en Copyright 2025 Java http://127.0.0.1:8080/history/dokuwiki/_test/tests/Remote/ApiCoreAclCheckTest.php#7ec464d90fb88e69d3690d59f84747bc52480fa6 fix(remote): make aclCheck self-check case-insensitive-backend awareThe check gating aclCheck() for other users compared the requested useragainst REMOTE_USER verbatim. On a case-insensitive auth backend a usernaming themselves in a different case than their login was treated as adifferent user and wrongly denied checking their own ACL. Normalize bothnames the way auth_isMember() does before comparing.The self-check was introduced in 884caed92. List of files: /dokuwiki/_test/tests/Remote/ApiCoreAclCheckTest.php Wed, 08 Jul 2026 13:50:59 +0000 Andreas Gohr <gohr@cosmocode.de> http://127.0.0.1:8080/history/dokuwiki/_test/tests/Remote/ApiCoreAclCheckTest.php#884caed926ca0aa0af6ce3f34ae3aa7317a3361a Remote: restrict core.aclCheck for other users to superusersaclCheck() let any API-enabled user pass an arbitrary username and learnthat user's effective permission level on any page/namespace, enablingACL-posture enumeration of other accounts. Checking another user'spermissions is now limited to superusers; users may still check theirown. The deprecated legacyAclCheck() delegates here and is covered too.Not really a big security concern, but there is no reason to enable it.Note: arbitrary groups can still be checked by anyone. List of files: /dokuwiki/_test/tests/Remote/ApiCoreAclCheckTest.php Thu, 25 Jun 2026 19:35:40 +0000 Andreas Gohr <gohr@cosmocode.de> http://127.0.0.1:8080/history/dokuwiki/_test/tests/Remote/ApiCoreAclCheckTest.php#6e1ddc64940f0098c726a0f486a45e4ca1221956 fix ApiCoreAclCheckTestThis is mostly syntactic fix. I did not check how sensible these testsare and did not switch from positional to named arguments List of files: /dokuwiki/_test/tests/Remote/ApiCoreAclCheckTest.php Sat, 06 Jan 2024 16:25:44 +0000 Andreas Gohr <andi@splitbrain.org> http://127.0.0.1:8080/history/dokuwiki/_test/tests/Remote/ApiCoreAclCheckTest.php#285c73a17369665ceb4a048858d947f6a025af8f More adjusted API tests List of files: /dokuwiki/_test/tests/Remote/ApiCoreAclCheckTest.php Fri, 01 Dec 2023 14:28:58 +0000 Andreas Gohr <andi@splitbrain.org>