Thijs/wiki.techinc.nl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

SECURITY: Escape usernames in HTMLUserTextField validation errors

Browse source 
CVE-2025-6590

The HTMLUserTextField is accessible to logged-out users on private wikis
through Special:PasswordReset. Validation error messages returned by this
field included unescaped usernames parsed as wikitext. This allowed
logged-out attackers arbitrary access to the parser, enabling them to
reveal page contents through transclusion, e.g., "{{:Private page}}".

Escape the username parameter using wfEscapeWikiText() to prevent
wikitext interpretation in error messages.

Bug: T392746
Change-Id: Ifd8283e107e1655fa3f5694183c4f67954e5c4c5
This commit is contained in:
Dylan F 2025-04-26 02:40:29 +01:00 committed by Reedy
parent b1adf3c728
commit b2310f4736
1 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
includes/htmlform/fields/HTMLUserTextField.php
View file

@ -67,14 +67,14 @@ class HTMLUserTextField extends HTMLTextField {
// Treat hidden users as unregistered if current user can't view them (T309894)
!( $user->isHidden() && !( $this->mParent && $this->mParent->getUser()->isAllowed( 'hideuser' ) ) )
) ) {
return $this->msg( 'htmlform-user-not-exists', $user->getName() );
return $this->msg( 'htmlform-user-not-exists', wfEscapeWikiText( $user->getName() ) );
}
// check if the user account type matches the account type filter
$excludeNamed = $this->mParams['excludenamed'] ?? null;
$excludeTemp = $this->mParams['excludetemp'] ?? null;
if ( ( $excludeTemp && $user->isTemp() ) || ( $excludeNamed && $user->isNamed() ) ) {
return $this->msg( 'htmlform-user-not-valid', $user->getName() );
return $this->msg( 'htmlform-user-not-valid', wfEscapeWikiText( $user->getName() ) );
}
} else {
// not a valid username
@ -102,7 +102,7 @@ class HTMLUserTextField extends HTMLTextField {
}
}
if ( !$valid ) {
return $this->msg( 'htmlform-user-not-valid', $value );
return $this->msg( 'htmlform-user-not-valid', wfEscapeWikiText( $value ) );
}
}