{"push_id":583775694,"size":2,"distinct_size":2,"ref":"refs/heads/old-stable","head":"d0a452980dab3a51fc92642094d43d5fda914def","before":"4325e9e13609b1b3f370c056f974e89eb9abe3ff","commits":[{"sha":"16ca97e1690c775fa74d3c3cb1a906685a37b53b","author":{"email":"dbd122ef7b6a09ffecf5db9c9296320f3c94e707@splitbrain.org","name":"Andreas Gohr"},"message":"check permissions in ACL plugin's RPC API component. #1056\n\nSecurity Fix\n\nSeverity: Medium\nType:     Remote Priviledge Escalation\nRemote:   yes\n\nVulnerability Details:\n\nThis fixes a security hole in the ACL plugins remote API component. The\nplugin failed to check for superuser permissions before executing ACL\naddition or deletion. This means everybody with permissions to call the\nXMLRPC API also had permissions to set up their own ACL rules and thus\ncircumventing any existing rules.\n\nRisk Assessment:\n\nThe XMLRPC API in DokuWiki is marked experimental and off by default. It\nalso implements an additional safeguard by giving access to a configured\ncircle of users and groups only. So only a minor number of DokuWiki\ninstallations will be affected at all.\nFor affected installations the risk is high if users with access to the\nAPI are not to be trusted.\nThus the overall severity of medium.\n\nResolution:\n\nInstallations applying this commit are safe. A hotfix is about to be\nreleased. Meanwhile users are advised to disable the XMLRPC API in the\nconfig manager.","distinct":true,"url":"https://api.github.com/repos/splitbrain/dokuwiki/commits/16ca97e1690c775fa74d3c3cb1a906685a37b53b"},{"sha":"d0a452980dab3a51fc92642094d43d5fda914def","author":{"email":"61fc7bcf04ff146cac10c8334fa8324470f67d53@unistra.fr","name":"Guy Brand"},"message":"Hotfix release 2014-05-05d \"Ponder Stibbons\"","distinct":true,"url":"https://api.github.com/repos/splitbrain/dokuwiki/commits/d0a452980dab3a51fc92642094d43d5fda914def"}]}