fix(remote): make aclCheck self-check case-insensitive-backend aware

The check gating aclCheck() for other users compared the requested user
against REMOTE_USER verbatim. On a case-insensitive auth

fix(remote): make aclCheck self-check case-insensitive-backend aware

The check gating aclCheck() for other users compared the requested user
against REMOTE_USER verbatim. On a case-insensitive auth backend a user
naming themselves in a different case than their login was treated as a
different user and wrongly denied checking their own ACL. Normalize both
names the way auth_isMember() does before comparing.

The self-check was introduced in 884caed92.

show more ...

Remote: restrict core.aclCheck for other users to superusers

aclCheck() let any API-enabled user pass an arbitrary username and learn
that user's effective permission level on any page/namespace, en

Remote: restrict core.aclCheck for other users to superusers

aclCheck() let any API-enabled user pass an arbitrary username and learn
that user's effective permission level on any page/namespace, enabling
ACL-posture enumeration of other accounts. Checking another user's
permissions is now limited to superusers; users may still check their
own. The deprecated legacyAclCheck() delegates here and is covered too.

Not really a big security concern, but there is no reason to enable it.

Note: arbitrary groups can still be checked by anyone.

show more ...

fix ApiCoreAclCheckTest

This is mostly syntactic fix. I did not check how sensible these tests
are and did not switch from positional to named arguments

More adjusted API tests