drop tilde from title. fixes #4347

When a link with the page relative shortcut is used and no title is
given, the given ID is used to create a title. In this case, the tilde
should be removed from t

drop tilde from title. fixes #4347

When a link with the page relative shortcut is used and no title is
given, the given ID is used to create a title. In this case, the tilde
should be removed from the title.

[[~SomeThing]] -> SomeThing

show more ...

Typo in the word associative

remove deprecated code

This removes code that has been marked as deprecated before 2020.

Replace strftime with Intl ICU. Fixes #3573

This uses a class that maps strftime placeholders to the appropriate ICU
patterns. I am using the fallback-intl branch here which provides an
English-only

Replace strftime with Intl ICU. Fixes #3573

This uses a class that maps strftime placeholders to the appropriate ICU
patterns. I am using the fallback-intl branch here which provides an
English-only fallback when the intl extension is not available.

Core has only two places where strftime is used: dformat() and the
SimplePie feed parser. Both are adjusted with this patch. For the latter
a custom Item class had to be registered. For better separation all our
FeedParser classes have been moved to the Feed namespace where our
FeedCreator classes already reside.

Note that this will currently be a degration for users without intl as
it will fall back to date and not to the still available strftime.

show more ...

Revert "use a dispatcher to access static image files"

This reverts commit 944e9ba7254387adb60f253b0d8796f2276096b1.

It was accidentally pused to master before review. A PR with a revert
for the re

Revert "use a dispatcher to access static image files"

This reverts commit 944e9ba7254387adb60f253b0d8796f2276096b1.

It was accidentally pused to master before review. A PR with a revert
for the revert will be pushed shortly.

show more ...

use a dispatcher to access static image files

This makes it possible to replace default images in an update safe way.
It also addresses the issue raised in dokuwiki/docker#16

A .htaccess rewrite ca

use a dispatcher to access static image files

This makes it possible to replace default images in an update safe way.
It also addresses the issue raised in dokuwiki/docker#16

A .htaccess rewrite catches any direct accesses that might come in from
plugins.

show more ...

Fix stored XSS vulnerability via do=export_metadata #4305

This prevents metadata export in general and also ensures the the
temporary $doc property in the metadata renderer is cleared in
document_end

Use str_starts_with/str_ends_with

minor cleanup in the renderers

apply code sniffer rules to inc/parser as well

simplify URL linking in handler

update some plugin classes in phpdocs, reformatting

recover comments in list

apply PSR-12 constant visibility rule

PSR-12 says constants need their visibility declared from PHP 7.1
onwards

Apply rector fixes to inc/parser

metadata: consider webp and svg for first images as well

fix XSS in RSS syntax

The title was not correctly escaped when written to the doc in xhtml
renderer.

SimplePie does no content escaping on its own (a comment in the code
seems to suggest that that

fix XSS in RSS syntax

The title was not correctly escaped when written to the doc in xhtml
renderer.

SimplePie does no content escaping on its own (a comment in the code
seems to suggest that that was assumed). Instead the content is passed
on as-is from the feed.

This patch also applies some more escaping on the description output
(though it should have been relatively safe thanks to the use of
striptags).

This was discovered by @ry0tak and reported in
https://huntr.dev/bounties/c6119106-1a5c-464c-94dd-ee7c5d0bece0/

show more ...

fix some php 8.2 deprecation warnings

clean up parserutils (reformatting mostly)

Replace is_null() check with count()

Backwards Compatibility: Don't error if finishSectionEdit is called without first startSectionEdit

Update core code to make use of sexplode()

This makes use of our own explode mechanism everywhere were we expect a
fixed number of results.

Remove the htmlok and phpok embedding options

Both options have grave security implications and novice users seem to
ignore advice about them. In the last decades I never came across a wiki
that had

Remove the htmlok and phpok embedding options

Both options have grave security implications and novice users seem to
ignore advice about them. In the last decades I never came across a wiki
that had legitimate use of these options.

If someone needs the functionality, it can easily be added back using a
plugin. But I prefer to give users one less option to shoot themselves
in the foot.

Removal of the translations for the config strings can follow after this
has been merged.

show more ...

Accept returnonly parameter to header()

move resolvers into File namespace