interested to know how to do it if you are able to reproduce.

To delete it, the only way I can think of is to go to PhpWikiAdministration, in Page Explorer put a star, then select only the blank page and Purge.

Best regards,

Marc-Etienne


--
Marc-Etienne Vargenau mar...@no...<mailto:mar...@no...>
Nokia, 12, rue Jean-Bart, 91300 Massy, FRANCE
Mobile: +33 6 24 49 78 68<tel:+33624497868>

Senior Specialist Open Source
Planned absence: none

De : Marc-Etienne Vargenau (Nokia) <mar...@no...>
Date : jeudi, 4 septembre 2025 à 09:52
À : Discussion on PhpWiki features, bugs, development. <php...@li...>
Objet : Re: [Phpwiki-talk] Missing access checks in CreatePage and AppendText plugins

Hi Harold,

The latest version of PhpWiki is 1.6.6.

You can see the version you are running by displaying the SystemInfo page:
http://phpwiki.demo.free.fr/index.php/SystemInfo


In the source code, the version can be found in files Makefile, lib/prepend.php and all pgsrc files.

The patches from Christof Meerwald (see below) are not yet in version 1.6.6, I will publish a new version with them.

Best regards,

Marc-Etienne


--
Marc-Etienne Vargenau mar...@no...<mailto:mar...@no...>
Nokia, 12, rue Jean-Bart, 91300 Massy, FRANCE
Mobile: +33 6 24 49 78 68<tel:+33624497868>

Senior Specialist Open Source
Planned absence: none

De : Harold Hallikainen <ha...@ha...>
Date : mercredi, 3 septembre 2025 à 19:55
À : Discussion on PhpWiki features, bugs, development. <php...@li...>
Objet : Re: [Phpwiki-talk] Missing access checks in CreatePage and AppendText plugins


CAUTION: This is an external email. Please be very careful when clicking links or opening attachments. See the URL nok.it/ext for additional information.



I've had this update on my list of things to do, but had not yet gotten to
it. This morning, there were a bunch of new blank pages on one of my
wikis. So, I deleted them and did the update. Is there an easy way to tell
what version I have installed to make sure I did it correctly? The wiki is
running, but I'd like to make sure it is running the latest code.

Also, one of the newly created pages has a title that is blank, and I
cannot delete it through the admin interface. Is there a way to delete it?

THANKS!

Harold


On Wed, July 30, 2025 12:59 am, Marc-Etienne Vargenau \(Nokia\) via
Phpwiki-talk wrote:
> Hi Christof,
>
>
> Thank you for your patches.
> I have published them in Subversion.
>
>
> Best regards,
>
>
> Marc-Etienne
>
>
> --
> Marc-Etienne Vargenau
> mar...@no...<mailto:mar...@no...>
> Nokia, 12, rue Jean-Bart, 91300 Massy, FRANCE
> Mobile: +33 6 24 49 78 68<tel:+33624497868>
> Senior Specialist Open Source
> Planned absence: 4-22 August
>
>
> De : Christof Meerwald via Phpwiki-talk
> <php...@li...>
> Date : mardi, 29 juillet 2025 à 23:24
> À : Phpwiki-talk <php...@li...>
> Cc : Christof Meerwald <cm...@cm...>
> Objet : Re: [Phpwiki-talk] Missing access checks in CreatePage and
> AppendText plugins
>
>
> CAUTION: This is an external email. Please be very careful when clicking
> links or opening attachments. See the URL nok.it/ext for additional
> information.
>
>
>
> On Tue, Jul 29, 2025 at 11:04:24PM +0200, Christof Meerwald wrote:
>
>> Noticed that the CreatePage and AppendText plugins let unauthenticated
>> users create pages or let them append text to pages, e.g.
>
> Actually, WikiAdminDeleteAcl is also missing an access check, patch
> attached.
>
>
> Christof
>
>
> --
> https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcmeerw.o%2F&data=05%7C02%7Cmarc-etienne.vargenau%40nokia.com%7C3f24d955fb20401444b408ddeb1316e7%7C5d4717519675428d917b70f44f9630b0%7C0%7C0%7C638925189423530808%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=OiyIJxyrNr9KpLerPD282%2FaY5pxuOv4YK2Btjw8baCQ%3D&reserved=0<https://cmeerw.o/>
> rg%2F&data=05%7C02%7Cmarc-etienne.vargenau%40nokia.com%7C4e796218c09f47fe
> 61f408ddcee6362f%7C5d4717519675428d917b70f44f9630b0%7C0%7C0%7C63889421050
> 8983458%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwM
> CIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=w%
> 2B9pGigz7tN%2BhTJYA2nrg%2FgQ34nH6B59h0smjnzcheg%3D&reserved=0<https://cme
> erw.org/>                             sip:cmeerw at cmeerw.org
> mailto:cmeerw at cmeerw.org                   xmpp:cmeerw at cmeerw.org
> _______________________________________________
> Phpwiki-talk mailing list
> Php...@li...
> https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.sourceforge.net%2Flists%2Flistinfo%2Fphpwiki-talk&data=05%7C02%7Cmarc-etienne.vargenau%40nokia.com%7C3f24d955fb20401444b408ddeb1316e7%7C5d4717519675428d917b70f44f9630b0%7C0%7C0%7C638925189423568480%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=6Ovckr72RjkaAZq5TDwJVzgrc4heKIWvaLqhXIp70h0%3D&reserved=0<https://lists.sourceforge.net/lists/listinfo/phpwiki-talk>
>
>


--
Not sent from an iPhone.


--
Not sent from an iPhone.


_______________________________________________
Phpwiki-talk mailing list
Php...@li...
https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.sourceforge.net%2Flists%2Flistinfo%2Fphpwiki-talk&data=05%7C02%7Cmarc-etienne.vargenau%40nokia.com%7C3f24d955fb20401444b408ddeb1316e7%7C5d4717519675428d917b70f44f9630b0%7C0%7C0%7C638925189423585832%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=v7VnGkTGpbMbdsl6Se8FSYmZptpfMw4%2F1ZR9hIAnYQc%3D&reserved=0<https://lists.sourceforge.net/lists/listinfo/phpwiki-talk>