search

scragg0x / realms-wiki

Git based wiki inspired by Gollum
http://realms.io
GNU General Public License v2.0
833 stars 91 forks source link

Security: Improper access controls #172

Closed alxjsn closed 7 years ago

alxjsn commented 7 years ago

Added check for PRIVATE_WIKI in search function. Without this there would be information disclosure of content that is being stored on the site.

It may be a good idea to also remove all the functions from the navbar which are not available to an unauthenticated user when the wiki is running in private mode.

gazpachoking commented 7 years ago

This sounds good, but it looks like your indent size got messed up and is only 3 spaces. I like the idea of hiding inappropriate navbar items too, which would probably solve #163 as well.

alxjsn commented 7 years ago

Oops, spacing should be fixed now.

gazpachoking commented 7 years ago

Thanks!