| #
0aa34e23
|
| 30-Jun-2026 |
Andreas Gohr <gohr@cosmocode.de> |
Resolve configured paths to absolute to fix wiki dir protection (#50)
Relative roots (e.g. "firmware") never matched the absolute DOKU_INC, so
isWikiControlled() was silently bypassed and files insi
Resolve configured paths to absolute to fix wiki dir protection (#50)
Relative roots (e.g. "firmware") never matched the absolute DOKU_INC, so
isWikiControlled() was silently bypassed and files inside the DokuWiki
directory could be served, circumventing ACLs. Relative paths also resolved
against the current working directory, which differs between doku.php (wiki
root) and file.php (plugin dir) - hence listing worked while downloads failed
with "Path not readable".
Paths are now resolved to absolute (relative ones against DOKU_INC) before any
filesystem access and before the wiki/data dir comparison, making behaviour
cwd-independent and the guard effective. Also fixes the always-relative
savedir default and the doubled-slash (%2F%2F) in generated file URLs.
show more ...
|
| #
202f571c
|
| 03-Apr-2024 |
splitbrain <86426+splitbrain@users.noreply.github.com> |
�� Automatic code style fixes
|
| #
e82754c5
|
| 03-Apr-2024 |
Andreas Gohr <andi@splitbrain.org> |
prevent access of wiki files
This prevents the crawler to descent into the wiki directory or data
directory, even when for some reason a higher up directory was made
accessible. This should prevent
prevent access of wiki files
This prevents the crawler to descent into the wiki directory or data
directory, even when for some reason a higher up directory was made
accessible. This should prevent the circumvention of ACLs and prevent
access to sensitive data like user password hashes etc.
show more ...
|
| #
46bd41a8
|
| 13-Mar-2024 |
splitbrain <86426+splitbrain@users.noreply.github.com> |
�� Automatic code style fixes
|
| #
d6a45e5c
|
| 13-Mar-2024 |
Andreas Gohr <andi@splitbrain.org> |
ignore typical temporary files when listing directories
Operating systems love to cluter the file system with all kinds of
cruft. This adds a gitignore like config to skip those files when
listing f
ignore typical temporary files when listing directories
Operating systems love to cluter the file system with all kinds of
cruft. This adds a gitignore like config to skip those files when
listing files.
show more ...
|
| #
05f444a4
|
| 27-Feb-2024 |
Andreas Gohr <andi@splitbrain.org> |
style cleanup
|
| #
28af4b67
|
| 27-Feb-2024 |
Andreas Gohr <andi@splitbrain.org> |
Major Refactoring (will need some cleanup)
This refactors the plugin from one mega syntax file into multiple
classes.
The plugin now focuses on one usecase: listing files that are external
to the w
Major Refactoring (will need some cleanup)
This refactors the plugin from one mega syntax file into multiple
classes.
The plugin now focuses on one usecase: listing files that are external
to the wiki and making them downloadable. All other usecases have been
dropped. Also a bunch of other options have been dropped.
A new dispatcher makes it possible to deliver files without the need to
have the webserver pointing at them.
show more ...
|