What about diffs ? I hope they are protected too ?

I think so; at least I could not hack around that.

What about medias ? Sounds a little more difficult to do.

Images are not used in my wiki, as my provider runs PHP in safe mode and the whole upload does not work. I have not looked at that aspect. I would have to check whether the db table has any restriction column at all.

Brion has a very good point in Templates - this is an open hole that has to be closed.

Thanks for the feedback!

MaPhi