[dokuwiki] Re: plugin deletion
- From: Myron Turner <turnermm02@xxxxxxx>
- To: dokuwiki@xxxxxxxxxxxxx
- Date: Sun, 06 Feb 2011 10:04:22 -0600
On 2/6/2011 9:32 AM, Michael Hamann wrote:
Hi,
Excerpts from Myron Turner's message of 2011-02-06 16:05:02 +0100:
[...]
Thanks for the fix. I'm aware of the access issues and the this in fact
is the only way I could get the FCKeditor to access media files. There
is .htaccess protection but, in addition, the fckgLite implementation of
the FCKeditor's file browser is fully ACL-compliant. So, unless you
have used fckgLite you can't know whether your security warning is
accurate. Please do so before jumping to conclusions. And what are you
referring to as the 'non-safe' version?
Regarding media access I just referred to actual file access over http,
not listing the contents. The only way to prevent read access would be
more rules in the .htaccess files, there aren't any so I can conclude
that without testing the plugin. You say in various places that in the
fckgLiteSafe version in contrast to the other ("non-safe") version there
is an enhanced filebrowser. On
http://www.mturner.org/dwfck/fckgLite/doku.php?id=fckglite_safe#fckglitesafe_enhanced_filebrowser_as_of_nov_6_2010
you write that "Users cannot browse files to which they do not have at
least read permission. These files are hidden, preventing users from
creating links to files for which they do not have at least read
permission."
What this refers to is individual files. To view the contents of a
directory you need write permission to that directory. But a user may
have write permission to a directory and there may be files in that
directory to which they do not have read permission. Those files will be
hidden from them.
My conclusion was that this is different in the "non-safe"
version and there users can list pages they can't access. If that
shouldn't be correct sorry for the wrong conclusions, feel free to
correct that. I just wanted to make these two points more obvious as if
any of these two things existed in DokuWiki core we would consider that
a major security issue, fix it asap and would probably do a security
release.
Michael
The 'safe" and 'non-safe' designations refer to the fnencoding safe
protocol, and not to whether or not the file browser is safe. I do have
an .htaccess rule in the directory where they symbolic links occur which
prevents indexing. So this prevents the media directory from being
viewed by http.
As of this morning fckgLite was downloaded 14861 times from from 4470
Unique IP's. It is being used in all kinds of contexts, wherever
Dokuwiki is used. There have not been any recent complaints about
security. I did have early complaints and there was in fact a time when
it wasn't "safe" in the sense that you mean it, but over the course of
the year and half that it has been in development, I've worked hard to
address the security concerns. In fact, access to the media
directory--not the data directory itself--does have an http security
flaw which I haven't figured out a way to correct, but I have made this
clear in the documentation and provided ways for administrators to deal
with it.
Myron
--
Myron Turner
http://mturner.org/
http://mturner.org/fckgLite
http://www.mturner.org/dwfck/doku.php
http://www.room535.org
--
DokuWiki mailing list - more info at
http://www.dokuwiki.org/mailinglist
Other related posts:
