Manual:Rename and move pages and Security:Security Advisories/BSSA-2022-02: Difference between pages

(Difference between pages)
No edit summary
 
(Created page with "{| class="wikitable" |+ ! ! |- |Date |2022-04-25 |- |Severity |Medium |- |Affected |BlueSpice 4.x |- |Fixed in |4.1.3 |} == Problem == Users are able to inject arbitrary HTML...")
Tag: 2017 source edit
 
Line 1: Line 1:
<bookshelf src="Book:User manual" />
{| class="wikitable"
==About moving pages==
|+
A wiki page can only be renamed by moving it. Moving is necessary, since the web address of the page changes during renaming. Normally, there are many links to a wiki page. It is therefore important that these links still work after renaming the page.
!
!
|-
|Date
|2022-04-25
|-
|Severity
|Medium
|-
|Affected
|BlueSpice 4.x
|-
|Fixed in
|4.1.3
|}


A page can be moved with or without redirecting the original page. Let's take a closer look at the differences.
== Problem ==
Users are able to inject arbitrary HTML (XSS) on regular pages, using a special value for the <nowiki><code>title</code></nowiki> parameter. This can be triggered via URL.


==What happens when you move a page?==
== Solution ==
When you move a page:
Upgrade to BlueSpice 4.1.3


*you rename the page name and thus the page title
== Acknowledgements ==
*the page content is displayed on the new page
Special thanks to the security team of an undisclosed customer
*the version history of the original page is transferred to the new page
 
If you move from the original page to the new page, an additional page with the old page name will be created. This page then serves as a redirect to the new page. If you do not create a redirect, the original page is simply replaced. In this case, you should check and update the links to the old page on your wiki.
 
=== What links here ===
Before you move a page, you should see if other pages link to that page name. To do this, go to ''What links here''  under ''...all actions'' in the page tools. If many links are listed here, you should create a redirect when moving the page.
[[File:Manual:action-move-what links here.png|alt=What links here|center|thumb|550x550px|What links here]]
The following diagram shows how to rename an "Emobile" page to a page called  "Electric Vehicles" page:
 
{{#drawio:Seite_verschieben}}
 
 
==How do I move a page?==
Go to the page tools menu item  "Manage page> Move":
 
<br />
 
#'''Click''' ''Move.'' [[File:Manual:action-move.png|alt=Actions menu|center|thumb|216x216px|Actions menu]]
#'''Enter''' a new page name. If you move the page to a different namespace, you need to include the namespace prefix as well.  [[File:Manual:action-move-dialog.png|alt=Moving a page to a different namespace and renaming the page|center|thumb|350x350px|Moving a page to a different namespace and renaming the page]]
#'''Provide''' a reason why why it was necessary to move the page (optional). This reason is shown in the logs of the wiki.
#'''Leave a redirect behind:''' Depending on the linking status or purpose of a page, you now have to decide whether to move the page with or without forwarding.
#'''Watch source page and target page''': Specify whether you want to put the source and landing pages on your watch list when redirecting.
#'''Click''' ''Done''. The page has been moved.[[File:Manual:action-move-success.png|alt=Successfull move|center|thumb|350x350px|Successfull move]]
===Move with redirect===
It makes sense to create a redirect in the following cases:
 
*The original page is linked to many other sites (e.g., from other websites or other internal wiki sites).
*The title of the original page is sometimes used in the search and the page should be found either way.
 
===Move without redirect===
In these cases, it makes sense to move without forwarding:
 
*A spelling error is corrected in the title. There are only a few links to the page and they are easy to find and replace.
*The original title should not appear in the search.
*An unnecessary redirection via a forwarding page should be avoided.
 
<br />
 
==Updating references to the page==
If no redirect was created when the page was renamed,  it is sometimes necessary to check if existing links  to the original page exist in your wiki. These must then be adapted accordingly to the new page name, so that the page is newly networked.
 
Users with administrator permissions can go to the page ''Special:Replace Text'' to find references to the previous page name.
 
Enter the original page title under "Existing text" and the new page title under "Replacement text":
[[File:Manual:1A1A.png|alt=Replace text|center|thumb|500x500px|Replace text]]
 
 
Select all wiki sections using the "All" button to find existing references to the original page:
[[File:Manual:replacetext-settings.png|alt=Replace text - settings|center|thumb|500x500px|Replace text - settings]]
 
 
If you click on "Continue" the text will not be replaced yet. First, an overview page with the results found will be displayed. Check which of the results you want to replace and check the box. Click "Replace" to perform the replacement:
[[File:Manual:replacetext-results.png|alt=Replace old page name|center|thumb|400x400px|Replace old page name]]
 
The last page now confirms that the wiki is now completing the text replacements:
[[File:Manual:replacetext-results2.png|alt=Confirmation of text replacements|center|thumb|400x400px|Confirmation of text replacements]]
 
Your wiki is now correctly linked again and the editing of the page renaming is completed. Depending on the number of replacements, it may take a while before the changes are actually visible. The changes made by this special page are collected in a queue, which is gradually processed in the background.
 
 
 
{{Box_Links-en | Topic1 =[[Manual:Redirects|Redirecting pages]] | Topic2 =[[Manual:Subpage|Working with subpages]]  }}
 
[[en:{{FULLPAGENAME}}]]
[[de:Seiten umbenennen und verschieben]]
 
 
 
[[Category:Page tools]]

Revision as of 09:15, 26 April 2022

Date 2022-04-25
Severity Medium
Affected BlueSpice 4.x
Fixed in 4.1.3

Problem

Users are able to inject arbitrary HTML (XSS) on regular pages, using a special value for the <code>title</code> parameter. This can be triggered via URL.

Solution

Upgrade to BlueSpice 4.1.3

Acknowledgements

Special thanks to the security team of an undisclosed customer




To submit feedback about this documentation, visit our community forum.

No categories assignedEdit

Discussions