[rpms/dokuwiki] f44: Backport "disableactions" mechanism bypass fix

[rpms/dokuwiki] f44: Backport "disableactions" mechanism bypass fix

[Artur Frenszek-Iwicki]

A new commit has been pushed.

Repo   : rpms/dokuwiki
Branch : f44
Commit : c48e9bdb4df8e1cbd76d7ddcaacaca2866f66531
Author : Artur Frenszek-Iwicki <fedora@svgames.pl>
Date   : 2026-08-12T13:27:51+02:00
Stats  : +92/-1 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/dokuwiki/c/c48e9bdb4df8e1cbd76d7ddcaacaca2866f66531?branch=f44

Log:
Backport "disableactions" mechanism bypass fix

---
diff --git a/4731.patch b/4731.patch
new file mode 100644
index 0000000..2b007fc
--- /dev/null
+++ b/4731.patch
@@ -0,0 +1,80 @@
+From 012ec40c0d41cdbe5cb81aec13089eb9b8c86788 Mon Sep 17 00:00:00 2001
+From: Andreas Gohr <gohr@cosmocode.de>
+Date: Tue, 11 Aug 2026 15:23:18 +0200
+Subject: [PATCH] security(actions): resolve action names to exactly one class
+
+Action names were resolved by dropping underscore separated parts from the end
+until a matching class was found. Any name carrying extra underscores thus
+reached a core action while keeping a name that no longer matched the
+disableactions setting, bypassing it. Each name now maps to exactly one class,
+the export modes and profile_delete being the only ones with underscores.
+
+Fixes #4731
+---
+ _test/tests/Action/ActionTest.php | 53 +++++++++++++++++++++++++++++++
+ inc/ActionRouter.php              | 38 ++++++++++++----------
+ 2 files changed, 75 insertions(+), 16 deletions(-)
+
+diff --git a/inc/ActionRouter.php b/inc/ActionRouter.php
+index 83b8339abd..c00fb9757b 100644
+--- a/inc/ActionRouter.php
++++ b/inc/ActionRouter.php
+@@ -8,7 +8,9 @@
+ use dokuwiki\Action\Exception\ActionException;
+ use dokuwiki\Action\Exception\FatalException;
+ use dokuwiki\Action\Exception\NoActionException;
++use dokuwiki\Action\Export;
+ use dokuwiki\Action\Plugin;
++use dokuwiki\Action\ProfileDelete;
+ 
+ /**
+  * Class ActionRouter
+@@ -167,28 +169,32 @@ protected function handleFatalException(\Throwable $e)
+     /**
+      * Load the given action
+      *
+-     * This translates the given name to a class name by uppercasing the first letter.
+-     * Underscores translate to camelcase names. For actions with underscores, the different
+-     * parts are removed beginning from the end until a matching class is found. The instatiated
+-     * Action will always have the full original action set as Name
++     * Each action name maps to exactly one class. A name made up of letters and digits maps to
++     * the class of the same name with an uppercased first letter. The export modes and
++     * profile_delete are the only action names containing underscores. Any other name does not
++     * name an action.
+      *
+-     * Example: 'export_raw' -> ExportRaw then 'export' -> 'Export'
++     * Example: 'media' -> Media, 'export_odt_book' -> Export
+      *
+-     * @param $actionname
++     * @param string $actionname the name of the action to load
+      * @return AbstractAction
+-     * @throws NoActionException
++     * @throws NoActionException when the name does not name an action
+      */
+     public function loadAction($actionname)
+     {
+-        $actionname = strtolower($actionname); // FIXME is this needed here? should we run a cleanup somewhere else?
+-        $parts = explode('_', $actionname);
+-        while ($parts !== []) {
+-            $load = implode('_', $parts);
+-            $class = 'dokuwiki\\Action\\' . str_replace('_', '', ucwords($load, '_'));
+-            if (class_exists($class)) {
+-                return new $class($actionname);
+-            }
+-            array_pop($parts);
++        $actionname = strtolower($actionname);
++
++        // the only action names carrying underscores
++        if (preg_match('/^export_[a-z0-9]+(_[a-z0-9]+)*$/', $actionname)) {
++            return new Export($actionname);
++        }
++        if ($actionname === 'profile_delete') {
++            return new ProfileDelete($actionname);
++        }
++
++        if (preg_match('/^[a-z0-9]+$/', $actionname)) {
++            $class = 'dokuwiki\\Action\\' . ucfirst($actionname);
++            if (class_exists($class)) return new $class($actionname);
+         }
+ 
+         throw new NoActionException();

diff --git a/dokuwiki.spec b/dokuwiki.spec
index 7482e31..5c4cd8c 100644
--- a/dokuwiki.spec
+++ b/dokuwiki.spec
@@ -5,7 +5,7 @@ License:	GPL-2.0-only
 %global		releasenum 2025-05-14b
 %global		releasetag %(rel="%{releasenum}"; echo "${rel//-/}")
 Version:	%{releasetag}
-Release:	6%{?dist}
+Release:	7%{?dist}
 
 %global php_min_version 7.4
 
@@ -26,10 +26,18 @@ Patch2:		CVE-2026-26477.patch
 # https://github.com/dokuwiki/dokuwiki/commit/ed28f990b6e1705dab522ad34afa8c02b188dc91
 Patch3:		CVE-2026-37106.patch
 
+# Assortment of security fixes.
+#
 # Backport from upstream. Edited to remove changes to tests.
 # https://github.com/dokuwiki/dokuwiki/pull/4703
 Patch4:		4703.patch
 
+# Fix bypass of "disableactions" mechanism.
+#
+# Backport from upstream. Edited to remove changes to tests.
+# https://github.com/dokuwiki/dokuwiki/commit/012ec40c0d41cdbe5cb81aec13089eb9b8c86788
+Patch5:     4731.patch
+
 BuildArch:	noarch
 
 %global smoke_test 1
@@ -291,6 +299,9 @@ fi
 %doc DOKUWIKI-SELINUX.README
 
 %changelog
+* Wed Aug 12 2026 Artur Frenszek-Iwicki <fedora@svgames.pl> - 20250514b-7
+- Backport "disableactions" mechanism bypass fix
+
 * Wed Jul 22 2026 Artur Frenszek-Iwicki <fedora@svgames.pl> - 20250514b-6
 - Backport some more security patches