wikimedia/mediawiki-extensions-AbuseFilter
1
0
Fork 0
mirror of https://gerrit.wikimedia.org/r/mediawiki/extensions/AbuseFilter.git synced 2024-11-23 21:53:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add missing limits to explode() calls

Browse source 
This is fixing potential bugs where invalid strings with more than one
comma have silently been accepted.

Change-Id: Ib1e7d0c99973f243ef6faad6389bab688187c1cf
This commit is contained in:
Thiemo Kreuz 2019-05-15 16:14:12 +02:00
parent 9cb58a4737
commit c6f20a64dd
4 changed files with 5 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
includes/AbuseFilter.php
View file

@ -2356,9 +2356,7 @@ class AbuseFilter {
* @return null|string Null on success, a string with the error message on failure
*/
public static function checkThrottleParameters( $params ) {
$throttleRate = explode( ',', $params[1] );
$throttleCount = $throttleRate[0];
$throttlePeriod = $throttleRate[1];
list( $throttleCount, $throttlePeriod ) = explode( ',', $params[1], 2 );
$throttleGroups = array_slice( $params, 2 );
$validGroups = [
'ip',

7
includes/Views/AbuseFilterViewEdit.php
View file

@ -527,12 +527,9 @@ class AbuseFilterViewEdit extends AbuseFilterView {
$throttleFields = [];
if ( $set ) {
array_shift( $parameters );
$throttleRate = explode( ',', $parameters[0] );
$throttleCount = $throttleRate[0];
$throttlePeriod = $throttleRate[1];
list( $throttleCount, $throttlePeriod ) = explode( ',', $parameters[1], 2 );
$throttleGroups = array_slice( $parameters, 1 );
$throttleGroups = array_slice( $parameters, 2 );
} else {
$throttleCount = 3;
$throttlePeriod = 60;

3
maintenance/addMissingLoggingEntries.php
View file

@ -61,8 +61,7 @@ class AddMissingLoggingEntries extends Maintenance {
foreach ( $logResult as $row ) {
// id . '\n' . filter
$params = explode( "\n", $row->log_params );
// id
$params = explode( "\n", $row->log_params, 2 );
$afhId = $params[0];
// Forget this row had any issues - it just has a different timestamp in the log
unset( $afhRows[$afhId] );

1
tests/phpunit/AbuseFilterSaveTest.php
View file

@ -664,6 +664,7 @@ class AbuseFilterSaveTest extends MediaWikiTestCase {
[ [ '1', '-3,23', 'user', 'ip' ], 'abusefilter-edit-invalid-throttlecount' ],
[ [ '1', '5,2.3', 'user', 'ip' ], 'abusefilter-edit-invalid-throttleperiod' ],
[ [ '1', '4,-14', 'user', 'ip' ], 'abusefilter-edit-invalid-throttleperiod' ],
[ [ '1', '3,33,44', 'user', 'ip' ], 'abusefilter-edit-invalid-throttleperiod' ],
[ [ '1', '3,33' ], 'abusefilter-edit-empty-throttlegroups' ],
[ [ '1', '3,33', 'user', 'ip,foo,user' ], 'abusefilter-edit-invalid-throttlegroups' ],
[ [ '1', '3,33', 'foo', 'ip,user' ], 'abusefilter-edit-invalid-throttlegroups' ],