security(media): authorize the resolved target of media write operations

The media manager computed a permission level for the request's namespace
and passed it to the media write helpers, which the

security(media): authorize the resolved target of media write operations

The media manager computed a permission level for the request's namespace
and passed it to the media write helpers, which then acted on a target that
need not live in that namespace. Reachability differs per helper:

- media_restore() took the id to restore from the separate "image"
parameter, unrelated to the namespace the permission was computed for. A
user with upload permission in any one namespace could restore revisions
of media in namespaces they cannot write.

- media_upload() and media_upload_xhr() derive the target from the upload
namespace plus a user-controlled filename that may carry its own namespace
segments, so the target can only resolve into a sub-namespace of the upload
namespace. Where that child has a stricter ACL, the parent's permission was
applied instead.

- media_metasave() was not vulnerable: its target and its permission both
derive from the same request id, so the namespaces always matched. It is
changed only for consistency.

Each helper now recomputes the permission from its resolved target id, as
media_delete() already does. The redundant $auth parameter is removed from
media_restore() and media_metasave(), which have no other callers, and
ignored but kept for compatibility in media_upload() and media_upload_xhr().

Severity: medium - an authenticated user with upload rights in one namespace
can restore media revisions in other namespaces, or write into a stricter
sub-namespace of one they can upload to; an authorization bypass affecting
media integrity, not code execution or disclosure.

fixes #4702

show more ...

updated rector and applied it

Check security token for media restore. fix #4323

The whole media management is a mess, but this should fix the issue for
now.

I think the severity is low since, this will only restore previously
u

Check security token for media restore. fix #4323

The whole media management is a mess, but this should fix the issue for
now.

I think the severity is low since, this will only restore previously
uploaded media files, so permissions need to be high enogh for upload
anyway.

show more ...

reformat lib/exe/mediamanager.php

manual code style fix

codestyle adjustments: function argument spacing

Apply rector fixes to lib/exe

MediaManager: remove check for removed option

The refshow option has been removed in
3e7e02779454686e1c639eb366a195bd1ab50458 and should not have been
checked anymore. This fixes a warning on PHP8 w

MediaManager: remove check for removed option

The refshow option has been removed in
3e7e02779454686e1c639eb366a195bd1ab50458 and should not have been
checked anymore. This fixes a warning on PHP8 when deleting a media
file.

Replaces #3912

show more ...

:bug: Fixes #3738 , default value for mediamanger in fullscreen mode

deprecated trigger_event() in favor of a static method on Event

populate the JSINFO array in similar way as via doku.php

Prevents overwriting already added stuff.

#1327

add conf as global

restoring of mediafiles failed

fix mediamanager messages. closes #792

use empty() where array values might not be set

fix expression passed by reference

JSINFO in Media Manager: Initialize with empty array, as $ID and $NS
aren't useful and available. This is just for adding more values in
e. g. an action plugin.

Populate global variable JSINFO also in the Media Manager popup

fix comment grammar

make global, ensure created in mediamanager is global and merged with any pre-existing

Merge branch 'master' into FS#2415

FS#2415 add to mediamanager (refactor pageinfo() and shift MEDIAMANAGER_STARTED after mediainfo() sets up )

Media manager: don't create empty namespaces FS#2642

Previously the media manager created an empty namespace whenever you
opened a non-existing namespace with upload permissions. Now the current
nam

Media manager: don't create empty namespaces FS#2642

Previously the media manager created an empty namespace whenever you
opened a non-existing namespace with upload permissions. Now the current
namespace is only displayed in the tree but not actually created.

show more ...

introduced http_status() for sending HTTP status code FS#1698

It seems, some servers require a special Status: header for sending the
HTTP status code from PHP (F)CGI to the server. This patch intro

introduced http_status() for sending HTTP status code FS#1698

It seems, some servers require a special Status: header for sending the
HTTP status code from PHP (F)CGI to the server. This patch introduces a
new function (adopted from CodeIgniter) for simplifying the status
handling.

show more ...

fix necessary global declaration

Input validation for media manager