0001-SECURITY-Abort-login-autologin-when-loginwiki-accoun.patch
Tgr (Gergő Tisza)
Actions

Authored By

	Tgr
	Jun 10 2016, 1:34 PM

Size

1 KB

Referenced Files

None

Subscribers

None

0001-SECURITY-Abort-login-autologin-when-loginwiki-accoun.patch
View Options

	From a35c79249cb1c11a8eba5178cd6897ed2225d9bb Mon Sep 17 00:00:00 2001
	From: =?UTF-8?q?Gerg=C5=91=20Tisza?= <gtisza@wikimedia.org>
	Date: Fri, 10 Jun 2016 13:32:11 +0000
	Subject: [PATCH] [SECURITY] Abort login/autologin when loginwiki account is
	unattached

	Bug: T137551
	Change-Id: I7405af5a9361ea58d16194ec7e1385a5e58fde16
	---
	includes/specials/SpecialCentralAutoLogin.php \| 7 +++++++
	includes/specials/SpecialCentralLogin.php \| 2 ++
	2 files changed, 9 insertions(+)

	diff --git a/includes/specials/SpecialCentralAutoLogin.php b/includes/specials/SpecialCentralAutoLogin.php
	index 1e9e86f..c5c625a 100644
	--- a/includes/specials/SpecialCentralAutoLogin.php
	+++ b/includes/specials/SpecialCentralAutoLogin.php
	@@ -250,6 +250,13 @@ class SpecialCentralAutoLogin extends UnlistedSpecialPage {
	return;
	}

	+ if ( !$centralUser->isAttached() ) {
	+ // this should never happen but it's good to be
	+ $this->doFinalOutput( false, 'Central account not connected on login wiki! Please '
	+ . ' ask for developer help', self::getInlineScript( 'anon-set.js' ) );
	+ return;
	+ }
	+
	// We're pretty sure this user is logged in, so pass back
	// headers to prevent caching, just in case
	$this->getOutput()->enableClientCache( false );
	diff --git a/includes/specials/SpecialCentralLogin.php b/includes/specials/SpecialCentralLogin.php
	index da1d70a..e841d27 100644
	--- a/includes/specials/SpecialCentralLogin.php
	+++ b/includes/specials/SpecialCentralLogin.php
	@@ -77,6 +77,8 @@ class SpecialCentralLogin extends UnlistedSpecialPage {
	throw new Exception( "Global user '{$info['name']}' does not exist." );
	} elseif ( $centralUser->getId() !== $info['guid'] ) { // sanity
	throw new Exception( "Global user does not have ID '{$info['guid']}'." );
	+ } elseif ( !$centralUser->isAttached() ) { // even more sanity
	+ throw new Exception( "Global user '{$info['name']}' is not attached on loginwiki." );
	}

	$session = CentralAuthUtils::getCentralSession();
	--
	1.9.1

File Metadata

Mime Type: text/x-diff
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 3789127
Default Alt Text: 0001-SECURITY-Abort-login-autologin-when-loginwiki-accoun.patch (1 KB)

0001-SECURITY-Abort-login-autologin-when-loginwiki-accoun.patchTgr (Gergő Tisza)Actions

0001-SECURITY-Abort-login-autologin-when-loginwiki-accoun.patchView Options

File Metadata

Event Timeline

0001-SECURITY-Abort-login-autologin-when-loginwiki-accoun.patch
Tgr (Gergő Tisza)
Actions

0001-SECURITY-Abort-login-autologin-when-loginwiki-accoun.patch
View Options