0001-SECURITY-Check-read-permissions-in-ApiQueryRevisions.patch
Catrope (Roan Kattouw)
Actions

Authored By

	Catrope
	Nov 7 2025, 8:30 PM

Size

1 KB

Referenced Files

None

Subscribers

None

0001-SECURITY-Check-read-permissions-in-ApiQueryRevisions.patch
View Options

	From 83fc654bfe3e0a85286835e83d9bdacf7b30caed Mon Sep 17 00:00:00 2001
	From: Roan Kattouw <roan.kattouw@gmail.com>
	Date: Fri, 7 Nov 2025 12:29:03 -0800
	Subject: [PATCH] SECURITY: Check read permissions in ApiQueryRevisionsBase

	If the user doesn't have permission to read a page, don't output the
	content of any revisions associated with that page.

	Bug: T401053
	Change-Id: Ia72aa0cc74cd6bc951135f3c33fe9abbc32b9bac
	---
	includes/Api/ApiQueryRevisionsBase.php \| 6 +++++-
	1 file changed, 5 insertions(+), 1 deletion(-)

	diff --git a/includes/Api/ApiQueryRevisionsBase.php b/includes/Api/ApiQueryRevisionsBase.php
	index 49d3d7227a2..d83e1056264 100644
	--- a/includes/Api/ApiQueryRevisionsBase.php
	+++ b/includes/Api/ApiQueryRevisionsBase.php
	@@ -524,7 +524,7 @@ abstract class ApiQueryRevisionsBase extends ApiQueryGeneratorBase {
	$vals['slots'][$role] = $this->extractSlotInfo( $slot, $revDel, $content );
	// @todo Move this into extractSlotInfo() (and remove its $content parameter)
	// when extractDeprecatedContent() is no more.
	- if ( $content ) {
	+ if ( $content && $this->getAuthority()->authorizeRead( 'read', $revision->getPage() ) ) {
	/** @var Content $content */
	$model = $content->getModel();
	$format = $this->slotContentFormats[$role] ?? $content->getDefaultFormat();
	@@ -624,6 +624,10 @@ abstract class ApiQueryRevisionsBase extends ApiQueryGeneratorBase {
	$vals = [];
	$title = Title::newFromPageIdentity( $revision->getPage() );

	+ if ( !$this->getAuthority()->authorizeRead( 'read', $title ) ) {
	+ return [];
	+ }
	+
	if ( $this->fld_parsetree \|\| ( $this->fld_content && $this->generateXML ) ) {
	if ( $content->getModel() === CONTENT_MODEL_WIKITEXT ) {
	/** @var WikitextContent $content */
	--
	2.43.0

File Metadata

Mime Type: text/x-diff
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 22242714
Default Alt Text: 0001-SECURITY-Check-read-permissions-in-ApiQueryRevisions.patch (1 KB)

0001-SECURITY-Check-read-permissions-in-ApiQueryRevisions.patchCatrope (Roan Kattouw)Actions

0001-SECURITY-Check-read-permissions-in-ApiQueryRevisions.patchView Options

File Metadata

Event Timeline

0001-SECURITY-Check-read-permissions-in-ApiQueryRevisions.patch
Catrope (Roan Kattouw)
Actions

0001-SECURITY-Check-read-permissions-in-ApiQueryRevisions.patch
View Options