phpwiki-checkins Mailing List for PhpWiki

SourceForge Headquarters 1320 Columbia Street Suite 310 San Diego, CA 92101 +1 (858) 422-6466

Revision: 11200
          http://sourceforge.net/p/phpwiki/code/11200
Author:   vargenau
Date:     2025-07-30 07:57:02 +0000 (Wed, 30 Jul 2025)
Log Message:
-----------
Add access checks for plugins AppendText, CreatePage and WikiAdminDeleteAcl (patches by Christof Meerwald)

Modified Paths:
--------------
    trunk/lib/plugin/AppendText.php
    trunk/lib/plugin/CreatePage.php
    trunk/lib/plugin/WikiAdminDeleteAcl.php
    trunk/pgsrc/ReleaseNotes

Modified: trunk/lib/plugin/AppendText.php
===================================================================

--- trunk/lib/plugin/AppendText.php	2025-05-05 19:11:33 UTC (rev 11199)
+++ trunk/lib/plugin/AppendText.php	2025-07-30 07:57:02 UTC (rev 11200)
@@ -106,6 +106,13 @@
             return HTML();
         }
 
+        if (!mayAccessPage('change', $pagename)) {
+            $message = HTML::div();
+            $message->setAttr('class', 'error');
+            $message->pushContent(HTML::p(fmt("Access denied to change page “%s”.", $pagename)));
+            return $message;
+        }
+
         $page = $dbi->getPage($pagename);
         $message = HTML();
 

Modified: trunk/lib/plugin/CreatePage.php
===================================================================
--- trunk/lib/plugin/CreatePage.php	2025-05-05 19:11:33 UTC (rev 11199)
+++ trunk/lib/plugin/CreatePage.php	2025-07-30 07:57:02 UTC (rev 11200)
@@ -85,6 +85,13 @@
             return $this->error(_("Page name too long"));
         }
 
+        if (!mayAccessPage('create', $s)) {
+            $message = HTML::div();
+            $message->setAttr('class', 'error');
+            $message->pushContent(HTML::p(fmt("Access denied to change page “%s”.", $s)));
+            return $message;
+        }
+
         $param = array('action' => 'edit');
         if ($template and $dbi->isWikiPage($template)) {
             $param['template'] = $template;

Modified: trunk/lib/plugin/WikiAdminDeleteAcl.php
===================================================================
--- trunk/lib/plugin/WikiAdminDeleteAcl.php	2025-05-05 19:11:33 UTC (rev 11199)
+++ trunk/lib/plugin/WikiAdminDeleteAcl.php	2025-07-30 07:57:02 UTC (rev 11200)
@@ -50,20 +50,25 @@
         $perm->sanify();
         foreach ($pages as $pagename) {
             // check if unchanged? we need a deep array_equal
-            $page = $dbi->getPage($pagename);
-            setPagePermissions($page, $perm);
-            $result->setAttr('class', 'feedback');
-            $result->pushContent(HTML::p(fmt("ACL deleted for page “%s”", $pagename)));
-            $current = $page->getCurrentRevision();
-            $version = $current->getVersion();
-            $meta = $current->_data;
-            $text = $current->getPackedContent();
-            $meta['summary'] = sprintf(_("ACL deleted for page “%s”"), $pagename);
-            $meta['is_minor_edit'] = 1;
-            $meta['author'] = $request->_user->UserName();
-            unset($meta['mtime']); // force new date
-            $page->save($text, $version + 1, $meta);
-            $count++;
+            if (mayAccessPage('change', $pagename)) {
+                $page = $dbi->getPage($pagename);
+                setPagePermissions($page, $perm);
+                $result->setAttr('class', 'feedback');
+                $result->pushContent(HTML::p(fmt("ACL deleted for page “%s”", $pagename)));
+                $current = $page->getCurrentRevision();
+                $version = $current->getVersion();
+                $meta = $current->_data;
+                $text = $current->getPackedContent();
+                $meta['summary'] = sprintf(_("ACL deleted for page “%s”"), $pagename);
+                $meta['is_minor_edit'] = 1;
+                $meta['author'] = $request->_user->UserName();
+                unset($meta['mtime']); // force new date
+                $page->save($text, $version + 1, $meta);
+                $count++;
+            } else {
+                $result->setAttr('class', 'error');
+                $result->pushContent(HTML::p(fmt("Access denied to change page “%s”.", $pagename)));
+            }
         }
         if ($count) {
             $dbi->touch();

Modified: trunk/pgsrc/ReleaseNotes
===================================================================
--- trunk/pgsrc/ReleaseNotes	2025-05-05 19:11:33 UTC (rev 11199)
+++ trunk/pgsrc/ReleaseNotes	2025-07-30 07:57:02 UTC (rev 11200)
@@ -1,4 +1,4 @@
-Date: Mon,  5 May 2025 19:51:55 +0000
+Date: Wed, 30 Jul 2025 09:42:13 +0000
 Mime-Version: 1.0 (Produced by PhpWiki 1.6.6)
 Content-Type: application/x-phpwiki;
   pagename=ReleaseNotes;
@@ -9,6 +9,10 @@
 
 <<CreateToc with_toclink||=1 headers||=1,2,3 width=300px position=right>>
 
+== 1.6.7 2025-XX-XX Marc-Etienne Vargenau, Christof Meerwald ==
+
+* Add access checks for plugins AppendText, CreatePage and WikiAdminDeleteAcl (patches by Christof Meerwald)
+
 == 1.6.6 2025-05-05 Marc-Etienne Vargenau, Christof Meerwald ==
 
 * Fix PDO SQL syntax (patch by Christof Meerwald)

This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.





