0001-SECURITY-reassignEdits-Delete-rows-from-ip_changes.patch
Custom Policy
Actions

Authored By

	Reedy
	Aug 26 2022, 1:25 AM

Size

1 KB

Referenced Files

None

Subscribers

None

0001-SECURITY-reassignEdits-Delete-rows-from-ip_changes.patch
View Options

	From e1af147f915f0bc77a43745e1bfd09e11055bbc8 Mon Sep 17 00:00:00 2001
	From: Reedy <reedy@wikimedia.org>
	Date: Fri, 26 Aug 2022 02:25:44 +0100
	Subject: [PATCH] SECURITY: reassignEdits: Delete rows from ip_changes

	Bug: T316304
	Change-Id: Ie924c8e7859f8ecbdd50d7d829cfbc02c45649a9
	---
	maintenance/reassignEdits.php \| 15 +++++++++++++++
	1 file changed, 15 insertions(+)

	diff --git a/maintenance/reassignEdits.php b/maintenance/reassignEdits.php
	index 3921ada1d5..db835204f9 100644
	--- a/maintenance/reassignEdits.php
	+++ b/maintenance/reassignEdits.php
	@@ -24,6 +24,7 @@
	*/

	use MediaWiki\MediaWikiServices;
	+use Wikimedia\IPUtils;

	require_once __DIR__ . '/Maintenance.php';

	@@ -154,6 +155,20 @@ class ReassignEdits extends Maintenance {
	);
	$this->output( "done.\n" );
	}
	+
	+ # If $from is an IP, delete any relevant rows from the
	+ # ip_changes. No update needed, as $to cannot be an IP.
	+ if ( !$from->isRegistered() ) {
	+ $this->output( "Deleting ip_changes..." );
	+ $dbw->delete(
	+ 'ip_changes',
	+ [
	+ 'ipc_hex' => IPUtils::toHex( $from->getName() )
	+ ],
	+ __METHOD__
	+ );
	+ $this->output( "done.\n" );
	+ }
	}

	$this->commitTransaction( $dbw, __METHOD__ );
	--
	2.32.1 (Apple Git-133)

Mime Type: text/x-diff
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 9722710
Default Alt Text: 0001-SECURITY-reassignEdits-Delete-rows-from-ip_changes.patch (1 KB)

Attached To	Mode
T311776: Tracking bug for MediaWiki 1.35.8/1.37.5/1.38.3	Attached	Detach File
T316304: CVE-2022-41767: reassignEdits doesn't update results in an IP range check on Special:Contributions	Attached	Detach File