Fix for Windows-specific vulnerability before PmWiki 2.7.5

This is a quick update to provide a manual fix for a recently reported vulnerability.

PmWiki 2.7.5 closed a vulnerability in PmWikis on Windows servers, reported by Michael Engelke. It potentially allows a person with edit access to a page, to retrieve the full source text of another page in a read-protected group where the person should not have access. All wikis versions 2.0.0 to 2.7.4 on Windows servers may be vulnerable.

If your PmWiki installation:

• runs on a Windows server, and
• your wiki allows editing for untrusted users, even only WikiSandbox, and
• you may have sensitive information in restricted wikigroups, such as SiteAdmin.Notify, and
• you cannot immediately upgrade to 2.7.5,

If your wiki meets all the conditions above, to close the vulnerability before you've had the chance to upgrade, you can add this to farmconfig.php or config.php:

if(!empty($_REQUEST['template']))
  $_REQUEST['template'] = preg_replace('![./\\\\]+!', '.', $_REQUEST['template']);

Petko