diff options
| author | Andreas Gohr <gohr@cosmocode.de> | 2010-01-13 09:20:36 +0100 |
|---|---|---|
| committer | Andreas Gohr <gohr@cosmocode.de> | 2010-01-13 09:32:56 +0100 |
| commit | a46c097d04d070a8b37f3670277007639d06ff86 (patch) | |
| tree | 28f2c851ece4275e03a709b0e93f0fa978c24ab4 | |
| parent | 85d9abfce24272c94a4c91a601364e9f2d5cc8c0 (diff) | |
| download | rpg-a46c097d04d070a8b37f3670277007639d06ff86.tar.gz rpg-a46c097d04d070a8b37f3670277007639d06ff86.tar.bz2 | |
fixed information leakage in ACL plugin FS#1847
| -rw-r--r-- | lib/plugins/acl/ajax.php | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/lib/plugins/acl/ajax.php b/lib/plugins/acl/ajax.php index 54eaa8dc7..97fae2ad1 100644 --- a/lib/plugins/acl/ajax.php +++ b/lib/plugins/acl/ajax.php @@ -16,9 +16,11 @@ require_once(DOKU_INC.'inc/init.php'); require_once(DOKU_INC.'inc/common.php'); require_once(DOKU_INC.'inc/pageutils.php'); require_once(DOKU_INC.'inc/auth.php'); -//close sesseion +//close session session_write_close(); +if(!auth_ismanager()) die('forbidden'); + $ID = getID(); if(!auth_isadmin) die('for admins only'); @@ -42,6 +44,7 @@ if($ajax == 'info'){ if($ns == '*'){ $ns =''; } + $ns = cleanID($ns); $lvl = count(explode(':',$ns)); $ns = utf8_encodeFN(str_replace(':','/',$ns)); |