correctly escape comments in user names. fixes #4099
AuthPlain user parsing fix. #3833This removes workarounds we had for old PCRE versions. All modern PHPreleases should be workable with the Regex we have.If splitting the user line results in les
AuthPlain user parsing fix. #3833This removes workarounds we had for old PCRE versions. All modern PHPreleases should be workable with the Regex we have.If splitting the user line results in less than 5 results, we log anerror and pad the result for further use.
show more ...
authplain: properly clean user namesThe authplain module uses cleanID to clean usernames to make them validpagenames. However namespaces should not be used in usernames.For that cleanUser and cl
authplain: properly clean user namesThe authplain module uses cleanID to clean usernames to make them validpagenames. However namespaces should not be used in usernames.For that cleanUser and cleanGroup replaced columns in given names. Butdepending on the wiki configuration useslash, semicolons and slashes mayalso be used as namespace separators. cleanID would replace those withcolons, reintroducing colons into the names.The problem was reported in a forum post where spammers tried toregister http addresses as user names:https://forum.dokuwiki.org/d/19796-spammers-with-in-their-nameUsers with colons were correctly saved (the colon is escaped in the userfile) but could probably not login (unless using a slash or semicoloninstead of the colon). Since usernames are cleaned in many places inDokuWiki, such a logged in user was probably not recognized correctly.Because of the proper colon escaping when saving the user file, I don'tsee any security issue arising from this. Eg. it was not possible totrip up the user loading mechanism.Note: Previously created users containing colons can not be deleted viathe user manager, because displayed usernames are cleaned again, whichwill remove the colons.
add needed type hints for phpunit8This will break a lot of plugin tests, but can't be avoided
authplain: Add tests for group retrieval
fixed auth plain test
PSR-2 for authplain plugin
add phpdocs
add more plugin groups to authplain test
Scrutinizer Auto-FixesThis commit consists of patches automatically generated for this project on https://scrutinizer-ci.com
escaping backslash should be included in split items
Fix for issues 877 & 885 related to a bug in PCRE 6.6
PHPDocs and some improvements
authplain: Escape ':' in any data field as '\:'':' is the field delimiter in the authplain flat textconf/users.auth.php file, but it's also used as an internal delimiterfor the 'mediawiki' passwo
authplain: Escape ':' in any data field as '\:'':' is the field delimiter in the authplain flat textconf/users.auth.php file, but it's also used as an internal delimiterfor the 'mediawiki' password hash format. Currently using this hashformat corrupts the fileThis change escapes ':' as '\:' in any field in the users.auth.phpfile, and any '\' as '\\'.Also adds test cases for escaping modes.