| 0aa34e23 | 30-Jun-2026 |
Andreas Gohr <gohr@cosmocode.de> |
Resolve configured paths to absolute to fix wiki dir protection (#50)
Relative roots (e.g. "firmware") never matched the absolute DOKU_INC, so isWikiControlled() was silently bypassed and files insi
Resolve configured paths to absolute to fix wiki dir protection (#50)
Relative roots (e.g. "firmware") never matched the absolute DOKU_INC, so isWikiControlled() was silently bypassed and files inside the DokuWiki directory could be served, circumventing ACLs. Relative paths also resolved against the current working directory, which differs between doku.php (wiki root) and file.php (plugin dir) - hence listing worked while downloads failed with "Path not readable".
Paths are now resolved to absolute (relative ones against DOKU_INC) before any filesystem access and before the wiki/data dir comparison, making behaviour cwd-independent and the guard effective. Also fixes the always-relative savedir default and the doubled-slash (%2F%2F) in generated file URLs.
show more ...
|