Re: Re: Security Mailing List
> I am having issues with tiki-editpage.php.
>
> Tiki-editpage.php allows users without the correct permissions to open and edit pages that they cannot see.
>
> Tiki-index.php does stop the user from seeing the page, but it does not stop the user from editing what they are not supposed to edit.
>
> Someone gave me some advice in regards to line 24 in tiki-editpage.php, but it did not help the issue.
>
> Can anyone explain this behavior? I think that this qualifies as a security breach.
>
> thanks.
>
>
Which release? I fixed at least a security hole in 1.9 CVS
http://cvs.sourceforge.net/viewcvs.py/tikiwiki/tiki/tiki-editpage.php?r1=1.89.2.37&r2=1.89.2.38
;){kind=link}
;){kind=link}