en Copyright 2025 Java http://127.0.0.1:8080/history/dokuwiki/_test/tests/lib/exe/ajax_requests.test.php#5d8c9d422c83ef31e1acbe6e37664185196c3016 (security) Require a security token for the lock AJAX callThe lock AJAX call refreshes the edit lock and saves a draft, both ofwhich change server state. It was gated only by the write ACL and,unlike the sibling draft-delete call, did not verify a security token(low severity).A cross-site forged POST against a logged-in user could, within thatuser's own write permissions, take or hold an edit lock and storeattacker-controlled draft content under their name.The call now verifies the security token before taking the lock orsaving the draft. Logged out users are unaffected, as no token isissued or checked for them. The edit lock timer now always sends thetoken with its refresh request, including when draft saving isdisabled. List of files: /dokuwiki/_test/tests/lib/exe/ajax_requests.test.php Sat, 06 Jun 2026 18:01:44 +0000 Andreas Gohr <andi@splitbrain.org> http://127.0.0.1:8080/history/dokuwiki/_test/tests/lib/exe/ajax_requests.test.php#e8c9256af140fbe66c11ee76e814e1a226fd61af (security) Clean the media upload namespace in AJAX uploadThe namespace passed to the AJAX backend was not cleaned correctly,resulting in two separate issues.1. Theoretical Reflected XSS The raw namespace was reflected into the JSON response and injected into the mediamanager DOM. However since the media manager only passes cleaned namespaces to AJAX and the ajax backen only returns JSON, this issue was not exploitable.2. Cross-namespace ACL bypass (medium severity) The uncleaned namespace was directly used to check ACLs. In a wiki where a user has upload permission in a namespace above a namespace where they don't have permissions (eg. upload allowed in :user:*, but upload denied in :user:secret:*) they could pass an upper case namespace (eg :user:SECRET) - no ACL does exist for this upper case namespace and the acl of the namespace above applies (:user). When the file is written a cleanID is applied to the full filename, turning the uppercase namespace into lowercase. This can allow users to write into a namespace they normally should not be allowed to write to, but it does require upload permissions in a higher namespace. List of files: /dokuwiki/_test/tests/lib/exe/ajax_requests.test.php Sat, 06 Jun 2026 15:21:28 +0000 Andreas Gohr <andi@splitbrain.org> http://127.0.0.1:8080/history/dokuwiki/_test/tests/lib/exe/ajax_requests.test.php#9ad2b9131dcbe90c5d256acd8f9f347b14d958fb replace deprecated phpunit assertions List of files: /dokuwiki/_test/tests/lib/exe/ajax_requests.test.php Mon, 25 Nov 2024 10:08:14 +0000 Andreas Gohr <andi@splitbrain.org> http://127.0.0.1:8080/history/dokuwiki/_test/tests/lib/exe/ajax_requests.test.php#7eed8b73db342c07918df4e7c6d9741380a027b8 adjusted the tests List of files: /dokuwiki/_test/tests/lib/exe/ajax_requests.test.php Tue, 29 Aug 2017 19:06:52 +0000 Andreas Gohr <andi@splitbrain.org> http://127.0.0.1:8080/history/dokuwiki/_test/tests/lib/exe/ajax_requests.test.php#f0cc02d3454070081b82b7907c0cbbfa74be3ed2 cleaning List of files: /dokuwiki/_test/tests/lib/exe/ajax_requests.test.php Fri, 28 Jul 2017 13:50:35 +0000 Yurii K <yurii-github@users.noreply.github.com> http://127.0.0.1:8080/history/dokuwiki/_test/tests/lib/exe/ajax_requests.test.php#814e20b885024d75719ca160139e824af2bb9992 extracted functionsadded test coverage List of files: /dokuwiki/_test/tests/lib/exe/ajax_requests.test.php Fri, 28 Jul 2017 13:34:15 +0000 Yurii K <yurii-github@users.noreply.github.com>