0001-SECURITY-Fix-log-entry-search-revealing-suppressed-d.patch
matmarex (Bartosz Dziewoński)
Actions

Authored By

	matmarex
	Feb 11 2025, 8:21 PM

Size

1 KB

Referenced Files

None

Subscribers

None

0001-SECURITY-Fix-log-entry-search-revealing-suppressed-d.patch
View Options

	From 7a5de017761b1ef9f4e519da289bfcdea45be922 Mon Sep 17 00:00:00 2001
	From: =?utf-8?q?Bartosz=20Dziewo=C5=84ski?= <dziewonski@fastmail.fm>
	Date: Tue, 11 Feb 2025 21:20:58 +0100
	Subject: [PATCH] SECURITY: Fix log entry search revealing suppressed data to
	users with 'deletedhistory' rights

	Bug: T385958
	Change-Id: Id0588baf6a1587d326b262d075d4e943dc5daacd
	---
	includes/logging/LogPager.php \| 4 ++--
	1 file changed, 2 insertions(+), 2 deletions(-)

	diff --git a/includes/logging/LogPager.php b/includes/logging/LogPager.php
	index 699df9c3420..697324914f0 100644
	--- a/includes/logging/LogPager.php
	+++ b/includes/logging/LogPager.php
	@@ -523,7 +523,7 @@ class LogPager extends ReverseChronologicalPager {
	$this->mConds[] = $this->mDb->bitAnd( 'log_deleted', LogPage::DELETED_ACTION ) . ' = 0';
	} elseif ( !$this->getAuthority()->isAllowedAny( 'suppressrevision', 'viewsuppressed' ) ) {
	$this->mConds[] = $this->mDb->bitAnd( 'log_deleted', LogPage::SUPPRESSED_ACTION ) .
	- ' != ' . LogPage::SUPPRESSED_USER;
	+ ' != ' . LogPage::SUPPRESSED_ACTION;
	}
	}

	@@ -540,7 +540,7 @@ class LogPager extends ReverseChronologicalPager {
	$this->mConds[] = $this->mDb->bitAnd( 'log_deleted', LogPage::DELETED_USER ) . ' = 0';
	} elseif ( !$this->getAuthority()->isAllowedAny( 'suppressrevision', 'viewsuppressed' ) ) {
	$this->mConds[] = $this->mDb->bitAnd( 'log_deleted', LogPage::SUPPRESSED_USER ) .
	- ' != ' . LogPage::SUPPRESSED_ACTION;
	+ ' != ' . LogPage::SUPPRESSED_USER;
	}
	}
	}
	--
	2.28.0.windows.1

Mime Type: text/x-diff
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 19254012
Default Alt Text: 0001-SECURITY-Fix-log-entry-search-revealing-suppressed-d.patch (1 KB)