2000	Jan	Feb	Mar	Apr	May	Jun	Jul	Aug	Sep	Oct (43)	Nov (73)	Dec (10)
2001	Jan (34)	Feb (110)	Mar (24)	Apr (44)	May (37)	Jun (22)	Jul (20)	Aug (28)	Sep (50)	Oct (11)	Nov (132)	Dec (595)
2002	Jan (1099)	Feb (579)	Mar (63)	Apr	May	Jun	Jul	Aug (125)	Sep (101)	Oct (25)	Nov (34)	Dec (47)
2003	Jan (82)	Feb (182)	Mar (71)	Apr (3)	May (1)	Jun (3)	Jul	Aug	Sep (14)	Oct (6)	Nov (124)	Dec (68)
2004	Jan (64)	Feb (191)	Mar (199)	Apr (298)	May (252)	Jun (426)	Jul (134)	Aug (13)	Sep (96)	Oct (75)	Nov (232)	Dec (171)
2005	Jan (205)	Feb (165)	Mar (8)	Apr (74)	May (21)	Jun (19)	Jul (37)	Aug (69)	Sep (141)	Oct (118)	Nov (31)	Dec (7)
2006	Jan (5)	Feb (10)	Mar (35)	Apr (24)	May (34)	Jun (29)	Jul (5)	Aug (38)	Sep (30)	Oct (37)	Nov (30)	Dec (86)
2007	Jan (414)	Feb (40)	Mar (18)	Apr (10)	May (66)	Jun (60)	Jul (105)	Aug (55)	Sep (64)	Oct (7)	Nov (11)	Dec (5)
2008	Jan (26)	Feb (28)	Mar (79)	Apr (34)	May (61)	Jun (24)	Jul (29)	Aug (160)	Sep (62)	Oct (70)	Nov (32)	Dec (14)
2009	Jan (140)	Feb (135)	Mar (153)	Apr (53)	May (24)	Jun (138)	Jul (90)	Aug (46)	Sep (72)	Oct (84)	Nov (32)	Dec (4)
2010	Jan (13)	Feb (7)	Mar (14)	Apr (55)	May (89)	Jun (131)	Jul (41)	Aug (38)	Sep (42)	Oct (11)	Nov (27)	Dec (54)
2011	Jan (127)	Feb (16)	Mar (71)	Apr (52)	May (32)	Jun (31)	Jul (4)	Aug	Sep (45)	Oct (26)	Nov (36)	Dec (10)
2012	Jan (23)	Feb (6)	Mar (13)	Apr (18)	May (1)	Jun (4)	Jul (3)	Aug (12)	Sep (57)	Oct (96)	Nov (163)	Dec (124)
2013	Jan (11)	Feb (17)	Mar (7)	Apr (48)	May (15)	Jun (29)	Jul (12)	Aug	Sep (9)	Oct	Nov	Dec (3)
2014	Jan (4)	Feb (1)	Mar (2)	Apr (1)	May (8)	Jun (90)	Jul (104)	Aug (12)	Sep (81)	Oct (139)	Nov (111)	Dec (64)
2015	Jan (46)	Feb (74)	Mar (56)	Apr (61)	May (3)	Jun (7)	Jul (11)	Aug (5)	Sep (15)	Oct (1)	Nov (1)	Dec (15)
2016	Jan (25)	Feb (33)	Mar (24)	Apr (4)	May (24)	Jun (3)	Jul (75)	Aug	Sep (2)	Oct (38)	Nov (4)	Dec (18)
2017	Jan (8)	Feb (1)	Mar (1)	Apr	May (14)	Jun	Jul (5)	Aug (9)	Sep	Oct (23)	Nov	Dec
2018	Jan	Feb	Mar	Apr	May	Jun (2)	Jul	Aug	Sep	Oct	Nov	Dec
2019	Jan	Feb	Mar (9)	Apr (60)	May (1)	Jun	Jul (13)	Aug	Sep (11)	Oct	Nov	Dec
2020	Jan	Feb	Mar (15)	Apr (4)	May	Jun	Jul	Aug	Sep	Oct	Nov	Dec (47)
2021	Jan (24)	Feb (33)	Mar (1)	Apr	May (1)	Jun (64)	Jul (71)	Aug (114)	Sep (82)	Oct (32)	Nov (76)	Dec (86)
2022	Jan (162)	Feb (41)	Mar (11)	Apr (9)	May	Jun	Jul (1)	Aug (2)	Sep	Oct	Nov	Dec (7)
2023	Jan	Feb (1)	Mar (2)	Apr	May	Jun	Jul (25)	Aug	Sep	Oct	Nov (7)	Dec
2024	Jan (7)	Feb (3)	Mar (3)	Apr (1)	May	Jun	Jul	Aug	Sep	Oct	Nov	Dec
2025	Jan	Feb (90)	Mar (19)	Apr	May (6)	Jun	Jul (1)	Aug	Sep	Oct	Nov	Dec

phpwiki-checkins Mailing List for PhpWiki

phpwiki-checkins — Automatic notification of CVS checkins on PhpWiki.