You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I wanted to highlight a potential flaw in the extension code. Specifically, there's an issue with how files are accessed, which fails in wikis with private configurations or those using img_auth.php.
In the current implementation, the file retrieval method assumes direct access to the file's URL:
However, this approach doesn't work when img_auth.php is used, as direct URL access is restricted, and proper authentication processes are not followed in the code, leading to failed retrievals.
For environments where file access is regulated through img_auth.php, the method getLocalRefPath() should be considered for use, since it obtains files from the local path, avoiding unauthorized access issues.
Could this be adjusted to accommodate private or restricted-access wikis?
The text was updated successfully, but these errors were encountered:
YOUR1
added a commit
to YOUR1/diagrams-extension
that referenced
this issue
Oct 19, 2023
I wanted to highlight a potential flaw in the extension code. Specifically, there's an issue with how files are accessed, which fails in wikis with private configurations or those using
img_auth.php
.In the current implementation, the file retrieval method assumes direct access to the file's URL:
diagrams-extension/includes/Diagrams.php
Line 137 in 7b35076
However, this approach doesn't work when
img_auth.php
is used, as direct URL access is restricted, and proper authentication processes are not followed in the code, leading to failed retrievals.For environments where file access is regulated through img_auth.php, the method
getLocalRefPath()
should be considered for use, since it obtains files from the local path, avoiding unauthorized access issues.Could this be adjusted to accommodate private or restricted-access wikis?
The text was updated successfully, but these errors were encountered: