Page Menu
Home
Phabricator
Search
Configure Global Search
Log In
Files
F7059672
T161453-master.patch
Reedy (Sam Reed)
Actions
View File
Edit File
Delete File
View Transforms
Subscribe
Mute Notifications
Award Token
Flag For Later
Authored By
Reedy
Mar 28 2017, 8:51 PM
2017-03-28 20:51:35 (UTC+0)
Size
2 KB
Referenced Files
None
Subscribers
None
T161453-master.patch
View Options
From d08e69b0414330a8fe950d6b828862d5a0a5d80b Mon Sep 17 00:00:00 2001
From: Reedy <reedy@wikimedia.org>
Date: Tue, 28 Mar 2017 21:47:08 +0100
Subject: [PATCH] [SECURITY] Don't write LocalisationCache to temporary
directory
Bug: T161453
Change-Id: I51b375c63fcece908da921c465c861968c9eee1c
---
RELEASE-NOTES-1.29 | 2 ++
includes/cache/localisation/LocalisationCache.php | 14 ++++++--------
2 files changed, 8 insertions(+), 8 deletions(-)
diff --git a/RELEASE-NOTES-1.29 b/RELEASE-NOTES-1.29
index bb57a9e..e316df6 100644
--- a/RELEASE-NOTES-1.29
+++ b/RELEASE-NOTES-1.29
@@ -35,6 +35,8 @@ production.
* (T156983) $wgRateLimitsExcludedIPs now accepts CIDR ranges as well as single IPs.
* $wgDummyLanguageCodes is deprecated. Additional language code mappings may be
added to $wgExtraLanguageCodes instead.
+* (T161453) LocalisationCache will no longer use the temporary directory in it's
+ fallback chain when trying to work out where to write the cache.
=== New features in 1.29 ===
* (T137376) New language support: Atikamekw (atj)
diff --git a/includes/cache/localisation/LocalisationCache.php b/includes/cache/localisation/LocalisationCache.php
index cbff113..d499340 100644
--- a/includes/cache/localisation/LocalisationCache.php
+++ b/includes/cache/localisation/LocalisationCache.php
@@ -212,19 +212,17 @@ class LocalisationCache {
case 'detect':
if ( !empty( $conf['storeDirectory'] ) ) {
$storeClass = 'LCStoreCDB';
+ } elseif ( $wgCacheDirectory ) {
+ $storeConf['directory'] = $wgCacheDirectory;
+ $storeClass = 'LCStoreCDB';
} else {
- $cacheDir = $wgCacheDirectory ?: wfTempDir();
- if ( $cacheDir ) {
- $storeConf['directory'] = $cacheDir;
- $storeClass = 'LCStoreCDB';
- } else {
- $storeClass = 'LCStoreDB';
- }
+ $storeClass = 'LCStoreDB';
}
break;
default:
throw new MWException(
- 'Please set $wgLocalisationCacheConf[\'store\'] to something sensible.' );
+ 'Please set $wgLocalisationCacheConf[\'store\'] to something sensible.'
+ );
}
}
--
2.9.3
File Metadata
Details
Attached
Mime Type
text/x-diff
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
4509493
Default Alt Text
T161453-master.patch (2 KB)
Attached To
Mode
T140591: MediaWiki 1.28.1/1.27.2/1.23.16 security release
Attached
Detach File
T161453: Having LocalisationCache directory default to system tmp directory is insecure
Attached
Detach File
Event Timeline
Log In to Comment