Skip to content
Snippets Groups Projects
  1. Jan 23, 2011
  2. Jan 22, 2011
  3. Jan 16, 2011
    • Andreas Gohr's avatar
    • Michael Hamann's avatar
      Fix several security issues in the XML-RPC interface · eff795ac
      Michael Hamann authored
      For locks and getRevisions there hasn't been any acl check. In many
      other cases the id hadn't been cleaned before the acl check was done
      which means that many acl rules that should be applied weren't applied.
      So e.g. when you have read permissions for the root namespace but not
      for a subnamespace you could add a leading ":" and the permissions for
      the root namespace will be used instead of the permissions for the
      subnamespace. This did not apply to writing pages and reading media
      files, but writing and deleting media files have been concerned as well
      as reading both plain and html versions of pages.
      
      This only concerns installations where XML-RPC is enabled (default is
      disabled) and XML-RPC is allowed for all or untrusted users.
      eff795ac
  4. Jan 15, 2011
  5. Jan 14, 2011
  6. Jan 12, 2011
  7. Jan 09, 2011
  8. Jan 04, 2011
  9. Jan 03, 2011
  10. Dec 31, 2010
  11. Dec 29, 2010
  12. Dec 28, 2010
  13. Dec 26, 2010
  14. Dec 23, 2010
  15. Dec 21, 2010
  16. Dec 18, 2010
  17. Dec 10, 2010
  18. Dec 09, 2010
  19. Dec 06, 2010
  20. Nov 30, 2010
Loading