[dokuwiki] XSS vulnerabilities in plugins?
- From: Mischa The Evil <mischa@xxxxxxxxxxxxxxxx>
- To: DokuWiki Mailinglist <dokuwiki@xxxxxxxxxxxxx>
- Date: Sun, 27 Apr 2008 03:25:57 +0200
Hi list,
Is it correct to say that all syntax-plugins which use
if(!defined('DOKU_INC'))
define('DOKU_INC',realpath(dirname(__FILE__).'/../../').'/');
if(!defined('DOKU_PLUGIN')) define('DOKU_PLUGIN',DOKU_INC.'lib/plugins/');
require_once(DOKU_PLUGIN.'syntax.php');
instead of
if (!defined('DOKU_INC')) die();
if (!defined('DOKU_PLUGIN')) define('DOKU_PLUGIN', DOKU_INC.'lib/plugins/');
require_once(DOKU_PLUGIN.'syntax.php');
have a XSS vulnerability which allows arbitrary (JavaScript) insertion?
In that case lots of plugins which are listed at wiki:plugins are
vulnerable so I can't believe this is a correct assumption... Also then
the skeleton-plugin
(http://wiki.splitbrain.org/wiki:plugins:syntax_skeleton) would be
vulnerable too...
Greetings,
Mischa.
--
DokuWiki mailing list - more info at
http://wiki.splitbrain.org/wiki:mailinglist
- Follow-Ups:
- [dokuwiki] Re: XSS vulnerabilities in plugins?
- From: Andreas Gohr
Other related posts:
- » [dokuwiki] XSS vulnerabilities in plugins?
- » [dokuwiki] Re: XSS vulnerabilities in plugins?
- [dokuwiki] Re: XSS vulnerabilities in plugins?
- From: Andreas Gohr