summaryrefslogtreecommitdiff
path: root/lib
Commit message (Collapse)AuthorAge
* SECURITY escape user properties in user manager #1081Andreas Gohr2015-03-19
| | | | | | | | | The user properties (login, real name, etc) where not properly escaped in the user manager's edit form. This allowed a XSS attack on the superuser by registered users. Thanks to Filippo Cavallarin from www.segment.technology for discovering this bug.
* check permissions in ACL plugin's RPC API component. #1056Andreas Gohr2015-02-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Security Fix Severity: Medium Type: Remote Priviledge Escalation Remote: yes Vulnerability Details: This fixes a security hole in the ACL plugins remote API component. The plugin failed to check for superuser permissions before executing ACL addition or deletion. This means everybody with permissions to call the XMLRPC API also had permissions to set up their own ACL rules and thus circumventing any existing rules. Risk Assessment: The XMLRPC API in DokuWiki is marked experimental and off by default. It also implements an additional safeguard by giving access to a configured circle of users and groups only. So only a minor number of DokuWiki installations will be affected at all. For affected installations the risk is high if users with access to the API are not to be trusted. Thus the overall severity of medium. Resolution: Installations applying this commit are safe. A hotfix is about to be released. Meanwhile users are advised to disable the XMLRPC API in the config manager.
* Merge branch 'master' into stableGuy Brand2014-10-08
|\
| * escaping backslash should be included in split itemsChristopher Smith2014-10-04
| |
| * Fix for issues 877 & 885 related to a bug in PCRE 6.6Christopher Smith2014-10-03
| |
* | Merge branch 'master' into stableAndreas Gohr2014-09-29
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * master: (214 commits) release preparations postgresql auth plugin: correct function name parse AT parameter: first strtotime then timestamp remove config option move more strings to lang.php move strings to lang.php add placeholders for create page text phpdocs parserutils improve some scrutinizer issues visibility plugin methods use config cascade for loading of localizations reformatting config cascade add lang files to cascading work around missing gzopen on certain systems #865 translation update fix scrutinizer issues fixed typos in docblock comments do not allow empty passwords clean user credentials from control chars added filter method to INPUT class translation update ...
| * Merge pull request #624 from lisps/revisionsAndreas Gohr2014-09-29
| |\ | | | | | | date_at support
| | * parse AT parameter: first strtotime then timestamplisps2014-09-29
| | | | | | | | | | | | remove config option
| | * Merge remote-tracking branch master into revisionslisps2014-09-26
| | |\
| | * | fix config optionlisps2014-03-19
| | | |
| | * | Merge remote-tracking branch 'remotes/origin/master' into revisions_locallisps2014-03-19
| | |\ \
| | * \ \ Merge remote-tracking branch 'origin/diff_navigation' into revisionslisps2014-02-17
| | |\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | Conflicts: inc/parser/xhtml.php
| | * \ \ \ Merge remote-tracking branch 'remotes/splitbrain/diff_navigation' into revisionslisps2013-11-22
| | |\ \ \ \
| | * | | | | remove property rev from xhtml.phplisps2013-11-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | changed variable name $create_time to $modified_time
| | * | | | | add parameter at($DATE_AT) and mind revisionslisps2013-11-21
| | | | | | |
| * | | | | | postgresql auth plugin: correct function nameChristopher Smith2014-09-29
| | | | | | |
| * | | | | | Merge pull request #828 from ssahara/extension-make_infoAndreas Gohr2014-09-27
| |\ \ \ \ \ \ | | |_|_|_|_|/ | |/| | | | | Last Update Date info of extension fix
| | * | | | | Last Update Date info of extension fixSatoshi Sahara2014-08-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This request makes "Your last update" of the extension info shown when clicking more info triangle mark. The first installed date of the extension may not be necessary for local site admin work.
