wikimedia/mediawiki-extensions-AbuseFilter
1
0
Fork 0
mirror of https://gerrit.wikimedia.org/r/mediawiki/extensions/AbuseFilter.git synced 2024-11-24 06:03:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
mediawiki-extensions-AbuseF.../includes
History
Dreamy Jazz 233a4f1b31 SECURITY: abusefiltercheckmatch: Check if user can see log details 
CVE-2024-PENDING

Why:
* The 'abusefiltercheckmatch' API allows callers to match
  arbitary filter conditions against existing AbuseFilter logs
* The API does not check if the performer has the ability to
  see the log details for the given filter, so can allow a user
  to bypass hidden and protected visibility settings.

What:
* Call AbuseFilterPermissionManager::canSeeLogDetailsForFilter
  before attempting to match a filter against a given AbuseFilter
  log.
* Add a test to verify that this security fix works.

Bug: T372998
Change-Id: I4a2467dc4e0d1f8401d5428a89c7f6d6ebcdfa70
2024-10-01 00:18:18 +01:00
..
Api SECURITY: abusefiltercheckmatch: Check if user can see log details 2024-10-01 00:18:18 +01:00
ChangeTags Replace deprecated ChangeTags method calls with ChangeTagStore 2024-03-29 11:08:41 +01:00
Consequences build: Updating mediawiki/mediawiki-codesniffer to 43.0.0 2024-03-16 18:53:05 +00:00
EditBox Fix casing of dropdown-related methods 2024-03-09 15:44:59 +01:00
Filter Replace BadMethodCallException with LogicException 2023-11-16 19:10:50 +00:00
Hooks Handlers: Drop AutoPromoteGroupsHandler::factory() 2024-03-06 21:38:12 +00:00
LogFormatter logging: Inject services into AbuseLogHitFormatter 2024-03-29 21:53:34 +01:00
Pager Merge "build: Updating mediawiki/mediawiki-codesniffer to 43.0.0" 2024-03-16 19:21:29 +00:00
Parser build: Updating mediawiki/mediawiki-codesniffer to 43.0.0 2024-03-16 18:53:05 +00:00
Special build: Updating mediawiki/mediawiki-codesniffer to 43.0.0 2024-03-16 18:53:05 +00:00
VariableGenerator build: Updating mediawiki/mediawiki-codesniffer to 43.0.0 2024-03-16 18:53:05 +00:00
Variables Add user_type variable 2024-03-07 10:38:25 +00:00
View build: Updating mediawiki/mediawiki-codesniffer to 43.0.0 2024-03-16 18:53:05 +00:00
Watcher Use namespaced classes 2023-12-10 23:03:12 +01:00
AbuseFilter.php Use actor table in AbuseFilter 2023-03-22 14:01:29 +01:00
AbuseFilterActorMigration.php Use namespaced MediaWiki\User\ActorMigrationBase 2023-08-20 01:08:09 +02:00
AbuseFilterChangesList.php Use namespaced classes 2023-12-10 23:03:12 +01:00
AbuseFilterPermissionManager.php AbuseFilterPermissionManager: Add sitewide block check 2022-10-21 17:34:01 +00:00
AbuseFilterPreAuthenticationProvider.php Use namespaced classes 2023-12-10 23:03:12 +01:00
AbuseFilterServices.php BlockedDomains: Move filtering logic to a dedicated class 2023-08-06 16:27:23 +02:00
AbuseLogger.php build: Updating mediawiki/mediawiki-codesniffer to 43.0.0 2024-03-16 18:53:05 +00:00
AbuseLoggerFactory.php Use namespaced classes 2023-12-10 23:03:12 +01:00
ActionSpecifier.php Use ActionSpecifier to load the IP address 2022-12-17 22:52:24 +01:00
BlockAutopromoteStore.php Use namespaced classes 2023-12-10 23:03:12 +01:00
BlockedDomainFilter.php Use namespaced classes 2023-12-10 23:03:12 +01:00
BlockedDomainStorage.php Remove indirect calls to IDBAccessObject::READ_* constants 2024-01-26 09:25:35 -05:00
CentralDBManager.php Fix various typos and documentation issues 2023-09-04 12:55:17 +02:00
CentralDBNotAvailableException.php
EchoNotifier.php Use namespaced Title 2023-08-19 19:49:36 +02:00
EditRevUpdater.php Replace deprecated database object access methods 2023-03-08 16:50:56 +01:00
EditStashCache.php Refactor ParserStatus 2021-09-17 11:25:54 +00:00
EmergencyCache.php build: Updating dependencies 2021-07-21 18:51:18 +00:00
FilterCompare.php build: Updating dependencies 2021-07-21 18:51:18 +00:00
FilterImporter.php maintenance,includes: Clean up file headers 2022-09-29 17:56:49 +01:00
FilterLookup.php FilterLookup: Stop using DBAccessObjectUtils::getDBOptions() 2024-03-21 20:22:02 +01:00
FilterProfiler.php build: Updating mediawiki/mediawiki-codesniffer to 43.0.0 2024-03-16 18:53:05 +00:00
FilterRunner.php Use namespaced classes 2023-12-10 23:03:12 +01:00
FilterRunnerFactory.php Use namespaced classes 2023-12-10 23:03:12 +01:00
FilterStore.php Use namespaced classes 2023-12-10 23:03:12 +01:00
FilterUser.php Don't attempt to steal or create the FilterUser in CheckUserHandler 2024-01-31 19:32:52 +00:00
FilterValidator.php build: Updating mediawiki/mediawiki-codesniffer to 43.0.0 2024-03-16 18:53:05 +00:00
GlobalNameUtils.php build: Updating dependencies 2021-07-21 18:51:18 +00:00
InvalidImportDataException.php
KeywordsManager.php Reorder messages that describe operators 2024-03-26 11:22:46 -04:00
RunnerData.php Refactor ParserStatus 2021-09-17 11:25:54 +00:00
ServiceWiring.php tests: Remove redundant wgMainCacheType=hash 2024-03-29 15:37:58 -07:00
SpecsFormatter.php build: Updating mediawiki/mediawiki-codesniffer to 43.0.0 2024-03-16 18:53:05 +00:00
TableDiffFormatterFullContext.php Use the new Wikimedia\Diff namespace 2023-06-29 11:56:13 +10:00
TextExtractor.php Remove bits of unused code across the codebase 2023-06-14 19:41:00 +00:00
ThrottleFilterPresentationModel.php build: Updating mediawiki/mediawiki-codesniffer to 43.0.0 2024-03-16 18:53:05 +00:00