ACL checks in the media file details ajax calls only for root/arbitrary namespace

[michitux]

A comment in our old bug tracker alerted me of this issue: in the media manager ACLs are broken for all views for individual files if you have access to the root namespace or - in the case of the media diff ajax call - an arbitrary namespace.

I have reproduced this issue in my local DokuWiki installation, I can simply open an image I have no permission for in the media manager, I get a permission denied message in the media details tab and when I click on the detail tabs they load via ajax with the real content. The media diff ajax call is a bit more difficult to test as the ns parameter (but only that one) is a post parameter, but after changing the code to accept a get parameter as well I can clearly see that it uses the ns parameter for the permission check (and nothing else).

No actual file content is exposed, just the metadata, but the metadata can contain a lot of information (title, caption etc. from the exif metadata) and the full history is displayed, too. This also requires knowing the actual media file id.

So far I can see the following problems in the code:

• in ajax_mediadetails(), $NS is not set, but in tpl_mediaFileDetails() $NS is used and its value is only checked when it is set (if(isset($NS) && getNS($image) != $NS) return;)
• $AUTH is a cache for the permissions of the current media ns (wtf?) which is set by ajax_mediadiff() using the "ns" parameter as namespace without any checks if this is actually the namespace of the current media file. This check is done in tpl_mediaFileDetails() but not in media_diff() which is called in ajax_mediadiff().

I think a first fix could be to ignore the ns parameter in all ajax calls and instead set it based on the supplied image id.

I think we should fix this and release a hotfix release ASAP.

[splitbrain]

ouch. Can you provide a quick fix?

[Chris--S]

I noticed this same issue with media manager & acl just today, but from the other way around. When a user has full access to a namespace but no access to the parent namespace. The media manager shows the images but gives a denied access message when viewing details.

Was the $NS global 'rationalised' recently?

A side question - how can you check the user's permissions to a namespace? medialist plugin does a quick_aclcheck() using the namespace, but gets the actual permissions for the page (named as namespace) in the parent namespace.

[splitbrain]

Namespace permissions are checked by adding ':*' to the namespace usually.

[Chris--S]

@michitux your fix resolves my issue.

[splitbrain]

I will be home in an hour or so and build the hotfix release.

[Klap-in]

What about including 59d6be9 in the hotfix as well. This will improve the usability of the extension manager significantly, but is of course not urgent.

[splitbrain]

Hotfix is out.

[ginsterbusch]

Does that issue only apply to the current release or are all (some) older releases are affected as well?

[splitbrain]

It applies to at least the last two releases, maybe even older.

[mprins]

Will you push a new tag (eg. release_stable_2014-05-05a)?
I know this fix is in the stable branch as well.

[splitbrain]

tags pushed. I think I just learned something new about tags :-)