Current configuration on the wiki
9d39b05391
* Update extensions/AbuseFilter from branch 'REL1_43'
to bc7e84a07c991ebd9251fb7d0cfb5829af50cbaf
- SECURITY: Check protected variable access in CheckMatch API
Why:
* The AbuseFilter 'abusefiltercheckmatch' API allows users to
check if abuse_filter_log rows or recentchange rows match against
a provided pattern.
* This currently does not check if the pattern attempts to match
against protected variables that may be present in the variables
generated for either the RecentChange or abuse_filter_log row.
** This allows users to trial-and-error work out the value of
protected variables when they do not have access to the
variables.
* This should not be possible and proper access restrictions for
protected variables should be applied.
** This includes logging when a caller is matching against
protected variable values to avoid trial-and-error matching
allowing an authorised user to see the value without creating
a log entry.
What:
* Update CheckMatch::execute to:
** Reject attempts to match using a pattern that contains
protected variables that the user cannot see the value of.
** Reject attempts to match against abuse_filter_log rows that have
protected variable values that the user cannot see to be
consistent with Special:AbuseLog access restrictions.
** Log when the provided pattern uses protected variables that
have a value in the variable dump.
* Add tests to verify this fix works.
Bug: T397196
Change-Id: I5f02572b94760141f6f57873409469318f441e18
|
||
|---|---|---|
| .phan | ||
| cache | ||
| docs | ||
| extensions | ||
| images | ||
| includes | ||
| languages | ||
| maintenance | ||
| mw-config | ||
| resources | ||
| skins | ||
| tests | ||
| vendor@ff925b8b4d | ||
| .dockerignore | ||
| .editorconfig | ||
| .eslintignore | ||
| .eslintrc.json | ||
| .fresnel.yml | ||
| .git-blame-ignore-revs | ||
| .gitattributes | ||
| .gitignore | ||
| .gitmessage | ||
| .gitmodules | ||
| .gitreview | ||
| .mailmap | ||
| .phpcs.xml | ||
| .stylelintrc.json | ||
| .svgo.config.js | ||
| .vsls.json | ||
| api.php | ||
| autoload.php | ||
| CODE_OF_CONDUCT.md | ||
| composer.json | ||
| composer.local.json-sample | ||
| COPYING | ||
| CREDITS | ||
| DEVELOPERS.md | ||
| docker-compose.yml | ||
| FAQ | ||
| Gruntfile.js | ||
| HISTORY | ||
| img_auth.php | ||
| index.php | ||
| INSTALL | ||
| jsdoc.json | ||
| load.php | ||
| opensearch_desc.php | ||
| package-lock.json | ||
| package.json | ||
| phpunit.xml.dist | ||
| README.md | ||
| RELEASE-NOTES-1.43 | ||
| rest.php | ||
| SECURITY | ||
| thumb.php | ||
| thumb_handler.php | ||
| UPGRADE | ||
MediaWiki
MediaWiki is a free and open-source wiki software package written in PHP. It serves as the platform for Wikipedia and the other Wikimedia projects, used by hundreds of millions of people each month. MediaWiki is localised in over 350 languages and its reliability and robust feature set have earned it a large and vibrant community of third-party users and developers.
MediaWiki is:
- feature-rich and extensible, both on-wiki and with hundreds of extensions;
- scalable and suitable for both small and large sites;
- simple to install, working on most hardware/software combinations; and
- available in your language.
For system requirements, installation, and upgrade details, see the files RELEASE-NOTES, INSTALL, and UPGRADE.
- Ready to get started?
- Setting up your local development environment?
- Looking for the technical manual?
- Seeking help from a person?
- Looking to file a bug report or a feature request?
- Interested in helping out?
MediaWiki is the result of global collaboration and cooperation. The CREDITS file lists technical contributors to the project. The COPYING file explains MediaWiki's copyright and license (GNU General Public License, version 2 or later). Many thanks to the Wikimedia community for testing and suggestions.