en Copyright 2025 Java http://127.0.0.1:8080/history/dokuwiki/inc/Remote/#75aef198cdc7307a75ab63c9403e704e2194959a Merge pull request #4633 from dokuwiki/issue-1690fix(mail): keep '&' intact in mailto links with multiple query params List of files: /dokuwiki/inc/Remote/LegacyApiCore.php Thu, 04 Jun 2026 17:00:00 +0000 Andreas Gohr <andi@splitbrain.org> http://127.0.0.1:8080/history/dokuwiki/inc/Remote/#7e687fd85a40bd8453b39b64bae8e989ab32fd36 fix(auth): scope media ACL checks to the namespaceMedia files have no per-file ACLs; permissions must be evaluated againstthe namespace they live in. Several call sites passed the raw media IDto auth_quickaclcheck(), so a page-intended exact-ID rule (e.g. onwiki:secret.png) could silently apply to a media file sharing that ID.Introduce mediaAclPath() that builds the correct namespace wildcardpath (handling root-namespace media) and route all media-related ACLchecks through it. Also normalize the lone `:X` sentinel variant infetch.functions.php to the standard `:*` form.fixes: #4647 List of files: /dokuwiki/inc/Remote/ApiCore.php/dokuwiki/inc/Remote/Response/Media.php Fri, 29 May 2026 09:00:00 +0000 Andreas Gohr <andi@splitbrain.org>