What about diffs ? I hope they are protected too ?
I think so; at least I could not hack around that.
What about medias ? Sounds a little more difficult to do.
Images are not used in my wiki, as my provider runs PHP in safe mode and the whole upload does not work. I have not looked at that aspect. I would have to check whether the db table has any restriction column at all.
Brion has a very good point in Templates - this is an open hole that has to be closed.
Thanks for the feedback!
MaPhi