FS#2762 Sitemap World Readable (Disabled Registration; Access only with Login)

Security

• 

  2013-04-03 Namikaze

  I'm currently migrating our running Dokuwiki from "dokuwiki-2007-06-26b" to "2012-10-13 (Adora Belle)".
  
  Migrating on a Test-System is done with one Problem:
  
  The Sitemap is world readable (Not logged in), I compared it with the old Version (2007-06-26b) and the Sitemap is not accessible.
  So their must be an issue at some point, because the Sitemap should not be accessible with disabled registration and only registered/logged in users have read permission.
  Only if I disable the Sitemap-Feature it is not accessible, but then for all.
  
  System Details:  Solaris 10 8/07 SPARC, http 2.2.6, php 5.2.5
• 

  2013-04-04 ach

  Can not logged in users really fully access the sitemap? Or do you mean, they see the namespaces, but can actually not see any pages? If yes, then the sneaky_index config option is what you're looking for: https://www.dokuwiki.org/config:sneaky_index
• 

  2013-04-04 Namikaze

  Thanks for that link, it fixed it.
  It wasn't a full access to Namespaces but a overview of them, but I didn't find such an option, since it worked in the old Version without additional settings.
  But one Behavior is still a bit strange. The Settings fixed the problem but instead of "Permission denied" like on our old Wiki I get still the Description of Namespaces, no Namespaces are listed but it is kinda confusing:
  ----
  Sitemap
  
  This is a sitemap over all available pages ordered by namespaces.
  ----
  
  The same behavior happens with the page "Recent Changes"
  ----
  Recent Changes
  
  The following pages were changed recently.
  View changes of
  ----
• 

  2013-04-19 andi

  This behaviour has not changed since previous releases. You most probably had customizations which you lost during your upgrade.