This is a static dump of issues in the old "Flyspray" bugtracker for DokuWiki. Bugs and feature requests
are now tracked at the issue tracker at Github.
Closed
Fixed
Fixed
FS#1918 Id not cleaned during XML-RPC putAttachment tempfile creation
Backend
-
2010-03-12 Michitux
In lib/exe/xmlrpc.php in putAttachment the given id isn't cleaned before the temporary file is created. As not all characters in the filename are allowed on all platforms, there are at least problems on windows, see http://forum.dokuwiki.org/post/17808. On the other hand I'm wondering if we shouldn't clean that id before unlinking the temporary file (imagine ids like ../../conf/local.php...). Perhaps something like md5 of that id + a timestamp would be a better filename? -
2010-03-16 Michitux
Fixed in current git version. This was a security issue when XML-RPC was enabled and untrusted people had upload + XML-RPC-permissions for the (whole) wiki.
