Cast the ACL permission to an integer when saving the rule table

The bulk update path pulled the permission map straight from input and
wrote each value verbatim into a tab-separated ACL line, while

Cast the ACL permission to an integer when saving the rule table

The bulk update path pulled the permission map straight from input and
wrote each value verbatim into a tab-separated ACL line, while the
single-rule path already read it through an integer filter. A non-integer
value could carry a newline or tab and inject extra rules into the file.
Cast to int so the value can only ever be a single permission number.

This was not exploitable: the rule table is reachable only through the
ACL admin plugin, which is superuser-only and CSRF-protected, and a
superuser can already edit the ACL file directly. The cast is hardening
for consistency with the single-rule path.

show more ...

updated rector and applied it

Revert "use a dispatcher to access static image files"

This reverts commit 944e9ba7254387adb60f253b0d8796f2276096b1.

It was accidentally pused to master before review. A PR with a revert
for the re

Revert "use a dispatcher to access static image files"

This reverts commit 944e9ba7254387adb60f253b0d8796f2276096b1.

It was accidentally pused to master before review. A PR with a revert
for the revert will be pushed shortly.

show more ...

use a dispatcher to access static image files

This makes it possible to replace default images in an update safe way.
It also addresses the issue raised in dokuwiki/docker#16

A .htaccess rewrite ca

use a dispatcher to access static image files

This makes it possible to replace default images in an update safe way.
It also addresses the issue raised in dokuwiki/docker#16

A .htaccess rewrite catches any direct accesses that might come in from
plugins.

show more ...

Use str_starts_with/str_ends_with

code style: operator spacing

coding style: control flow line breaks

Apply rector renames

Apply rector fixes to lib/plugin/acl

Changes according to revisions in https://github.com/moisesbr-dw/dokuwiki/pull/2

Many minor details and use of Sort::xyz() instead of intl_xyz() in files outside the "inc" folder.

Access Control List Management

All sortable lists:
- tree list of namespaces and pages
- drop-down list with users and groups
- rule list by page/namespace (main sort)
- [enhancement] rule list by u

Access Control List Management

All sortable lists:
- tree list of namespaces and pages
- drop-down list with users and groups
- rule list by page/namespace (main sort)
- [enhancement] rule list by user/group (secondary sort)

show more ...

Final project-wide check of curly brace deprecations.

Fix PHP 7.3 deprecations in lib/ directory.

ACL Plugin: make item formatter public again

The formatter needs to be public to be called from html_buildlist()

Merge branch 'pr/2871' into pull-request-2871

* pr/2871:
Rename _acl_add to _acl_addOrUpdate
Fix #1115

Rename _acl_add to _acl_addOrUpdate

because that's what this method actually does now

Fix #1115

without this patch calling _acl_add may result in a corrupted acl.auth.php file.
This is the case when we're adding a config for a user and a scope with an
existing config.

The fix is jus

Fix #1115

without this patch calling _acl_add may result in a corrupted acl.auth.php file.
This is the case when we're adding a config for a user and a scope with an
existing config.

The fix is just to call the _acl_del method before perming the addition.

Note that this _acl_add method is currently called from two places:
- from admin_plugin_acl.handle() which was explicitely calling _acl_del before
- from remote_plugin_acl.addAcl, which can actually result in a corrupted file

show more ...

Merge branch 'master' into psr2

fix ACL admin footnote JS error, fixes #2540

- ACL's hand-written template doesn't use div.content to wrap the footnote content
- jQuery object existence check should use $obj.length

PSR-2 for ACL plugin

visibility declarations in plugins

line lengths shortened

This makes sure all files use line lenghts shorter than 120 characters.

This is a quick fix. It might not always be the nicest change.

remove DOKU_INC checks

There is no need for this check, since these files should not have any
main code that is executed on direct call.

Fixes PSR1.Files.SideEffects.FoundWithSymbols

Merge remote-tracking branch 'origin/remoteapiGetversions' into duchon-acl_list_xmlrpc

Conflicts:
inc/RemoteAPICore.php

Merge pull request #1176 from splitbrain/ioreplaceinfile

Add IO function to replace lines in a file (new)