Thijs/wiki.techinc.nl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

specials: Fix PHP Warning on Special:PasswordReset for crafted input

Browse source 
Why:

- Special:PasswordReset uses raw POST values to add username and email
  info to success messages post-submit.
- These values may be parsed by PHP as arrays if a client supplied
  crafted input with multi-value fields.
- Instead of doing our own param validation in onSuccess(), we can reuse
  parsed values in onSubmit() and do the rendering there.

What:

- Move success message processing to onSubmit().

Bug: T392086
Change-Id: I9b0e115c417d0f3080e711441c79608d782932ce
(cherry picked from commit 37d63156c841f9a19080c9438cdf66cf58a7da7a)
This commit is contained in:
Máté Szabó 2025-04-16 21:02:40 +02:00 committed by Reedy
parent 96f6631007
commit 145d205b4c
1 changed files with 26 additions and 29 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

55
includes/specials/SpecialPasswordReset.php
View file

@ -149,38 +149,35 @@ class SpecialPasswordReset extends FormSpecialPage {
throw new ThrottledError;
}
// Show a message on the successful processing of the form.
// This doesn't necessarily mean a reset email was sent.
if ( $result->isGood() ) {
$output = $this->getOutput();
// Information messages.
$output->addWikiMsg( 'passwordreset-success' );
$output->addWikiMsg( 'passwordreset-success-details-generic',
$this->getConfig()->get( MainConfigNames::PasswordReminderResendTime ) );
// Confirmation of what the user has just submitted.
$info = "\n";
if ( $username ) {
$info .= "* " . $this->msg( 'passwordreset-username' ) . ' '
. wfEscapeWikiText( $username ) . "\n";
}
if ( $email ) {
$info .= "* " . $this->msg( 'passwordreset-email' ) . ' '
. wfEscapeWikiText( $email ) . "\n";
}
$output->addWikiMsg( 'passwordreset-success-info', $info );
// Add a return to link to the main page.
$output->returnToMain();
}
return $result;
}
/**
* Show a message on the successful processing of the form.
* This doesn't necessarily mean a reset email was sent.
*/
public function onSuccess() {
$output = $this->getOutput();
// Information messages.
$output->addWikiMsg( 'passwordreset-success' );
$output->addWikiMsg( 'passwordreset-success-details-generic',
$this->getConfig()->get( MainConfigNames::PasswordReminderResendTime ) );
// Confirmation of what the user has just submitted.
$info = "\n";
$postVals = $this->getRequest()->getPostValues();
if ( isset( $postVals['wpUsername'] ) && $postVals['wpUsername'] !== '' ) {
$info .= "* " . $this->msg( 'passwordreset-username' ) . ' '
. wfEscapeWikiText( $postVals['wpUsername'] ) . "\n";
}
if ( isset( $postVals['wpEmail'] ) && $postVals['wpEmail'] !== '' ) {
$info .= "* " . $this->msg( 'passwordreset-email' ) . ' '
. wfEscapeWikiText( $postVals['wpEmail'] ) . "\n";
}
$output->addWikiMsg( 'passwordreset-success-info', $info );
// Add a return to link to the main page.
$output->returnToMain();
}
/**
* Hide the password reset page if resets are disabled.
* @return bool