The user properties (login, real name, etc) where not properly escaped
in the user manager's edit form. This allowed a XSS attack on the
superuser by registered users.
Thanks to Filippo Cavallarin from www.segment.technology for discovering
this bug.
Security Fix
Severity: Medium
Type: Remote Priviledge Escalation
Remote: yes
Vulnerability Details:
This fixes a security hole in the ACL plugins remote API component. The
plugin failed to check for superuser permissions before executing ACL
addition or deletion. This means everybody with permissions to call the
XMLRPC API also had permissions to set up their own ACL rules and thus
circumventing any existing rules.
Risk Assessment:
The XMLRPC API in DokuWiki is marked experimental and off by default. It
also implements an additional safeguard by giving access to a configured
circle of users and groups only. So only a minor number of DokuWiki
installations will be affected at all.
For affected installations the risk is high if users with access to the
API are not to be trusted.
Thus the overall severity of medium.
Resolution:
Installations applying this commit are safe. A hotfix is about to be
released. Meanwhile users are advised to disable the XMLRPC API in the
config manager.
* stable: (474 commits)
hotfix release for #765
Quick fix for #765 - ACL checks in the media manager ajax calls
Use git attributes to exclude some files from exported archives
Release 2014-05-05 "Ponder Stibbons"
Release preparation
no fancy quotes in user manager import description
add defaults to phpdocs of search universal
update deprecation stuff for dw_qearch
translation update
translation update
translation update
added another test for arrays
fixed some test inheriting from the wrong parent
use new $INPUT->valid() method in feed.php
add new valid() method to $INPUT #667
some updates on phpunit docs and settings
Fix https proxy authentication, the header was missing a colon so that the auth info was not working.
translation update
translation update
translation update
...
Guy Brand