Changeset 1115 for trunk/core/lib/Foswiki.pm

Timestamp:

12/01/08 12:01:08 (3 years ago)

Author:

CrawfordCurrie

Message:

Item42: protect REVINFO from footpads

File:

• trunk/core/lib/Foswiki.pm (modified) (1 diff)

trunk/core/lib/Foswiki.pm

@@ -3625 +3625 @@
     my $rev = $params->{rev} || $cgiRev || '';
 
+    ( $web, $topic ) = $this->normalizeWebTopicName( $web, $topic );
+    if ($web ne $theWeb || $topic ne $theTopic) {
+        unless (
+            $this->security->checkAccessPermission(
+                'VIEW', $this->{user}, undef, undef, $topic, $web
+            )
+          )
+        {
+            return $this->inlineAlert( 'alerts', 'access_denied', $web,
+                $topic );
+        }
+    }
+
     return $this->renderer->renderRevisionInfo( $web, $topic, undef, $rev,
         $format );