This issue has been created
There is 1 update.
 
 
Release Notes Application / cid:jira-generated-image-avatar-3afb12b8-7ae8-495d-adfa-f9d4a1271d19 RN-110 Open

The 1.x migration can be run by any user who can view its page

 
View issue   ยท   Add comment
 

Issue created

 
cid:jira-generated-image-avatar-6615d3e2-e255-426a-84c5-edeb8c3d9e71 Vincent Massol created this issue on 05/Sep/26 20:08
 
Summary: The 1.x migration can be run by any user who can view its page
Issue Type: cid:jira-generated-image-avatar-3afb12b8-7ae8-495d-adfa-f9d4a1271d19 Bug
Affects Versions: 2.0
Assignee: Unassigned
Components: Application
Created: 05/Sep/26 20:08
Priority: cid:jira-generated-image-static-major-84800d69-d232-40bf-ad82-5972013e774d Major
Reporter: Vincent Massol
Description:

Problem

ReleaseNotes.Code.MigrationFrom1x converts every 1.x ChangesClass object of the wiki into the 2.x EntryClass plus ChangeClass pair, and saves every page it touches. The conversion is one-shot and irreversible: the 1.x object is removed from the page as part of it.

The page validates a form token, so the migration cannot be triggered from another site, but it checks no right at all. Any user who can view the page runs the migration by following the "Start the migration" link the page itself displays to them.

A user who cannot edit the change pages does not get far, since $doc.save() refuses a page the current user has no edit right on. But it refuses it by throwing, so the migration stops there and leaves the wiki half converted: the pages saved before the refusal carry the 2.x objects, the rest still carry the 1.x one.

Fix

Only display and run the migration for a user who can administer the wiki. The migration writes across the whole wiki, since its query is not restricted to the ReleaseNotes space, so wiki administration right is the right bar for it.

 
 

1 update

 
cid:jira-generated-image-avatar-6615d3e2-e255-426a-84c5-edeb8c3d9e71 Changes by Vincent Massol on 05/Sep/26 20:08
 
Fix Version: 2.7