| #
195a3a7f
|
| 25-Jun-2026 |
Andreas Gohr <gohr@cosmocode.de> |
make getUserData() fail safely on non-string input
When removing multiple users at once, plugins listening on the
AUTH_USER_CHANGE event may pass the array of user names (params[0]
for 'delete') to
make getUserData() fail safely on non-string input
When removing multiple users at once, plugins listening on the
AUTH_USER_CHANGE event may pass the array of user names (params[0]
for 'delete') to getUserData(), which crashed authplain with an
"Array to string conversion" / illegal offset error.
Guard the bundled auth backends so a non-string user fails safely
by returning false, and document that AUTH_USER_CHANGE params[0] is
a string for create/modify but a string[] for delete.
Fixes #4567
show more ...
|
| #
81e99965
|
| 10-Mar-2020 |
Phy <git@phy25.com> |
fallback to auth_login check when trustExternal returns null
This is a work based on #2701, Before this patch, it is either fully external, or fully internal (and DokuWiki's auth cookie mechanism is
fallback to auth_login check when trustExternal returns null
This is a work based on #2701, Before this patch, it is either fully external, or fully internal (and DokuWiki's auth cookie mechanism is used in auth_login()). I believe we should provide plugin developers with a third state as out-put. Semantically $auth->trustExternal() === null to delegate auth flow back to DokuWiki makes sense to me - like no external auth result is returned, so we need to run internal auth flow.
Co-Authored-By: paweljasinski <paweljasinski@users.noreply.github.com>
show more ...
|