01562: The variable {$Action} is empty.
{$Action} is empty.Description:
I've found yet another bug: The variable {$Action} is empty.
{$Action} | browse |
In the code in pmwiki.php, on line 1727, the "pvCoreGlobals()" function handles variables that can be accessed via "$GLOBALS".
However, the variable in Page specific variables is written as "{$Action}", but according to line 424, the variable in "$GLOBALS" is written as "$action".
This creates a case sensitivity conflict.
(Judging by the code, there was already a similar error on line 278 with the "skin/Skin" variable.)
Furthermore, I would recommend not defining the variable "$action" directly via "$_GET" or "$_POST" as this is a key factor that can lead to security vulnerabilities.
(I would convert it to an alphanumeric string using a regular expression.)
I also noticed other variables that are suspiciously empty: "{$PasswdAttr}", "[@{$PasswdEdit}", "{$PasswdPublish}", "{$PasswdRead}", and "{$PasswdUpload}".
* {$PasswdAttr}
* {$PasswdEdit}
* {$PasswdPublish}
* {$PasswdRead}
* {$PasswdUpload} |
|
However, due to time constraints, I haven’t examined them more closely.
Thanks, $action will be sanitized to accept only Latin letters, digits, underscore, minus, slash. The page variable {$Action} should be fixed. Indeed the situation is similar to "if skin" but the reverse is true: the global variable $Skin is capitalized, not the condition.
The password variables should only exist if they are defined for the page in ?action=attr, otherwise they should be empty. When I added these, the variables show. ({$PasswdPublish} only when PmWiki:Drafts are enabled, not here.) However it seems there is another bug, trying to set here different passwords fails -- will review this. --Petko
The {$PasswdRead} and similar page variables were indeed broken -- the saving of the new passwords or groups worked correctly, but the display of the page variables didn't. Thanks again for your excellent work Michael. --Petko