Opened 9 years ago

Closed 8 years ago

#5338 closed defect (fixed)

download plain text

Reported by: Lucas Owned by: frayja
Priority: highest Component: ProtectedMacro
Severity: critical Keywords:
Cc: Trac Release: 0.11


the download in the plain text format allows the entire view, also the protected text. This is bad.

Attachments (2)

require_modify_permission.patch (2.0 KB) - added by miau 9 years ago.
add_format_check.patch (624 bytes) - added by miau 9 years ago.

Download all attachments as: .zip

Change History (9)

comment:1 Changed 9 years ago by miau

The diff view shows protected text, too.

comment:2 Changed 9 years ago by miau

I wrote the patch to fix the problem.

It require WIKI_MODIFY permission to download the plain text or to show diff.

Changed 9 years ago by miau

comment:3 Changed 9 years ago by anonymous

I'm sorry for including some debugging codes. When you patch the file, remove those.

comment:4 Changed 9 years ago by frayja

Please correct me if I'm wrong here but...

You don't seem to search the content of the wiki page for the #!protected pattern. So this patch will effectively prohibit viewing the diff of -any- wiki page unless you have the WIKI_MODIFY permission.

Currently the WIKI_VIEW permission handles this behavior. Although I agree that a separate permission for viewing diffs would have been more appropriate. This, however, should be provided by trac since they also provide the WIKI_VIEW and WIKI_MODIFY permissions.

It is a good approach though. Could you modify the patch a bit to search for the different #!protected patterns and apply the associated PROTECTED_VIEW permission? This should keep the ProtectedMacro from interfering to much with the 'core' trac workings.

(I'll try to do it myself in the near future if I can find the time)

comment:5 Changed 9 years ago by frayja

Resolution: fixed
Status: newclosed

This is now implemented using the mechanism supplied by miau (thanks!) and the strategy described in my previous reply.

comment:6 Changed 9 years ago by miau

Resolution: fixed
Status: closedreopened

Thank you for implementing! But the format must be checked since the action will be "view" when you download a plain text. I'll attach a patch that fix the problem.

Changed 9 years ago by miau

Attachment: add_format_check.patch added

comment:7 Changed 8 years ago by anonymous

Resolution: fixed
Status: reopenedclosed

Finally took the time (well it was only a few minutes) to apply the supplied patch.

Modify Ticket

Change Properties
Set your email in Preferences
as closed The owner will remain frayja.
The resolution will be deleted.

Add Comment

E-mail address and name can be saved in the Preferences.

Note: See TracTickets for help on using tickets.