Private pages can be overriden by URL hacking #44
Thanks for your great work on Omnigollum.
While using it, I've just noticed that if you specify
Then if you go to e.g. https://mywiki.com/private the authorization prompt is shown as expected. However, there seems to be an easy way to override this:
I'm by no means a Ruby developer, so I'm not too sure what's going on behind the scenes.
Something I tried was to modify the route, so that it's converted to downcase. While that works for that particular case, then unauthenticated users cannot access the open parts of the site that use capital letters, e.g. mywiki.com/Home. So no, the workaround does not quite work:
I'm sure there are better and cleverer ways to fix this.
The text was updated successfully, but these errors were encountered:
I just stumbled upon this issue while setting up gollum with omnigollum. Also having the described problem, I finally was able to solve this using regular expressions in the
:protected_routes => [ /\/[Pp][Rr][Ii][Vv][Aa][Tt][Ee]\/.*/, /\/[Pp][Rr][Ii][Vv][Aa][Tt][Ee]/ ]
I'm sure this solution can easily be improved, but being no ruby coder, this was the best I could come up with. Anyway, maybe this helps.
@mvdkleijn It's not a security flaw in omnigollum.
There is no way to turn off case sensitive route matching in Sinatra (that I could find, please correct me if I'm wrong). So you have two options. Perform URL normalisation on the web server, or use case insensitive regexes demonstrated above. I wouldn't necessarily write them like that though.
Assuming ruby is smart enough to not treat