cpet/freebsd-ports
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix a minor information leak issue which will expose directories outside

Browse Source 
the wiki root (not their contents though).

This commit actually upgraded the port to 2009-12-25b by adding the patch
file.

For details please consult:
	http://bugs.splitbrain.org/index.php?do=details&task_id=1847

Sponsored by:	iXsystems, Inc.
This commit is contained in:
Xin LI 2010-01-13 23:30:43 +00:00
parent ad1ac1896f
commit 28850e37bc
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=247833
2 changed files with 40 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
www/dokuwiki/Makefile
View File

@ -7,6 +7,7 @@
PORTNAME= dokuwiki
PORTVERSION= ${DIST_VER:S/${PORTNAME}//:S/-//g}
PORTREVISION= 1
CATEGORIES= www
MASTER_SITES= http://www.splitbrain.org/_media/projects/dokuwiki/ \
LOCAL/chinsan/${PORTNAME}

39
www/dokuwiki/files/patch-20091225b Normal file
View File

@ -0,0 +1,39 @@
diff -u -r -N VERSION VERSION
--- VERSION 2009-12-25 02:14:45.000000000 -0800
+++ VERSION 2010-01-13 09:21:13.000000000 -0800
@@ -1 +1 @@
-2009-12-25 "Lemming"
+2009-12-25b "Lemming"
diff -u -r -N conf/msg conf/msg
--- conf/msg 2009-12-25 02:14:41.000000000 -0800
+++ conf/msg 2010-01-13 08:25:37.000000000 -0800
@@ -1,4 +1,4 @@
-23
+24
The first line of this file contains a number, indicating
which notification messages should not be displayed. This
is the only information sent to dokuwiki.org when the
diff -u -r -N lib/plugins/acl/ajax.php lib/plugins/acl/ajax.php
--- lib/plugins/acl/ajax.php 2009-12-25 02:14:41.000000000 -0800
+++ lib/plugins/acl/ajax.php 2010-01-13 08:25:37.000000000 -0800
@@ -16,9 +16,11 @@
require_once(DOKU_INC.'inc/common.php');
require_once(DOKU_INC.'inc/pageutils.php');
require_once(DOKU_INC.'inc/auth.php');
-//close sesseion
+//close session
session_write_close();
+if(!auth_isadmin()) die('forbidden');
+
$ID = getID();
if(!auth_isadmin) die('for admins only');
@@ -42,6 +44,7 @@
if($ns == '*'){
$ns ='';
}
+ $ns = cleanID($ns);
$lvl = count(explode(':',$ns));
$ns = utf8_encodeFN(str_replace(':','/',$ns));