en Copyright 2025 Java http://127.0.0.1:8080/history/dokuwiki/_test/tests/#0579c2f8a6cf8c76cb756b91a4ab1167dcffd4af security(media): authorize the resolved target of media write operationsThe media manager computed a permission level for the request's namespaceand passed it to the media write helpers, which then acted on a target thatneed not live in that namespace. Reachability differs per helper:- media_restore() took the id to restore from the separate "image" parameter, unrelated to the namespace the permission was computed for. A user with upload permission in any one namespace could restore revisions of media in namespaces they cannot write.- media_upload() and media_upload_xhr() derive the target from the upload namespace plus a user-controlled filename that may carry its own namespace segments, so the target can only resolve into a sub-namespace of the upload namespace. Where that child has a stricter ACL, the parent's permission was applied instead.- media_metasave() was not vulnerable: its target and its permission both derive from the same request id, so the namespaces always matched. It is changed only for consistency.Each helper now recomputes the permission from its resolved target id, asmedia_delete() already does. The redundant $auth parameter is removed frommedia_restore() and media_metasave(), which have no other callers, andignored but kept for compatibility in media_upload() and media_upload_xhr().Severity: medium - an authenticated user with upload rights in one namespacecan restore media revisions in other namespaces, or write into a strictersub-namespace of one they can upload to; an authorization bypass affectingmedia integrity, not code execution or disclosure.fixes #4702 List of files: /dokuwiki/_test/tests/inc/media_metasave.test.php/dokuwiki/_test/tests/inc/media_restore.test.php/dokuwiki/_test/tests/inc/media_upload.test.php Sun, 19 Jul 2026 20:00:00 +0000 Andreas Gohr <andi@splitbrain.org> http://127.0.0.1:8080/history/dokuwiki/_test/tests/#3361bf0a349cd394d011fd1ebb19a11d50c13a36 fix(parser): fire PARSER_HANDLER_DONE only for the top-level parseHandler::finalize() triggered PARSER_HANDLER_DONE for every parse,including the per-item and per-blockquote sub-parses the built-inMarkdown list and quote modes run. A plugin hooking the event to appendinstructions (such as struct's automatic schema output) then injected acall into every list item. That call sat in front of the item'sparagraph, so GfmListblock could no longer recognise the item as tightand left the paragraph wrapper in place, wrapping every Markdown listitem in <p>.Mark the sub-parser handlers built by ModeRegistry::buildSubParser() sofinalize() fires PARSER_HANDLER_DONE only for the top-level document.Sub-parses instead fire a new PARSER_SUBHANDLER_DONE event, givingplugins that want per-item processing a dedicated hook; their resultsalso still reach the document event, nested inside each item's nestinstruction.Also correct the GfmListblock nest comments, which wrongly claimed thewrapper prevents the main Block pass from double-wrapping items in <p>;its real purpose is to keep the item's already-finalized sub-tree opaqueto the outer finalize, as Footnote does.The shared sub-parser mechanism (ModeRegistry::buildSubParser()) wasintroduced in 309a08521. List of files: /dokuwiki/_test/tests/Parsing/HandlerTest.php Tue, 21 Jul 2026 09:00:00 +0000 Andreas Gohr <gohr@cosmocode.de> http://127.0.0.1:8080/history/dokuwiki/_test/tests/#3ed34089439ec60adc294b4d4b976c5c88cf5be5 security(auth): use strict comparison in membership and ACL checksLoose comparison treated numerically-equal strings as the same value, soa superuser, manager, or ACL entry named with a numeric string (e.g. 1e3or @1e3) matched any user or group whose name was numerically equal(1000, 01000, 1000.0). Such names survive auth_nameencode() untouched,allowing silent privilege escalation. Match names strictly inauth_isMember() and auth_aclcheck_cb().Severity: low - only exploitable when an administrator names a superuser,manager or ACL group with a numeric string such as 1e3, an unusualconfiguration, so realistic deployments are rarely affected.fixes #4701 List of files: /dokuwiki/_test/tests/inc/auth_admincheck.test.php Sun, 19 Jul 2026 18:00:00 +0000 Andreas Gohr <andi@splitbrain.org> http://127.0.0.1:8080/history/dokuwiki/_test/tests/#657de3eabdf1415591ed4e1f15a761497a0a11cc fix(parser): defer GFM strikethrough to plugin ~~macro~~ syntaxThe GFM strikethrough mode sorted at 130 and its entry pattern matchedthe opening ~~ of plugin macros like ~~TOC~~ or ~~NOFOOTER~~, consumingthem as strikethrough before the owning plugin could parse them. Sortingit last lets those plugins claim their ~~KEYWORD~~ syntax first, whileplain ~~text~~ still falls through and renders as <del>. List of files: /dokuwiki/_test/tests/Parsing/ParserMode/GfmDeletedTest.php Tue, 21 Jul 2026 12:00:00 +0000 Andreas Gohr <gohr@cosmocode.de>