security: wiki should only allow markdown files #217
Closed
opened 2026-05-26 18:39:55 +00:00 by jmiller
·
1 comment
Labels
Clear labels
breaking-change
ci-cd
config
dependencies
deploy-failure
docker
documentation
good first issue
health-check
help wanted
mokostandards
pending: testing
priority: critical
priority: high
priority: low
priority: medium
push-failure
security
size/l
size/m
size/s
size/xl
size/xs
standards-drift
standards-update
status: blocked
status: in-progress
status: needs-review
status: on-hold
status: wontfix
sync-failure
tech-debt
type: bug
type: bug
type: chore
type: enhancement
type: feature
type: refactor
type: version
upstream
upstream
work-in-progress
bug
chore
documentation
enhancement
feature
pending: dependency
pending: deployment
pending: design
pending: documentation
pending: feedback
pending: review
pending: testing
priority: critical
priority: high
priority: low
priority: medium
refactor
roadmap
scope: client
scope: dolibarr
scope: infrastructure
scope: joomla
scope: waas
security
status: blocked
status: duplicate
status: in-progress
status: needs-review
status: wontfix
Breaking API or behavior change
CI/CD pipeline changes
Configuration changes
Dependency updates
Deployment failed
Docker/container changes
Documentation changes
Good for newcomers
Repo health check result
Extra attention needed
Related to MokoStandards framework
Feature implemented but not yet tested with documented proof
Must fix immediately
Important, fix soon
Nice to have
Normal priority
Git push operation failed
Security vulnerability or hardening
200-500 lines changed
50-200 lines changed
10-50 lines changed
500+ lines changed
< 10 lines changed
Deviates from MokoStandards
MokoStandards compliance update
Blocked by dependency or decision
Actively being worked on
Awaiting code review
Paused intentionally
Will not be addressed
Sync or mirror failed
Technical debt and TODO/FIXME items
Something isn't working
Maintenance, dependencies, cleanup
Improvement to existing feature
New functionality
Code restructuring without behavior change
Version bump or release
Inherited from upstream Gitea
Draft or incomplete work
Something is not working
Maintenance and housekeeping
Documentation improvements
Improvement to existing functionality
New feature or request
Blocked by another issue or external dependency
Tested and approved, awaiting deployment to production
Needs UI/UX or architecture design before implementation
Feature works, needs documentation/wiki update
Awaiting feedback or decision from stakeholder
Implementation complete, awaiting code review
Feature implemented but not yet tested
Must fix immediately
Should fix soon
Nice to have
Fix when convenient
Code restructuring without behavior change
Planned feature or enhancement tracked on the roadmap
Client-specific work
Dolibarr modules and customizations
Server, CI, backups, monitoring
Joomla templates and extensions
MokoWaaS platform
Security vulnerability or hardening
Waiting on external dependency
Duplicate of another issue
Being worked on
Ready for review
Will not be addressed
No labels
security
Milestone
No items
No Milestone
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: MokoConsulting/MokoGitea#217
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Summary
Wiki pages should only accept .md (Markdown) files. Currently there may not be sufficient validation preventing other file types from being stored in the wiki git repository.
Risk
If non-markdown files (HTML, JS, etc.) can be committed to the wiki repo, they could be rendered unsafely or used for XSS.
Requirements
Authored-by: Claude Opus 4.6 (1M context) noreply@anthropic.com
Deployed in v1.26.1-moko.05.05.00.
Authored-by: Claude Opus 4.6 (1M context) noreply@anthropic.com