Welcome Guest [Log In] [Register]
Viewing Single Post From: Security update
Jacroe
Member Avatar
Administrator
A security hole has been discovered that can allow an attacker to change your wiki, even when the wiki is locked. To plug this hole, add the following code in your save.php right below the <?php
Code:
 
if (file_exists('noedit.lock')) {
die('This wiki has been locked from editing. <a href="index.php">MainPage</a>'); }


Your new save.php file should look something like this:
Code:
 
<?php
if (file_exists('noedit.lock')) {
die('This wiki has been locked from editing. <a href="index.php">MainPage</a>'); }
if (($_POST['article']) == '') {

With more code after that. Save the changes, and it should work. If it doesn't, please post about it in the General Support forum.

Alternatively, you can just replace your old save.php with the new one attached to this topic.
Attached to this post:
Attachments: save.php (2.72 KB)
Offline Profile Quote Post
Security update · Announcements & News