Skip to content
Snippets Groups Projects
Commit 77244e70 authored by Michael Hamann's avatar Michael Hamann
Browse files

Security: Fix ACL check in search_allpages

Due to the changes in 8f34cf3d, the ACL
check in search_allpages was only executed when 'skipacl' has been
explicitly set to false. Otherwise, only ACLs for namespaces were
checked (unless the sneakyacl option was passed). The documentation
states that the default for 'skipacl' is false, so setting it to false
shouldn't be necessary.

From all I can see, this does not concern DokuWiki itself as
search_allpages is never used without the 'skipacl' option explicitly
set to true or false. However, this causes serious security issues in
plugins that rely on this ACL check in search_allpages like the include
plugin.
parent 5a361db5
No related branches found
No related tags found
No related merge requests found
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment