| aabc4782 | 06-Jun-2026 |
Andreas Gohr <andi@splitbrain.org> |
(security) Add CSRF protection and use Form class in popularity plugin
The plugin is accessible to managers, not just admins, and had two
separate issues.
1. Missing CSRF token (low severity)
Th
(security) Add CSRF protection and use Form class in popularity plugin
The plugin is accessible to managers, not just admins, and had two
separate issues.
1. Missing CSRF token (low severity)
The handler accepted the posted data and toggled autosubmit without
checking a security token. A cross-site forged POST against a logged-in
manager could enable autosubmit and trigger a submission of the wiki's
data to the popularity server.
2. Reflected XSS (low severity)
When a submission failed, the posted data was reflected back into a
readonly textarea without escaping. A value closing the textarea early
(eg. </textarea><script>...) could inject script into the manager's
browser.
To exploit this, not only a CSRF attack against an authenticated
manager was needed, also the connection to the DokuWiki popularity
server needed to fail.
The popularity plugin now verifies the security token before it sends
data or toggles the autosubmit option.
The form is now built via the the Form API so the textarea value is
escaped automatically. The security token is emitted automatically.
The fallback browser-submission form posts to an external server and is
built without the security token.
show more ...
|