01-T169545-REL1_27.patch
Reedy (Sam Reed)
Actions

Authored By

	Reedy
	Jul 7 2018, 5:54 PM

Size

1 KB

Referenced Files

None

Subscribers

None

01-T169545-REL1_27.patch
View Options

	From 01403f1fca5679739dc171a74790fdc58d679e49 Mon Sep 17 00:00:00 2001
	From: Chad Horohoe <chadh@wikimedia.org>
	Date: Tue, 13 Mar 2018 18:43:30 +0000
	Subject: [PATCH] SECURITY: Make 'newbie' limit in $wgRateLimits really
	override 'user' limit

	The order of operations was incorrect.

	Bug: T169545
	Change-Id: Ia910aa2a494914d3b0017daac9ab294ea9fa8705
	---
	RELEASE-NOTES-1.27 \| 1 +
	includes/user/User.php \| 9 +++++----
	2 files changed, 6 insertions(+), 4 deletions(-)

	diff --git a/RELEASE-NOTES-1.27 b/RELEASE-NOTES-1.27
	index 790b595efe..ecdee2181d 100644
	--- a/RELEASE-NOTES-1.27
	+++ b/RELEASE-NOTES-1.27
	@@ -20,6 +20,7 @@ This is a security and maintenance release of the MediaWiki 1.27 branch.
	* (T143790) Make $wgEmailConfirmToEdit only affect edit actions.
	* Special:BotPasswords now requires reauthentication.
	* (T191608, T187638) Add 'logid' parameter to Special:Log.
	+* (T169545) $wgRateLimits entry for 'user' overrides that for 'newbie'.

	== MediaWiki 1.27.4 ==
	This is a security and maintenance release of the MediaWiki 1.27 branch.
	diff --git a/includes/user/User.php b/includes/user/User.php
	index 9b956b4ed5..5cb1494f76 100644
	--- a/includes/user/User.php
	+++ b/includes/user/User.php
	@@ -1809,10 +1809,6 @@ class User implements IDBAccessObject {
	if ( isset( $limits['user'] ) ) {
	$userLimit = $limits['user'];
	}
	- // limits for newbie logged-in users
	- if ( $isNewbie && isset( $limits['newbie'] ) ) {
	- $keys[wfMemcKey( 'limiter', $action, 'user', $id )] = $limits['newbie'];
	- }
	}

	// limits for anons and for newbie logged-in users
	@@ -1844,6 +1840,11 @@ class User implements IDBAccessObject {
	}
	}

	+ // limits for newbie logged-in users (override all the normal user limits)
	+ if ( $id !== 0 && $isNewbie && isset( $limits['newbie'] ) ) {
	+ $userLimit = $limits['newbie'];
	+ }
	+
	// Set the user limit key
	if ( $userLimit !== false ) {
	list( $max, $period ) = $userLimit;
	--
	2.17.1

File Metadata

Mime Type: text/x-diff
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 6109411
Default Alt Text: 01-T169545-REL1_27.patch (1 KB)

Attached To	Mode
T181665: Tracking bug for 1.27.5/1.29.3/1.30.1/1.31.1 security release	Attached	Detach File
T169545: $wgRateLimits (rate limit / ping limiter) entry for 'user' overrides that for 'newbie' (CVE-2018-0503)	Attached	Detach File

01-T169545-REL1_27.patchReedy (Sam Reed)Actions

01-T169545-REL1_27.patchView Options

File Metadata

Event Timeline

01-T169545-REL1_27.patch
Reedy (Sam Reed)
Actions

01-T169545-REL1_27.patch
View Options