Anonymous users can create page without permissions after broken sql page shown
- Status
- Closed
- Subject
- Anonymous users can create page without permissions after broken sql page shown
- Version
- 2.x
- Category
- Error
- Feature
- All / Undefined
Permission - Submitted by
- liquidape
- Lastmod by
- liquidape
- Rating
- Description
An anonymous user without edit permissions can edit create a new page.
To Repeat:
1. Be logged into a user with no edit permisssions
2. Find a red ? link to an uncreated page.
3. Click the link
4. Note you don't have permission to edit/create the page.5. Log out
6. Click the red ? link as Anonymous
7. Note you can edit the new page
8. Save the page - Note the error:An error occured in a database query!
Context:
File tiki-editpage.php
Url tiki-editpage.php
Query:
insert into `tiki_user_watches`(`user`,`event`,`object`,`email`,`type`,`title`,`url`) values(?,?,?,?,?,?,?)
Values:
0 NULL
1 wiki_page_changed
2 LinkToLocPageFigs
3 NULL
4 wiki page
5 LinkToLocPageFigs
6 tiki-index.php?page=LinkToLocPageFigs
Message:
Column 'user' cannot be null
Built query was probably:
insert into `tiki_user_watches`(`user`,`event`,`object`,`email`,`type`,`title`,`url`) values(NULL,'wiki_page_changed','LinkToLocPageFigs',NULL,'wiki page','LinkToLocPageFigs','tiki-index.php?page=LinkToLocPageFigs')
9. Take note that though the error happened, the page was created.- Importance
- 9 high
- Priority
- 45
- Demonstrate Bug on Tiki 19+
-
This bug has been demonstrated on show2.tiki.org
Please demonstrate your bug on show2.tiki.org
Show.tiki.org is not configured properlyThe public/private keys configured to connect to show2.tiki.org were not accepted. Please make sure you are using RSA keys. Thanks.
- Demonstrate Bug (older Tiki versions)
-
This bug has been demonstrated on show.tikiwiki.org
Please demonstrate your bug on show.tikiwiki.org
Show.tiki.org is not configured properlyThe public/private keys configured to connect to show.tikiwiki.org were not accepted. Please make sure you are using RSA keys. Thanks.
- Ticket ID
- 1681
- Created
- Tuesday 08 April, 2008 21:28:58 UTC
by Unknown - LastModif
- Saturday 04 October, 2008 00:02:18 UTC