Merge pull request from GHSA-v642-mh27-8j6m

Due to insufficient access-level checks on the Wiki redirection page, any user could reveal private Projects' names, by accessing wiki.php with sequentially incremented IDs. Fixes #32981, CVE-2023-44394
mantisbt · Oct 14, 2023 · 65c4488 · 65c4488
1 parent 2cf945b
commit 65c4488
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/wiki.php b/wiki.php
@@ -43,11 +43,13 @@
 if( $f_type == 'project' ) {
 	if( $f_id !== 0 ) {
 		project_ensure_exists( $f_id );
+		access_ensure_project_level( VIEWER, $f_id );
 	}
 
 	$t_url = wiki_link_project( $f_id );
 } else {
 	bug_ensure_exists( $f_id );
+	access_ensure_bug_level( VIEWER, $f_id );
 	$t_url = wiki_link_bug( $f_id );
 }