extension: validate base name to prevent path traversal on install

The extension base name flowed unsanitized from an uploaded archive's
plugin.info.txt (or an extension id) into getInstallDir(), wh

extension: validate base name to prevent path traversal on install

The extension base name flowed unsanitized from an uploaded archive's
plugin.info.txt (or an extension id) into getInstallDir(), where
fullpath() collapses '..' segments. A crafted base such as
'../../../../evil' therefore resolved outside lib/plugins/, letting
dircopy() write the archive contents to an arbitrary web-writable path.

Route every base assignment through a new setBase() that rejects
anything other than a bare extension name.

Note: this is not really a security concern since plugins can execute
arbitrary code by design. The is mostly to make sure, plugin code is not
installed accidentally at the wrong location.

show more ...

ExtensionManager: get base from plugin classes. fixes #4484

When installing a plugin that has no plugin.info.txt, we need to figure
out where it belongs from other data. Previously we checked the ar

ExtensionManager: get base from plugin classes. fixes #4484

When installing a plugin that has no plugin.info.txt, we need to figure
out where it belongs from other data. Previously we checked the archive
name or folder within. This will fail for archives generated from github
branches as the plugin would be named "dokuwiki-plugin-foobar" or "master".

This implements looking for known plugin type php files, parsing them
with PHP's parser and extracting the class name. The base name is in
that class name.

Seems to work fine in my unit and manual tests.

show more ...

Extension Manager: updated tests