wikimedia/mediawiki-extensions-AbuseFilter
1
0
Fork 0
mirror of https://gerrit.wikimedia.org/r/mediawiki/extensions/AbuseFilter.git synced 2024-11-23 21:53:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

SECURITY: Make sure provided filter id match provided history ID in history view

Browse source 
AbuseFilterViewEdit does privilege checks based on filter ID,
and displays what is hidden under given history ID, but doesn't
make sure those two IDs actually belong to one filter.

That means user can easily change filter ID to a public
filter and view old versions of nowadays private filters.

Bug: T237887
Change-Id: Ic12790bd33982473f77551bde9599ed083a3e1f1
This commit is contained in:
Martin Urbanec 2019-11-10 23:11:34 +01:00 committed by sbassett
parent af000125ac
commit 5fd861365f
1 changed files with 5 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
includes/Views/AbuseFilterViewEdit.php
View file

@ -157,7 +157,11 @@ class AbuseFilterViewEdit extends AbuseFilterView {
// Load from request OR database.
list( $row, $actions ) = $this->loadRequest( $filter, $history_id );
if ( !$row ) {
if (
!$row ||
// @fixme Temporary stopgap for T237887
( $history_id && $row->af_id !== $filter )
) {
$out->addHTML(
Xml::tags(
'p',