From: Charles C. <ch...@ru...> - 2004-12-13 15:33:28
|
I have not been able to work out what is going on here, though I have been looking for a while... Please let me know if any further information is required. Regards, Charles All test cases assume that the user is logged in as the administrator Test case 1 =========== 1 - Go to PhpWikiAdministration/Chown 2 - Select RichTablePlugin (the value in the owner column is ReiniUrban). 3 - Change the owner to another user and confirm. 4 - Go to RichTablePlugin - the new owner is shown correctly. 5 - Go to PhpWikiAdministration/Chown - the owner is still shown as ReiniUrban Test Case 2 =========== 1 - Open a page 2 - Click on the Setacl button 3 - Select a group (row) to be deleted 4 - Click on SetAcl - the confirmation page is displayed but the group to be deleted is unselected 5 - Reselect the group (row) to be deleted and click on Yes 6 - Click on the Setacl button - the ACLs have not been changed Test Case 3 =========== 1 - Export a page to a zip file 2 - Extract a page from the zip file into a text file 3 - Use a text editor to set the acls on the page so it can only be edited by an administrator (will also have to update version and maybe lastmodified and/or created) 4 - Load the edited text file back into the wiki 5 - Open the page 6 - View the acls using the Setacl button 7 - log out of the wiki 8 - log back in as a user that should be unable to edit the page 9 - attempt to edit the page - it is allowed Platform ======== Linux: 2.4.21 Apache: 1.3.33 MySQL: 4.0.22 PHP: 4.3.9 phpwiki: CVS 1.3.11pre, extracted shortly after update to upgrade.php on 2004/12/10 at 22:33:39 Configuration ============= INCLUDE_PATH = "/home/runega2/phpwiki" ENABLE_PAGEPERM = true ENABLE_DOUBLECLICKEDIT = true WIKI_NAME = WhiteWall ENABLE_REVERSE_DNS = true ADMIN_USER = WhiteWallAdmin ADMIN_PASSWD = "xxxxxxxx" ENCRYPTED_PASSWD = true ZIPDUMP_AUTH = false ENABLE_RAW_HTML = false ENABLE_RAW_HTML_LOCKEDONLY = false ENABLE_RAW_HTML_SAFE = false STRICT_MAILABLE_PAGEDUMPS = true DEFAULT_DUMP_DIR = /home/runega2/whitewall/wikidump HTML_DUMP_DIR = /home/runega2/whitewall/wikidumphtml HTML_DUMP_SUFFIX = .html MAX_UPLOAD_SIZE = 1050000 MINOR_EDIT_TIMEOUT = 604800 ACCESS_LOG = /home/runega2/whitewall/accesslog/wiki_access_log CACHE_CONTROL = LOOSE CACHE_CONTROL_MAX_AGE = 600 COOKIE_EXPIRATION_DAYS = 365 DATABASE_TYPE = SQL DATABASE_PREFIX = wwwiki_ DATABASE_DSN = "mysql://runega2_phpwiki:xxxxxx@localhost/runega2_db" DATABASE_SESSION_TABLE = session DATABASE_DIRECTORY = /home/runega2/whitewall/files DATABASE_DBA_HANDLER = gdbm DATABASE_TIMEOUT = 5 SESSION_SAVE_PATH = /home/runega2/whitewall/session MAJOR_MAX_AGE = 32 MAJOR_KEEP = 8 MINOR_MAX_AGE = 7 MINOR_KEEP = 4 AUTHOR_MAX_AGE = 365 AUTHOR_KEEP = 8 AUTHOR_MIN_AGE = 7 AUTHOR_MAX_KEEP = 20 ALLOW_ANON_USER = true ALLOW_ANON_EDIT = false