| #
5d8c9d42
|
| 06-Jun-2026 |
Andreas Gohr <andi@splitbrain.org> |
(security) Require a security token for the lock AJAX call
The lock AJAX call refreshes the edit lock and saves a draft, both of
which change server state. It was gated only by the write ACL and,
un
(security) Require a security token for the lock AJAX call
The lock AJAX call refreshes the edit lock and saves a draft, both of
which change server state. It was gated only by the write ACL and,
unlike the sibling draft-delete call, did not verify a security token
(low severity).
A cross-site forged POST against a logged-in user could, within that
user's own write permissions, take or hold an edit lock and store
attacker-controlled draft content under their name.
The call now verifies the security token before taking the lock or
saving the draft. Logged out users are unaffected, as no token is
issued or checked for them. The edit lock timer now always sends the
token with its refresh request, including when draft saving is
disabled.
show more ...
|
| #
e8c9256a
|
| 06-Jun-2026 |
Andreas Gohr <andi@splitbrain.org> |
(security) Clean the media upload namespace in AJAX upload
The namespace passed to the AJAX backend was not cleaned correctly,
resulting in two separate issues.
1. Theoretical Reflected XSS
The
(security) Clean the media upload namespace in AJAX upload
The namespace passed to the AJAX backend was not cleaned correctly,
resulting in two separate issues.
1. Theoretical Reflected XSS
The raw namespace was reflected into the JSON response and injected
into the mediamanager DOM. However since the media manager only
passes cleaned namespaces to AJAX and the ajax backen only returns
JSON, this issue was not exploitable.
2. Cross-namespace ACL bypass (medium severity)
The uncleaned namespace was directly used to check ACLs. In a wiki
where a user has upload permission in a namespace above a namespace
where they don't have permissions (eg. upload allowed in :user:*, but
upload denied in :user:secret:*) they could pass an upper case
namespace (eg :user:SECRET) - no ACL does exist for this upper case
namespace and the acl of the namespace above applies (:user).
When the file is written a cleanID is applied to the full filename,
turning the uppercase namespace into lowercase.
This can allow users to write into a namespace they normally should
not be allowed to write to, but it does require upload permissions in
a higher namespace.
show more ...
|