T85858_CheckUser-REL1_19.patch
csteipp (Chris Steipp)
Actions

Authored By

	• csteipp
	Mar 24 2015, 9:16 PM

Size

2 KB

Referenced Files

None

Subscribers

None

T85858_CheckUser-REL1_19.patch
View Options

	From 4f53f4b1b4c53cbbd215fb03cab9f2e84be456e4 Mon Sep 17 00:00:00 2001
	From: csteipp <csteipp@wikimedia.org>
	Date: Tue, 24 Mar 2015 14:13:28 -0700
	Subject: [PATCH] SECURITY: Add an edit token to Special:CheckUser

	Bug: T85858
	Change-Id: I8b86ae48058ab85975b48a40008e91027387f5f8
	---
	CheckUser.i18n.php \| 2 ++
	CheckUser_body.php \| 6 +++++-
	2 files changed, 7 insertions(+), 1 deletion(-)

	diff --git a/CheckUser.i18n.php b/CheckUser.i18n.php
	index 3280e75..13743da 100644
	--- a/CheckUser.i18n.php
	+++ b/CheckUser.i18n.php
	@@ -101,6 +101,7 @@ Here are the IPs used (5000 max, sorted by address):',
	[http://www.ip2location.com/$1 Geolocate] ·
	[http://toolserver.org/~overlordq/scripts/checktor.fcgi?ip=$1 Tor check] ·
	[http://ws.arin.net/whois/?queryinput=$1 WHOIS]]</span>', # do not translate or duplicate this message to other languages
	+ 'checkuser-token-fail' => 'Session failure. Please try again.',
	);

	/** Message documentation (Message documentation)
	@@ -225,6 +226,7 @@ See screenshot "[http://www.mediawiki.org/wiki/Extension:CheckUser#Basic_interfa

	See screenshot \"[http://www.mediawiki.org/wiki/Extension:CheckUser#Basic_interface Example log]\".",
	'checkuser-autocreate-action' => 'Text of the event displayed in the CheckUser results, corresponding to the automatic creation of a new user account (by CentralAuth).',
	+ 'checkuser-token-fail' => 'Error message shown when the CSRF token does not match the current session.',
	);

	/** Karelian (Karjala)
	diff --git a/CheckUser_body.php b/CheckUser_body.php
	index 9674bed..e67bc5b 100644
	--- a/CheckUser_body.php
	+++ b/CheckUser_body.php
	@@ -57,7 +57,9 @@ class CheckUser extends SpecialPage {

	# Perform one of the various submit operations...
	if ( $wgRequest->wasPosted() ) {
	- if ( $wgRequest->getVal( 'action' ) === 'block' ) {
	+ if ( !$this->getUser()->matchEditToken( $wgRequest->getVal( 'wpEditToken' ) ) ) {
	+ $wgOut->wrapWikiMsg( '<div class="error">$1</div>', 'checkuser-token-fail' );
	+ } elseif ( $wgRequest->getVal( 'action' ) === 'block' ) {
	$this->doMassUserBlock( $users, $blockreason, $tag, $talkTag );
	} elseif ( !$this->checkReason( $reason ) ) {
	$wgOut->addWikiMsg( 'checkuser-noreason' );
	@@ -166,6 +168,7 @@ class CheckUser extends SpecialPage {
	$form .= '</tr>';
	$form .= Xml::closeElement( 'table' );
	$form .= '</fieldset>';
	+ $form .= Html::hidden( 'wpEditToken', $wgUser->getEditToken() );
	$form .= Xml::closeElement( 'form' );
	# Output form
	$wgOut->addHTML( $form );
	@@ -1048,6 +1051,7 @@ class CheckUser extends SpecialPage {
	array( 'id' => 'checkuserblocksubmit', 'name' => 'checkuserblock' ) ) . "</p>\n";
	$s .= "</fieldset>\n";
	}
	+ $s .= Html::hidden( 'wpEditToken', $wgUser->getEditToken() );
	$s .= '</form>';
	}

	--
	1.8.4.5

File Metadata

Mime Type: text/x-diff
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 100665
Default Alt Text: T85858_CheckUser-REL1_19.patch (2 KB)

T85858_CheckUser-REL1_19.patchcsteipp (Chris Steipp)Actions

T85858_CheckUser-REL1_19.patchView Options

File Metadata

Event Timeline

T85858_CheckUser-REL1_19.patch
csteipp (Chris Steipp)
Actions

T85858_CheckUser-REL1_19.patch
View Options