Page MenuHomePhabricator
Files F10774739

T134100-v4-REL1_29.patch
No One
Actions

Authored By
Bawolff
Nov 13 2017, 11:35 PM
Size
2 KB
Referenced Files
None
Subscribers
None

T134100-v4-REL1_29.patch
View Options

From 80926921b16d0d6e94a276adbb7c1f7636b09013 Mon Sep 17 00:00:00 2001
From: Brian Wolff <bawolff+wn@gmail.com>
Date: Mon, 13 Nov 2017 16:02:50 +0000
Subject: [PATCH] SECURITY: Do not reveal if user exists during login failure
This is meant for private wikis where the list of users may
be secret. It is only meant to prevent trivial enumeration
of usernames. It is not designed to prevent enumeration
via timing attacks.
Bug: T134100
Change-Id: I7afaa955a4b393ef00b11e420709bd62b84fbc71
---
includes/auth/LocalPasswordPrimaryAuthenticationProvider.php | 5 ++++-
languages/i18n/en.json | 2 +-
2 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/includes/auth/LocalPasswordPrimaryAuthenticationProvider.php b/includes/auth/LocalPasswordPrimaryAuthenticationProvider.php
index fd36887..0e22d96 100644
--- a/includes/auth/LocalPasswordPrimaryAuthenticationProvider.php
+++ b/includes/auth/LocalPasswordPrimaryAuthenticationProvider.php
@@ -96,7 +96,10 @@ class LocalPasswordPrimaryAuthenticationProvider
__METHOD__
);
if ( !$row ) {
- return AuthenticationResponse::newAbstain();
+ // Do not reveal whether its bad username or
+ // bad password to prevent username enumeration
+ // on private wikis. (T134100)
+ return $this->failResponse( $req );
}
$oldRow = clone $row;
diff --git a/languages/i18n/en.json b/languages/i18n/en.json
index 8129205..336b6a4 100644
--- a/languages/i18n/en.json
+++ b/languages/i18n/en.json
@@ -483,7 +483,7 @@
"nosuchusershort": "There is no user by the name \"$1\".\nCheck your spelling.",
"nouserspecified": "You have to specify a username.",
"login-userblocked": "This user is blocked. Login not allowed.",
- "wrongpassword": "Incorrect password entered.\nPlease try again.",
+ "wrongpassword": "Incorrect username or password entered.\nPlease try again.",
"wrongpasswordempty": "Password entered was blank.\nPlease try again.",
"passwordtooshort": "Passwords must be at least {{PLURAL:$1|1 character|$1 characters}}.",
"passwordtoolong": "Passwords cannot be longer than {{PLURAL:$1|1 character|$1 characters}}.",
--
1.9.5 (Apple Git-50.3)

File Metadata

Mime Type
text/x-diff
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
5088784
Default Alt Text
T134100-v4-REL1_29.patch (2 KB)

Event Timeline

Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL