| fa03edf3 | 06-Jun-2026 |
Andreas Gohr <andi@splitbrain.org> |
(security) Enforce per-page edit permission in the revert plugin
The revert manager is accessible to managers, not just admins. Its
reversion loop called saveWikiText() for every submitted page id w
(security) Enforce per-page edit permission in the revert plugin
The revert manager is accessible to managers, not just admins. Its
reversion loop called saveWikiText() for every submitted page id without
checking the per-page ACL, relying only on the manager role. A manager
denied edit on a namespace could therefore revert those pages to an
older revision or blank them entirely (low severity).
The page listing already hid unreadable pages, but offered every
readable page for reversion, including ones the manager could not edit.
A hand-crafted POST could also target arbitrary ids regardless of what
the listing showed.
Each id is now cleaned and checked for edit permission before it is
reverted; ids that fail the check are silently skipped. The listing
additionally only offers pages the manager actually has edit permission
on, so the form and the action agree.
show more ...
|