Good Morning!
These are the git changes for DokuWiki committed
yesterday. Please test them and report bugs.
---------------------------------------------------------------------
http://github.com/splitbrain/dokuwiki/commit/e6699927414e1778fc6313d97c88e92762b61fec
Author: Andreas Gohr <andi[at]splitbrain.org>
Date: Tue Dec 14 22:27:03 2021 +0100
check CSRF token in draftdel action. fixes #3563
http://github.com/splitbrain/dokuwiki/commit/b0265d201d997ac97ef50dda2c4ec6d958374ff5
Author: Andreas Gohr <andi[at]splitbrain.org>
Date: Tue Dec 14 18:09:23 2021 +0100
ignore another PSR12 style check for now
http://github.com/splitbrain/dokuwiki/commit/5f18fdf30e4325978c0fb77c25bf7eff96de9394
Author: Andreas Gohr <andi[at]splitbrain.org>
Date: Tue Dec 14 17:44:48 2021 +0100
authplain: properly clean user names
The authplain module uses cleanID to clean usernames to make them valid
pagenames. However namespaces should not be used in usernames.
For that cleanUser and cleanGroup replaced columns in given names. But
depending on the wiki configuration useslash, semicolons and slashes may
also be used as namespace separators. cleanID would replace those with
colons, reintroducing colons into the names.
The problem was reported in a forum post where spammers tried to
register http addresses as user names:
https://forum.dokuwiki.org/d/19796-spammers-with-in-their-name
Users with colons were correctly saved (the colon is escaped in the user
file) but could probably not login (unless using a slash or semicolon
instead of the colon). Since usernames are cleaned in many places in
DokuWiki, such a logged in user was probably not recognized correctly.
Because of the proper colon escaping when saving the user file, I don't
see any security issue arising from this. Eg. it was not possible to
trip up the user loading mechanism.
Note: Previously created users containing colons can not be deleted via
the user manager, because displayed usernames are cleaned again, which
will remove the colons.
---------------------------------------------------------------------
You can download individual diffs or patches by appending .diff or
.patch to the given commit URLs above.
Bye,
your git changelog mailer
--
DokuWiki mailing list - more info at
http://www.dokuwiki.org/mailinglist
