Page MenuHomePhabricator
Files F13975537

T188145.patch
No One
Actions

Authored By
Bawolff
Feb 23 2018, 9:56 PM
Size
2 KB
Referenced Files
None
Subscribers
None

T188145.patch
View Options

From ab8e5f76b2d80dc4fda6729ed5a0a88e7634158c Mon Sep 17 00:00:00 2001
From: Brian Wolff <bawolff+wn@gmail.com>
Date: Fri, 23 Feb 2018 21:52:25 +0000
Subject: [PATCH] SECURITY: Fix revdel checks in LogPager
Mostly a follow-up to ce881e02e8d6 where the check for performer
restrictions and action restrictions was reversed. Additionally
this adds filtering for DELETED_ACTION when filtering by
log_type or log_action.
Bug: T188145
Change-Id: I85a44f925212929ac87fb7a7e494023258f2d148
---
includes/logging/LogPager.php | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/includes/logging/LogPager.php b/includes/logging/LogPager.php
index 5404f35..cf03a67 100644
--- a/includes/logging/LogPager.php
+++ b/includes/logging/LogPager.php
@@ -156,6 +156,7 @@ class LogPager extends ReverseChronologicalPager {
if ( count( $types ) == 1 ) {
$this->typeCGI = $types[0];
}
+ $this->enforceActionRestrictions();
}
}
@@ -275,6 +276,9 @@ class LogPager extends ReverseChronologicalPager {
// add condition to query
$this->mConds['log_action'] = $actions[$type][$action];
$this->action = $action;
+ // This should already happen from log_type filtering
+ // but just in case.
+ $this->enforceActionRestrictions();
}
}
}
@@ -423,9 +427,9 @@ class LogPager extends ReverseChronologicalPager {
$this->actionRestrictionsEnforced = true;
$user = $this->getUser();
if ( !$user->isAllowed( 'deletedhistory' ) ) {
- $this->mConds[] = $this->mDb->bitAnd( 'log_deleted', LogPage::DELETED_USER ) . ' = 0';
+ $this->mConds[] = $this->mDb->bitAnd( 'log_deleted', LogPage::DELETED_ACTION ) . ' = 0';
} elseif ( !$user->isAllowedAny( 'suppressrevision', 'viewsuppressed' ) ) {
- $this->mConds[] = $this->mDb->bitAnd( 'log_deleted', LogPage::SUPPRESSED_USER ) .
+ $this->mConds[] = $this->mDb->bitAnd( 'log_deleted', LogPage::SUPPRESSED_ACTION ) .
' != ' . LogPage::SUPPRESSED_USER;
}
}
@@ -441,9 +445,9 @@ class LogPager extends ReverseChronologicalPager {
$this->performerRestrictionsEnforced = true;
$user = $this->getUser();
if ( !$user->isAllowed( 'deletedhistory' ) ) {
- $this->mConds[] = $this->mDb->bitAnd( 'log_deleted', LogPage::DELETED_ACTION ) . ' = 0';
+ $this->mConds[] = $this->mDb->bitAnd( 'log_deleted', LogPage::DELETED_USER ) . ' = 0';
} elseif ( !$user->isAllowedAny( 'suppressrevision', 'viewsuppressed' ) ) {
- $this->mConds[] = $this->mDb->bitAnd( 'log_deleted', LogPage::SUPPRESSED_ACTION ) .
+ $this->mConds[] = $this->mDb->bitAnd( 'log_deleted', LogPage::SUPPRESSED_USER ) .
' != ' . LogPage::SUPPRESSED_ACTION;
}
}
--
2.8.1

File Metadata

Mime Type
text/x-diff
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
5562299
Default Alt Text
T188145.patch (2 KB)

Event Timeline

Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits