T237887.patch
Urbanecm
Actions

Authored By

	Urbanecm
	Nov 11 2019, 4:22 PM

Size

1 KB

Referenced Files

None

Subscribers

None

T237887.patch
View Options

	From 820b77a9fe6225e2460d7d55bf4ffc9386e12073 Mon Sep 17 00:00:00 2001
	From: Martin Urbanec <martin.urbanec@wikimedia.cz>
	Date: Sun, 10 Nov 2019 23:11:34 +0100
	Subject: [PATCH] SECURITY: Make sure provided filter id match provided history
	ID in history view

	AbuseFilterViewEdit does privilege checks based on filter ID,
	and displays what is hidden under given history ID, but doesn't
	make sure those two IDs actually belong to one filter.

	That means user can easily change filter ID to a public
	filter and view old versions of nowadays private filters.

	Bug: T237887
	Change-Id: Ic12790bd33982473f77551bde9599ed083a3e1f1
	---
	includes/Views/AbuseFilterViewEdit.php \| 6 +++++-
	1 file changed, 5 insertions(+), 1 deletion(-)

	diff --git a/includes/Views/AbuseFilterViewEdit.php b/includes/Views/AbuseFilterViewEdit.php
	index 8dd4eb7c..1077ca8a 100644
	--- a/includes/Views/AbuseFilterViewEdit.php
	+++ b/includes/Views/AbuseFilterViewEdit.php
	@@ -157,7 +157,11 @@ class AbuseFilterViewEdit extends AbuseFilterView {
	// Load from request OR database.
	list( $row, $actions ) = $this->loadRequest( $filter, $history_id );

	- if ( !$row ) {
	+ if (
	+ !$row \|\|
	+ // @fixme Temporary stopgap for T237887
	+ ($history_id && $row->af_id !== $filter)
	+ ) {
	$out->addHTML(
	Xml::tags(
	'p',
	--
	2.17.1