Thijs/wiki.techinc.nl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
wiki.techinc.nl/includes/htmlform/fields
History
Dylan F b2310f4736 SECURITY: Escape usernames in HTMLUserTextField validation errors 
CVE-2025-6590

The HTMLUserTextField is accessible to logged-out users on private wikis
through Special:PasswordReset. Validation error messages returned by this
field included unescaped usernames parsed as wikitext. This allowed
logged-out attackers arbitrary access to the parser, enabling them to
reveal page contents through transclusion, e.g., "{{:Private page}}".

Escape the username parameter using wfEscapeWikiText() to prevent
wikitext interpretation in error messages.

Bug: T392746
Change-Id: Ifd8283e107e1655fa3f5694183c4f67954e5c4c5
2025-06-30 20:57:16 +01:00
..
HTMLApiField.php Standardise all our class alias deprecation comments for ease of grepping 2024-03-19 20:11:29 +00:00
HTMLAutoCompleteSelectField.php htmlform: Add missing documentation to class properties 2024-09-14 11:49:05 +00:00
HTMLButtonField.php htmlform: Add missing documentation to class properties 2024-09-14 11:49:05 +00:00
HTMLCheckField.php Add namespace and deprecation alias to Xml and XmlSelect 2024-05-16 15:23:14 +03:30
HTMLCheckMatrix.php Use const keyword for constant list of strings or ints 2024-09-11 23:16:24 +02:00
HTMLComboboxField.php Add namespace and deprecation alias to Xml and XmlSelect 2024-05-16 15:23:14 +03:30
HTMLDateTimeField.php htmlform: Add missing documentation to class properties 2024-09-14 11:49:05 +00:00
HTMLEditTools.php Standardise all our class alias deprecation comments for ease of grepping 2024-03-19 20:11:29 +00:00
HTMLExpiryField.php Use namespaced classes (3) 2024-06-16 20:26:43 +02:00
HTMLFileField.php htmlform: Add missing documentation to class properties 2024-09-14 11:49:05 +00:00
HTMLFloatField.php htmlform: fix min/max validations on empty input in int/float fields 2025-06-28 12:49:28 +00:00
HTMLFormFieldCloner.php htmlform: Add missing documentation to class properties 2024-09-14 11:49:05 +00:00
HTMLFormFieldWithButton.php Standardise all our class alias deprecation comments for ease of grepping 2024-03-19 20:11:29 +00:00
HTMLHiddenField.php htmlform: Add missing documentation to class properties 2024-09-14 11:49:05 +00:00
HTMLInfoField.php HTMLForm: Make raw InfoFields work in Codex 2024-03-26 00:02:21 +00:00
HTMLIntField.php Standardise all our class alias deprecation comments for ease of grepping 2024-03-19 20:11:29 +00:00
HTMLMultiSelectField.php SECURITY: escape section labels in HTMLMultiSelectField 2025-04-10 15:56:06 +01:00
HTMLNamespacesMultiselectField.php Standardise all our class alias deprecation comments for ease of grepping 2024-03-19 20:11:29 +00:00
HTMLRadioField.php HTMLRadioField: clean up HTML 2024-08-12 21:02:38 -04:00
HTMLRestrictionsField.php Use namespaced classes (3) 2024-06-16 20:26:43 +02:00
HTMLSelectAndOtherField.php Use namespaced classes (3) 2024-06-16 20:26:43 +02:00
HTMLSelectField.php Add namespace and deprecation alias to Xml and XmlSelect 2024-05-16 15:23:14 +03:30
HTMLSelectLanguageField.php Standardise all our class alias deprecation comments for ease of grepping 2024-03-19 20:11:29 +00:00
HTMLSelectLimitField.php Standardise all our class alias deprecation comments for ease of grepping 2024-03-19 20:11:29 +00:00
HTMLSelectNamespace.php HTMLSelectNamespace: Add Codex output 2024-05-05 11:35:18 +03:00
HTMLSelectNamespaceWithButton.php Standardise all our class alias deprecation comments for ease of grepping 2024-03-19 20:11:29 +00:00
HTMLSelectOrOtherField.php Add namespace and deprecation alias to Xml and XmlSelect 2024-05-16 15:23:14 +03:30
HTMLSizeFilterField.php Add namespace and deprecation alias to Xml and XmlSelect 2024-05-16 15:23:14 +03:30
HTMLSubmitField.php htmlform: Add missing documentation to class properties 2024-09-14 11:49:05 +00:00
HTMLTagFilter.php htmlform: Add missing documentation to class properties 2024-09-14 11:49:05 +00:00
HTMLTagMultiselectField.php Standardise all our class alias deprecation comments for ease of grepping 2024-03-19 20:11:29 +00:00
HTMLTextAreaField.php htmlform: Add missing documentation to class properties 2024-09-14 11:49:05 +00:00
HTMLTextField.php htmlform: Add missing documentation to class properties 2024-09-14 11:49:05 +00:00
HTMLTextFieldWithButton.php Standardise all our class alias deprecation comments for ease of grepping 2024-03-19 20:11:29 +00:00
HTMLTimezoneField.php Standardise all our class alias deprecation comments for ease of grepping 2024-03-19 20:11:29 +00:00
HTMLTitlesMultiselectField.php Standardise all our class alias deprecation comments for ease of grepping 2024-03-19 20:11:29 +00:00
HTMLTitleTextField.php Make use of the ??= and ?? operators where it makes sense 2024-08-26 09:26:36 +02:00
HTMLToggleSwitchField.php Standardise all our class alias deprecation comments for ease of grepping 2024-03-19 20:11:29 +00:00
HTMLUsersMultiselectField.php Update user widgets to support named and temp account exclusion 2024-09-16 08:45:58 -07:00
HTMLUserTextField.php SECURITY: Escape usernames in HTMLUserTextField validation errors 2025-06-30 20:57:16 +01:00