| * | | | | | Merge remote-tracking branch 'origin/auth_getUserData_improvements'Andreas Gohr2014-09-26
| |\ \ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * origin/auth_getUserData_improvements: KISS - remove class constants for REQUIRE_GROUPS & IGNORE_GROUPS and replace with boolean values use $requireGroups constants in auth classes; comments; code improvements fix comment errors, sp. & grammar code styling - add missing braces Allow user info to be retrieved without groups Restore correct public interface of getUserData() for authldap plugin Conflicts: inc/common.php
| | * | | | | | KISS - remove class constants for REQUIRE_GROUPS & IGNORE_GROUPS and replace ↵Christopher Smith2014-05-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | with boolean values
| | * | | | | | use $requireGroups constants in auth classes; comments; code improvementsChristopher Smith2014-03-14
| | | | | | | |
| | * | | | | | fix comment errors, sp. & grammarChristopher Smith2014-03-12
| | | | | | | |
| | * | | | | | code styling - add missing bracesChristopher Smith2014-03-12
| | | | | | | |
| | * | | | | | Allow user info to be retrieved without groupsChristopher Smith2014-03-12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some parts of dokuwiki (e.g. recent changes, old revisions) can requests lots of user info (to provide editor names) without requiring any group information. This change also implements caching of user info by authmysql & authpgsql plugins to avoid repeated querying of the DB to retrieve the same user information.
| | * | | | | | Restore correct public interface of getUserData() for authldapChristopher Smith2014-03-12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | plugin The outer/public getUserData() implemented as a wrapper for the previous fn which is now protected.
| * | | | | | | translation updateMohamed Belhsine2014-09-22
| | | | | | | |
| * | | | | | | translation updateJaroslav Lichtblau2014-09-20
| | | | | | | |
| * | | | | | | translation updateDavor Turkalj2014-09-19
| | | | | | | |
| * | | | | | | translation updateSchplurtz le Déboulonné2014-09-17
| | | | | | | |
| * | | | | | | Merge pull request #857 from dokuwiki-translate/lang_update_20Andreas Gohr2014-09-15
| |\ \ \ \ \ \ \ | | | | | | | | | | | | | | | | | | Translation update (zh-tw)
| | * | | | | | | translation updateJune-Hao Hou2014-09-13
| | | | | | | | |
| * | | | | | | | translation updateViktor Zavadil2014-09-15
| |/ / / / / / /
| * | | | | | | translation updateDavor Turkalj2014-09-10
| | | | | | | |
| * | | | | | | Merge pull request #851 from dokuwiki-translate/lang_update_12Andreas Gohr2014-09-10
| |\ \ \ \ \ \ \ | | | | | | | | | | | | | | | | | | Translation update (hr)
| | * | | | | | | translation updateDavor Turkalj2014-09-08
| | | | | | | | |
| * | | | | | | | translation updateMohamad Mehdi Habibi2014-09-10
| |/ / / / / / /
| * | | | | | | translation updatepokesakura2014-08-28
| | | | | | | |
| * | | | | | | translation updateFelipe Castro2014-08-27
| | | | | | | |
| * | | | | | | translation updateHamid2014-08-18
| | | | | | | |
| * | | | | | | translation updateFabio2014-08-09
| | | | | | | |
| * | | | | | | Merge pull request #831 from dokuwiki-translate/lang_update_127Andreas Gohr2014-08-07
| |\ \ \ \ \ \ \ | | | | | | | | | | | | | | | | | | Translation update (ru)
| | * | | | | | | translation updateIgor Degraf2014-08-07
| | | |/ / / / / | | |/| | | | |
| * / | | | | | translation updateIgor Degraf2014-08-07
| |/ / / / / /
| * | | | | | updated dates in info.txt of various plugins and templateAnika Henke2014-08-02
| | | | | | |
| * | | | | | translation updateStan2014-08-02
| | | | | | |
| * | | | | | translation updateDominik Mahr2014-08-01
| | | | | | |
| * | | | | | fix mediamanager messages. closes #792Andreas Gohr2014-07-30
| | | | | | |
| * | | | | | Merge pull request #788 from splitbrain/jqueryAndreas Gohr2014-07-30
| |\ \ \ \ \ \ | | | | | | | | | | | | | | | | update jquery and jquery-ui
| | * | | | | | upgrade to jQuery 1.11.1 and jQuery-UI 1.11.0. #778Andreas Gohr2014-07-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This now pulls all data from official jQuery sources. Either their CDN or their github account. Google tends to serve outdated or even broken files :-( Unfortunately there's no simple way to get the latest stable jQuery-UI so for now the version has to be adjusted manually in the script.
| * | | | | | | translation updateDavor Turkalj2014-07-17
| | | | | | | |
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-05 01:19:12 +0000