Dreamy Jazz 48b26792a9 SECURITY: abusefiltercheckmatch: Check if user can see log details ... CVE-2024-PENDING Why: * The 'abusefiltercheckmatch' API allows callers to match arbitary filter conditions against existing AbuseFilter logs * The API does not check if the performer has the ability to see the log details for the given filter, so can allow a user to bypass hidden and protected visibility settings. What: * Call AbuseFilterPermissionManager::canSeeLogDetailsForFilter before attempting to match a filter against a given AbuseFilter log. * Add a test to verify that this security fix works. Bug: T372998 Change-Id: I4a2467dc4e0d1f8401d5428a89c7f6d6ebcdfa70		2024-10-01 00:18:55 +01:00
..
integration	SECURITY: abusefiltercheckmatch: Check if user can see log details	2024-10-01 00:18:55 +01:00
unit	Log changes to protected variables access	2024-09-13 01:39:09 -07:00
AbuseFilterConsequencesTest.php	tests: Use multi-row insert in AbuseFilterConsequencesTest	2024-09-10 22:04:50 +02:00
AbuseFilterCreateAccountTestTrait.php	Use namespaced classes	2023-12-10 23:03:12 +01:00
AbuseFilterFilterUserTest.php	Use namespaced classes	2024-06-12 20:01:35 +02:00
AbuseFilterRowsAndFiltersTestTrait.php	Convert af_hidden into a bitmask	2024-05-28 00:59:08 -07:00
AbuseFilterUploadTestTrait.php	Update comment still mentioning setMwGlobals	2024-08-11 17:26:10 +02:00
ConsequenceGetMessageTestTrait.php	Use ActionSpecifier to load the IP address	2022-12-17 22:52:24 +01:00
DegroupTest.php	tests: Widen @covers tags in phpunit tests	2024-04-17 01:44:40 +01:00
LazyVariableComputerDBTest.php	tests: Widen @covers tags in phpunit tests	2024-04-17 01:44:40 +01:00
RCVariableGeneratorTest.php	RCVariableGeneratorTest: Handle anonymous user test with temp accounts enabled	2024-05-23 09:41:05 +02:00
SchemaChangesHandlerTest.php	Use namespaced classes	2024-06-12 20:01:35 +02:00