Page Menu
Home
Phabricator
Search
Configure Global Search
Log In
Files
F27231979
T209585.patch
Melos (Melos)
Actions
View File
Edit File
Delete File
View Transforms
Subscribe
Mute Notifications
Award Token
Flag For Later
Authored By
Melos
Nov 15 2018, 5:23 PM
2018-11-15 17:23:40 (UTC+0)
Size
1 KB
Referenced Files
None
Subscribers
None
T209585.patch
View Options
From b2c65f3a66e8946b2cf42b19887e1f3b05193840 Mon Sep 17 00:00:00 2001
From: Melos <webmelos@gmail.com>
Date: Thu, 15 Nov 2018 18:18:29 +0100
Subject: [PATCH] SECURITY: Don't allow blocked users to view check user logs
Bug: T209585
---
includes/specials/SpecialCheckUserLog.php | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/includes/specials/SpecialCheckUserLog.php b/includes/specials/SpecialCheckUserLog.php
index 81be07f..d9e97d1 100644
--- a/includes/specials/SpecialCheckUserLog.php
+++ b/includes/specials/SpecialCheckUserLog.php
@@ -14,6 +14,12 @@ class SpecialCheckUserLog extends SpecialPage {
$this->setHeaders();
$this->checkPermissions();
+ // Blocked users are not allowed to run checkuser queries (bug T157883)
+ $block = $this->getUser()->getBlock();
+ if ( $block && $block->isSitewide() ) {
+ throw new UserBlockedError( $block );
+ }
+
$out = $this->getOutput();
$request = $this->getRequest();
$this->target = trim( $request->getVal( 'cuSearch', $par ) );
--
2.14.1.windows.1
File Metadata
Details
Attached
Mime Type
text/x-diff
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
6698893
Default Alt Text
T209585.patch (1 KB)
Attached To
Mode
T209585: Special:CheckUserLog is accessible while a user with checkuser-log right is blocked
Attached
Detach File
Event Timeline
Log In to Comment