Description

By posting requests of the type

• http://wikiaddress/ForbiddenPage?action=show&rev=1

• http://wikiaddress/ForbiddenPage?action=show&rev=2

• http://wikiaddress/ForbiddenPage?action=show&rev=3

and so on, the users can find out at what times "ForbiddenPage" was updated even if they do not have rights for viewing the page. For example, they can find out that the first revision is from Dec 21st 12:00:13, the second revision from Jan 10th, 11:52:10, and so on.

Steps to reproduce

1. Log into some wiki as somebody with admin rights.
2. Change the ACLs of some page to make in unreadable for anyone except yourself.
3. Optionally modify the page a few time more to create a rich revision history.
4. Log out.
5. Go to the page that you may no longer read (e.g. by typing the page name into the URL manually.)

6. Manually change the URL by adding ?action=show&rev=1, ?action=show&rev=2 and so on after the page name.

This way you will find out when the page was edited.

Details

This wiki. Verification requires Admin rights for setting ACLs.

Workaround

Add the following four lines of code after the line def do_show(pagename, request): in the file wikiaction.py for your local copy of MoinMoin:

   1     # We must check if the current page has different ACLs.
   2     if not request.user.may.read(pagename):
   3         Page(request, pagename).send_page(request)
   4         return

Discussion

The problem does not exist if "recall" is used in place of "show"; the recall action checks ACLs properly. Since do_recall and do_show share a lot of code, there are two possible fixes that also make the code cleaner:

1. Remove the "rev" option for "show". I don't think it is used unless it is typed manually, so it just duplicates the functionality of an existing action ("recall").

2. Refactor the functions so that they use a common implementation. Currently, apart from the missing check in do_show, they only differ in the use of the keyword argument count_hit (and that difference is questionable anyway; shouldn't the hit be counted in both cases?).

Plan

• Priority: med

• Assigned to: ThomasWaldmann

• Status: fixed in patch-649

CategoryMoinMoinBugFixed