[rpms/dokuwiki] f44: Backport object injection vulnerability fix

[rpms/dokuwiki] f44: Backport object injection vulnerability fix

[Artur Frenszek-Iwicki]

A new commit has been pushed.

Repo   : rpms/dokuwiki
Branch : f44
Commit : c972bc7b90b9633f014959d9288b938137debcb9
Author : Artur Frenszek-Iwicki <fedora@svgames.pl>
Date   : 2026-09-02T22:45:03+02:00
Stats  : +78/-1 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/dokuwiki/c/c972bc7b90b9633f014959d9288b938137debcb9?branch=f44

Log:
Backport object injection vulnerability fix

---
diff --git a/4752.patch b/4752.patch
new file mode 100644
index 0000000..7a1b899
--- /dev/null
+++ b/4752.patch
@@ -0,0 +1,68 @@
+From 1531802afb2ac3eea147a887600fa5750e74e681 Mon Sep 17 00:00:00 2001
+From: Andreas Gohr <andi@splitbrain.org>
+Date: Wed, 2 Sep 2026 20:47:59 +0200
+Subject: [PATCH] fix(security): prevent object injection via unserialize
+
+This fixes a critical security vulnerability potentially leading to
+remote code execution.
+
+See #4752
+---
+ inc/Cache/CacheInstructions.php      | 2 +-
+ inc/Draft.php                        | 2 +-
+ inc/parserutils.php                  | 2 +-
+ lib/plugins/extension/Repository.php | 2 +-
+ 4 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/inc/Cache/CacheInstructions.php b/inc/Cache/CacheInstructions.php
+index 2fbe4a0ecf..f0df8eaf0f 100644
+--- a/inc/Cache/CacheInstructions.php
++++ b/inc/Cache/CacheInstructions.php
+@@ -27,7 +27,7 @@ public function __construct($id, $file, $syntax = null)
+     public function retrieveCache($clean = true)
+     {
+         $contents = io_readFile($this->cache, false);
+-        return empty($contents) ? [] : unserialize($contents);
++        return empty($contents) ? [] : unserialize($contents, ['allowed_classes' => ['stdClass']]);
+     }
+ 
+     /**
+diff --git a/inc/Draft.php b/inc/Draft.php
+index 4f108f60e6..8c095766b8 100644
+--- a/inc/Draft.php
++++ b/inc/Draft.php
+@@ -119,7 +119,7 @@ public function getDraftText()
+                 "Draft for page $this->id and user $this->client doesn't exist at $this->cname."
+             );
+         }
+-        $draft = unserialize(io_readFile($this->cname, false));
++        $draft = unserialize(io_readFile($this->cname, false), ['allowed_classes' => false]);
+         return cleanText(con($draft['prefix'], $draft['text'], $draft['suffix'], true));
+     }
+ 
+diff --git a/inc/parserutils.php b/inc/parserutils.php
+index f786717769..43bc6b81a0 100644
+--- a/inc/parserutils.php
++++ b/inc/parserutils.php
+@@ -474,7 +474,7 @@ function p_read_metadata($id, $cache = false)
+ 
+     $file = metaFN($id, '.meta');
+     $meta = file_exists($file) ?
+-        unserialize(io_readFile($file, false)) :
++        unserialize(io_readFile($file, false), ['allowed_classes' => false]) :
+         ['current' => [], 'persistent' => []];
+ 
+     if ($cache) {
+diff --git a/lib/plugins/extension/Repository.php b/lib/plugins/extension/Repository.php
+index 2b1e3f9c77..bfff1e643b 100644
+--- a/lib/plugins/extension/Repository.php
++++ b/lib/plugins/extension/Repository.php
+@@ -304,7 +304,7 @@ protected function retrieveCache($id)
+     {
+         $cache = new Cache(self::CACHE_PREFIX . $id, self::CACHE_SUFFIX);
+         if ($cache->useCache(['age' => self::CACHE_TIME])) {
+-            return unserialize($cache->retrieveCache(false));
++            return unserialize($cache->retrieveCache(false), ['allowed_classes' => false]);
+         }
+         return null;
+     }

diff --git a/dokuwiki.spec b/dokuwiki.spec
index 5c4cd8c..e67fc2e 100644
--- a/dokuwiki.spec
+++ b/dokuwiki.spec
@@ -5,7 +5,7 @@ License:	GPL-2.0-only
 %global		releasenum 2025-05-14b
 %global		releasetag %(rel="%{releasenum}"; echo "${rel//-/}")
 Version:	%{releasetag}
-Release:	7%{?dist}
+Release:	8%{?dist}
 
 %global php_min_version 7.4
 
@@ -38,6 +38,12 @@ Patch4:		4703.patch
 # https://github.com/dokuwiki/dokuwiki/commit/012ec40c0d41cdbe5cb81aec13089eb9b8c86788
 Patch5:     4731.patch
 
+# Fix object injection, potentially leading to RCE.
+#
+# Backport from upstream:
+# https://github.com/dokuwiki/dokuwiki/commit/1531802afb2ac3eea147a887600fa5750e74e681
+Patch6:     4752.patch
+
 BuildArch:	noarch
 
 %global smoke_test 1
@@ -299,6 +305,9 @@ fi
 %doc DOKUWIKI-SELINUX.README
 
 %changelog
+* Wed Sep 02 2026 Artur Frenszek-Iwicki <fedora@svgames.pl> - 20250514b-8
+- Backport object injection vulnerability fix
+
 * Wed Aug 12 2026 Artur Frenszek-Iwicki <fedora@svgames.pl> - 20250514b-7
 - Backport "disableactions" mechanism bypass fix