0001-SECURITY-Check-read-permissions-in-ApiQueryAllRevisi.patch
Catrope (Roan Kattouw)
Actions

Authored By

	Catrope
	Nov 7 2025, 8:09 PM

Size

2 KB

Referenced Files

None

Subscribers

None

0001-SECURITY-Check-read-permissions-in-ApiQueryAllRevisi.patch
View Options

	From 2e8ec0a5d41fe84d4870d1d05e7d1204d88c7a6b Mon Sep 17 00:00:00 2001
	From: Roan Kattouw <roan.kattouw@gmail.com>
	Date: Fri, 7 Nov 2025 12:06:48 -0800
	Subject: [PATCH] SECURITY: Check read permissions in ApiQueryAllRevisions

	Other API modules throw an error when trying to look at revisions of
	pages that the user doesn't have read permissions for. That doesn't make
	as much sense for list=allrevisions since it enumerates all revisions
	and could trigger this error just based on a restricted page having been
	edited recently. So instead, silently drop results from restricted
	pages.

	Bug: T401053
	Change-Id: Ic28e12c5731c90b707aef0b243f6399765062f69
	---
	includes/Api/ApiQueryAllRevisions.php \| 9 +++++++--
	1 file changed, 7 insertions(+), 2 deletions(-)

	diff --git a/includes/Api/ApiQueryAllRevisions.php b/includes/Api/ApiQueryAllRevisions.php
	index 485f5b9b033..7ba081321ba 100644
	--- a/includes/Api/ApiQueryAllRevisions.php
	+++ b/includes/Api/ApiQueryAllRevisions.php
	@@ -218,6 +218,12 @@ class ApiQueryAllRevisions extends ApiQueryRevisionsBase {
	continue;
	}

	+ $title = Title::newFromRow( $row );
	+ if ( !$this->getAuthority()->authorizeRead( 'read', $title ) ) {
	+ // If the user doesn't have permission to read this title, pretend it doesn't exist
	+ continue;
	+ }
	+
	if ( $resultPageSet !== null ) {
	if ( $params['generatetitles'] ) {
	$generated[$row->rev_page] = $row->rev_page;
	@@ -225,13 +231,12 @@ class ApiQueryAllRevisions extends ApiQueryRevisionsBase {
	$generated[] = $row->rev_id;
	}
	} else {
	- $revision = $this->revisionStore->newRevisionFromRow( $row, 0, Title::newFromRow( $row ) );
	+ $revision = $this->revisionStore->newRevisionFromRow( $row, 0, $title );
	$rev = $this->extractRevisionInfo( $revision, $row );

	if ( !isset( $pageMap[$row->rev_page] ) ) {
	$index = $nextIndex++;
	$pageMap[$row->rev_page] = $index;
	- $title = Title::newFromPageIdentity( $revision->getPage() );
	$a = [
	'pageid' => $title->getArticleID(),
	'revisions' => [ $rev ],
	--
	2.43.0

File Metadata

Mime Type: text/x-diff
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 22242576
Default Alt Text: 0001-SECURITY-Check-read-permissions-in-ApiQueryAllRevisi.patch (2 KB)

0001-SECURITY-Check-read-permissions-in-ApiQueryAllRevisi.patchCatrope (Roan Kattouw)Actions

0001-SECURITY-Check-read-permissions-in-ApiQueryAllRevisi.patchView Options

File Metadata

Event Timeline

0001-SECURITY-Check-read-permissions-in-ApiQueryAllRevisi.patch
Catrope (Roan Kattouw)
Actions

0001-SECURITY-Check-read-permissions-in-ApiQueryAllRevisi.patch
View Options