phpwiki-bugs Mailing List for PhpWiki

Bugs item #758044, was opened at 2003年06月20日 19:37
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=106121&aid=758044&group_id=6121
Category: version 1.3.x (experimental)
Group: PHP error
Status: Open
Resolution: None
Priority: 5
Submitted By: Martin Baute (devsolar)
Assigned to: Nobody/Anonymous (nobody)
Summary: Plugin UnfoldSubpages does not sort (includes fix)
Initial Comment:
The plugin UnfoldSubpages advertises support for 
sorting, but never evaluates the $sort parameter.
The code was in there in version 1.3 of 
phpwiki/lib/plugin/UnfoldSubpages.php, but commented 
out - sorting thus never worked.
About line 129 of file version 1.7, I exchanged
$subpages = array_reverse($subpages);
with
if ($sort != 'asc') {
$subpages = array_reverse($subpages);
}
Worked for me. Hint: $sortby, another parameter to the 
plugin, also never gets evaluated...
----------------------------------------------------------------------
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=106121&aid=758044&group_id=6121

Bugs item #752218, was opened at 2003年06月10日 14:58
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=106121&aid=752218&group_id=6121
Category: All databases
Group: User Authentication
Status: Open
Resolution: None
Priority: 5
Submitted By: John Sechrest (sechrest)
Assigned to: Nobody/Anonymous (nobody)
Summary: User authentication sends passwd in clear text
Initial Comment:
It looks to me like the process of taking a username
and then the password sends that password back to the 
server in clear text.
Either the server needs to collect the password in 
SSL , or it needs to use the userAuth process to 
collect and encrypt the password at the browser.
when I added user authentication to the old version
of php wiki for myself, I used the browser to do the encryption
using this library:
<?PHP
/// Auth example
/// how to do authentication
/// Assume a database like this:
/// create table members (
/// member_id int auto_increment primary key,
/// firstname varchar(40),
/// lastname varchar(40),
/// address varchar(60),
/// city varchar(40),
/// State varchar(16),
/// zip varchar(16),
/// Phone varchar(16),
/// bphone varchar(16),
/// email varchar(60),
/// login varchar(16),
/// passwd varchar(16),
/// team int,
/// admin int,
/// comment varchar(255)
/// );
/// Note, this need to add encryption on the passwd, which it 
does not do.
/// Constants for the php database access
/// auth code 
/// started from 
http://www.zend.com/zend/tut/authentication.php#Heading1
1
 $auth = false; // Assume user is not authenticated 
 if (isset( $PHP_AUTH_USER ) && isset($PHP_AUTH_PW)) { 
 // Connect to MySQL 
 mysql_connect( $authhost, $authdblogin, 
$authdbpasswd ) 
 or die ( 'Unable to connect to server.' ); 
 // Select database on MySQL server 
 mysql_select_db( $authdatabase ) 
 or die ( 'Unable to select database.' ); 
 // Formulate the query 
 $authsql = "SELECT * FROM $authtable WHERE 
 login = '$PHP_AUTH_USER' AND 
 passwd = '$PHP_AUTH_PW'"; 
 // Execute the query and put results in $result 
 $authresult = mysql_query( $authsql ) 
 or die ( 'Unable to execute query for login.' ); 
 // Get number of rows in $result. 
 $authnum = mysql_numrows( $authresult ); 
 if ( $authnum != 0 ) { 
 // A matching row was found - the user is 
authenticated. 
 for ($i = 0; $i < $authnum; $i++) {
 $admin = mysql_result($authresult, $i, "admin"); 
 /// debug echo " admin = $admin\n" ;
 }
 $auth = true; 
 }
 }
 if ( ! $auth ) { 
 header( 'WWW-Authenticate: Basic realm=$wwwrealm' 
); 
 header( 'HTTP/1.0 401 Unauthorized' ); 
 echo 'Authorization Required.'; 
 echo ' You need to register';
 exit; 
 } 
?>
I am getting feedback that I need to fix this security hole
for our use of the wiki. What will it take for that to happen?
----------------------------------------------------------------------
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=106121&aid=752218&group_id=6121

Bugs item #747790, was opened at 2003年06月02日 15:11
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=106121&aid=747790&group_id=6121
Category: version 1.3.x (experimental)
Group: None
Status: Open
Resolution: None
Priority: 5
Submitted By: Michael van Dam (mvandam)
Assigned to: Nobody/Anonymous (nobody)
Summary: Loading (from zip dump) has problems if files have %20 (spc)
Initial Comment:
I am using CVS snapshot of phpwiki from last week.
When trying to load in my wiki from a zip dump file into 
a freshly "deflowered" wiki, I get a couple of problems.
First: any *new* file (in the dump, but not in the 
standard PgSrc), comes up as an edit conflict. There 
are buttons for "Merge" or "Load Anyways".
Second: any file containg space (saved with %20) and 
presumably other special chars cannot be found by 
the system. Here is the error message:
Loading '/tmp/wiki/Content Management'
lib/FileFinder.php:143: Fatal[256]: /tmp/wiki/Content 
Management: file not found
--------------------------------------------------------------------------------
Fatal PhpWiki Error
lib/FileFinder.php:143: Fatal[256]: /tmp/wiki/Content 
Management: file not found
What I had to do was: Unzip the zip file, and specify 
the DIRECTORY as source for dump files. Rename all 
files containing %20 to contain an actual SPACE 
instead. Then it works as expected.
Seems like FileFinder is a bit broken.
----------------------------------------------------------------------
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=106121&aid=747790&group_id=6121