Security Fix

Severity: Medium
Type:     Remote Priviledge Escalation
Remote:   yes

Vulnerability Details:

This fixes a security hole in the ACL plugins remote API component. The
plugin failed to check for superuser permissions before executing ACL
addition or deletion. This means everybody with permissions to call the
XMLRPC API also had permissions to set up their own ACL rules and thus
circumventing any existing rules.

Risk Assessment:

The XMLRPC API in DokuWiki is marked experimental and off by default. It
also implements an additional safeguard by giving access to a configured
circle of users and groups only. So only a minor number of DokuWiki
installations will be affected at all.
For affected installations the risk is high if users with access to the
API are not to be trusted.
Thus the overall severity of medium.

Resolution:

Installations applying this commit are safe. A hotfix is about to be
released. Meanwhile users are advised to disable the XMLRPC API in the
config manager.

This reverts commit 362a4f08.

Support for the URI scheme tel: #643

This moves the message area into content div. The pageid is now aligned
by floating instead of absolute positioning.

1 little fix

This commit consists of patches automatically generated for this project on https://scrutinizer-ci.com

This commit consists of patches automatically generated for this project on https://scrutinizer-ci.com

In an older version of PHP a file_exists() call would issue a warning
when the file did not exist. This was fixed in later PHP releases. Since
we require PHP 5.3 now, there's no need to supress any error here
anymore. This might even give a minor performance boost.

As described in the common idioms of the HTML5 spec, mark up navigation as a list inside a `nav` element for better semantics and accessibility.

see:

  * http://www.w3.org/html/wg/drafts/html/master/common-idioms.html#rel-up
  * http://lists.w3.org/Archives/Public/public-html/2013Nov/thread.html#msg6
  * https://dl.dropboxusercontent.com/u/377471/breadcrumb.html

for discussion and background.

Add the class .bounce to any element to let it bounce slightly for 2
seconds. This is useful to make the user aware of some element. Can be
combined with #scroll__here when a long list auto scrolls to a certain
item.