en Copyright 2025 Java http://127.0.0.1:8080/history/dokuwiki/_test/tests/inc/media_restore.test.php#0579c2f8a6cf8c76cb756b91a4ab1167dcffd4af security(media): authorize the resolved target of media write operationsThe media manager computed a permission level for the request's namespaceand passed it to the media write helpers, which then acted on a target thatneed not live in that namespace. Reachability differs per helper:- media_restore() took the id to restore from the separate "image" parameter, unrelated to the namespace the permission was computed for. A user with upload permission in any one namespace could restore revisions of media in namespaces they cannot write.- media_upload() and media_upload_xhr() derive the target from the upload namespace plus a user-controlled filename that may carry its own namespace segments, so the target can only resolve into a sub-namespace of the upload namespace. Where that child has a stricter ACL, the parent's permission was applied instead.- media_metasave() was not vulnerable: its target and its permission both derive from the same request id, so the namespaces always matched. It is changed only for consistency.Each helper now recomputes the permission from its resolved target id, asmedia_delete() already does. The redundant $auth parameter is removed frommedia_restore() and media_metasave(), which have no other callers, andignored but kept for compatibility in media_upload() and media_upload_xhr().Severity: medium - an authenticated user with upload rights in one namespacecan restore media revisions in other namespaces, or write into a strictersub-namespace of one they can upload to; an authorization bypass affectingmedia integrity, not code execution or disclosure.fixes #4702 List of files: /dokuwiki/_test/tests/inc/media_restore.test.php Sun, 19 Jul 2026 20:33:30 +0000 Andreas Gohr <andi@splitbrain.org>