ALLOW_BOGO_LOGIN = false ALLOW_USER_PASSWORDS = true USER_AUTH_ORDER = "Db" PASSWORD_LENGTH_MINIMUM = 6 USER_AUTH_POLICY = first-only GROUP_METHOD = WIKIPAGE DBAUTH_AUTH_USER_EXISTS = "SELECT userid FROM wwwiki_user WHERE userid='$userid'" DBAUTH_AUTH_CHECK = "SELECT IF(passwd=PASSWORD('$password'),1,0) AS ok FROM wwwiki_user WHERE userid='$userid'" DBAUTH_AUTH_CRYPT_METHOD = plain DBAUTH_AUTH_UPDATE = "UPDATE wwwiki_user SET passwd=PASSWORD('$password') WHERE userid='$userid'" DBAUTH_AUTH_CREATE = "INSERT INTO wwwiki_user SET passwd=PASSWORD('$password'),userid='$userid'" DBAUTH_PREF_SELECT = "SELECT prefs FROM wwwiki_pref WHERE userid='$userid'" DBAUTH_PREF_UPDATE = "REPLACE INTO wwwiki_pref SET prefs='$pref_blob',userid='$userid'" DBAUTH_IS_MEMBER = "SELECT userid FROM wwwiki_member WHERE userid='$userid' AND groupname='$groupname'" DBAUTH_GROUP_MEMBERS = "SELECT DISTINCT userid FROM wwwiki_member WHERE groupname='$groupname'" DBAUTH_USER_GROUPS = "SELECT groupname FROM wwwiki_member WHERE userid='$userid'" EDITING_POLICY = EditingPolicy THEME = default CHARSET = iso-8859-1 DEFAULT_LANGUAGE = en WIKI_PGSRC = pgsrc DEFAULT_WIKI_PGSRC = pgsrc DEFAULT_WIKI_PAGES = "ReleaseNotes:SteveWainstead:TestPage" ALLOWED_PROTOCOLS = "http|https|mailto|ftp|news|nntp|ssh|gopher" INLINE_IMAGES = "png|jpg|gif" WIKI_NAME_REGEXP = "(?<![[:alnum:]])(?:[[:upper:]][[:lower:]]+){2,}(?![[:alnum:]])" SUBPAGE_SEPARATOR = / INTERWIKI_MAP_FILE = lib/interwiki.map WARN_NONPUBLIC_INTERWIKIMAP = false KEYWORDS = "Category:Topic" COPYRIGHTPAGE_TITLE = "GNU General Public License" COPYRIGHTPAGE_URL = "http://www.gnu.org/copyleft/gpl.html#SEC1" AUTHORPAGE_TITLE = The PhpWiki Programming Team AUTHORPAGE_URL = http://phpwiki.org/ThePhpWikiProgrammingTeam TOC_FULL_SYNTAX = true PHPWIKI_DIR = /home/runega2/phpwiki USE_PATH_INFO = true TEMP_DIR = /home/runega2/whitewall/tmp PLUGIN_CACHED_DATABASE = file PLUGIN_CACHED_CACHE_DIR = /home/runega2/whitewall/cache PLUGIN_CACHED_FILENAME_PREFIX = phpwiki PLUGIN_CACHED_HIGHWATER = 4194304 PLUGIN_CACHED_LOWWATER = 3145728 PLUGIN_CACHED_MAXLIFETIME = 2592000 PLUGIN_CACHED_MAXARGLEN = 1000 PLUGIN_CACHED_USECACHE = true PLUGIN_CACHED_FORCE_SYNCMAP = true PLUGIN_CACHED_IMGTYPES = "png|gif|gd|gd2|jpeg|wbmp|xbm|xpm" |
From: Charles C. <ch...@ru...> - 2004-12-13 15:38:22
|
While I cannot track it down, I get the feeling that somehow the problem is that the metadata for the oldest version of the page is always used, not the metadata for latest version. Regards, Charles -----Original Message----- From: Charles Corrigan [mailto:ch...@ru...] Sent: 13 December 2004 23:35 To: php...@li... Subject: [Phpwiki-talk] Whole bunch of security related issues I have not been able to work out what is going on here, though I have been looking for a while... Please let me know if any further information is required. Regards, Charles |