| Rxy | |
| Apr 28 2019, 2:56 PM |
| F28838873: T222036.patch | |
| Apr 28 2019, 8:30 PM |
| F28839068: T222038-formatter.patch | |
| Apr 28 2019, 8:27 PM |
| F28839051: T222038.patch | |
| Apr 28 2019, 8:27 PM |
Expose suppress log (Special:Log/suppress) by set logid by manually
Pre-requirements:
Step to reproduce:
Expected:
MUST prohibit access to the log
Original reporter : User:Ohgi
Related with T222036 - Case 2
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Stalled | None | T302086 Set scap minimum python version to 3.7 | |||
| Resolved | None | T247045 Migrate all of production metal and VMs to Buster or later | |||
| Resolved | akosiaris | T249724 Track and remove jessie based container images from production | |||
| Resolved | Jdforrester-WMF | T224908 Drop jessie testing support | |||
| Resolved | Jdforrester-WMF | T224907 Drop php55 testing support | |||
| Resolved | Reedy | T205039 Release MediaWiki 1.27.6/1.30.2/1.31.2/1.32.2 | |||
| Resolved | Reedy | T205041 Tracking bug for 1.27.6/1.30.2/1.31.2/1.32.2 security release | |||
| Resolved | sbassett | T222038 Exposed suppressed log in RevisionDelete page |
I guess based trouble is same with T222036 Case2.
the task is wrote before I read or investigate codes. And I assumed to Case2 is specific to EditTags, but that assume is wrong and actually problem is LogEventsList::userCan() related.
+1 on this patch
I do note some of the error messages are not great, but that was a pre-existing problem.
This patch is security fix patch also covers T222036 Case 2 (must applied F28838873 T222036.patch too)
This patch is similar with F28839051 (T222038.patch), but additionally contains fixing to LogFormatter too (may overkill too).
I think that's a reasonable hardening measure, but we should do that after the initial issue is fixed, and probably publicly.
T222038.patch was deployed to 1.34.0-wmf.1 and 1.34.0-wmf.3.
Chatting w/ @Bawolff and @Reedy, T222038-formatter.patch should just be pushed up publicly to gerrit.
Note: T222038-formatter.patch is now up on gerrit: https://gerrit.wikimedia.org/r/507870
Well, duh, r/507870 is failing CI builds because LogFormatter::canViewLogType() doesn't exist on master. Set WIP for now. Given that the sec patches are already deployed, I think this can probably just wait in gerrit until it can be merged.
It seems the gerrit patch is not same with F28839068 ...
Also I can't modify the gerrit patch due to recent permission changes
@Rxy - Apologies, the patch set should be fixed in gerrit now. I had manually modified F28839068 so as not to include the duplicate changes in F28839051 for includes/logging/LogEventsList.php, since that was already deployed as a security patch on Tuesday. Unfortunately, in doing so, I conflated userCanViewLogType and canViewLogType which, again, should now be resolved in the patch set.
Change 514768 had a related patch set uploaded (by Reedy; owner: Rxy):
[mediawiki/core@REL1_27] SECURITY: Add permission check for user is permitted to view the log type
Change 514768 merged by Reedy:
[mediawiki/core@REL1_27] SECURITY: Add permission check for user is permitted to view the log type
Change 514779 had a related patch set uploaded (by Reedy; owner: Rxy):
[mediawiki/core@REL1_30] SECURITY: Add permission check for user is permitted to view the log type
Change 514779 merged by Reedy:
[mediawiki/core@REL1_30] SECURITY: Add permission check for user is permitted to view the log type
Change 514855 had a related patch set uploaded (by Reedy; owner: Rxy):
[mediawiki/core@REL1_31] SECURITY: Add permission check for user is permitted to view the log type
Change 514759 merged by jenkins-bot:
[mediawiki/core@master] SECURITY: Add permission check for user is permitted to view the log type
Change 514955 had a related patch set uploaded (by Reedy; owner: Rxy):
[mediawiki/core@REL1_32] SECURITY: Add permission check for user is permitted to view the log type
Change 514979 had a related patch set uploaded (by Reedy; owner: Rxy):
[mediawiki/core@REL1_33] SECURITY: Add permission check for user is permitted to view the log type
Change 514955 merged by jenkins-bot:
[mediawiki/core@REL1_32] SECURITY: Add permission check for user is permitted to view the log type
Change 514979 merged by jenkins-bot:
[mediawiki/core@REL1_33] SECURITY: Add permission check for user is permitted to view the log type
Change 514855 merged by jenkins-bot:
[mediawiki/core@REL1_31] SECURITY: Add permission check for user is permitted to view the log type
Change 507870 merged by jenkins-bot:
[mediawiki/core@master] Add permission check for user is permitted to view the log type