Page Menu
Home
Phabricator
Search
Configure Global Search
Log In
Files
F8608778
0001-Make-newbie-limit-in-wgRateLimits-really-override-us.patch
matmarex (Bartosz Dziewoński)
Actions
View File
Edit File
Delete File
View Transforms
Subscribe
Authored By
matmarex
Jul 3 2017, 4:17 PM
2017-07-03 16:17:09 (UTC+0)
Size
1 KB
Referenced Files
None
Subscribers
None
0001-Make-newbie-limit-in-wgRateLimits-really-override-us.patch
View Options
From b6178aea17beba6254cfe08eeeabf85f81dbf6fa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bartosz=20Dziewo=C5=84ski?= <matma.rex@gmail.com>
Date: Mon, 3 Jul 2017 18:09:38 +0200
Subject: [PATCH] Make 'newbie' limit in $wgRateLimits really override 'user'
limit
The order of operations was incorrect.
Bug: T169545
Change-Id: Ia910aa2a494914d3b0017daac9ab294ea9fa8705
---
includes/user/User.php | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/includes/user/User.php b/includes/user/User.php
index a1119fa..2e6b95b 100644
--- a/includes/user/User.php
+++ b/includes/user/User.php
@@ -1965,10 +1965,6 @@ class User implements IDBAccessObject {
if ( isset( $limits['user'] ) ) {
$userLimit = $limits['user'];
}
- // limits for newbie logged-in users
- if ( $isNewbie && isset( $limits['newbie'] ) ) {
- $keys[$cache->makeKey( 'limiter', $action, 'user', $id )] = $limits['newbie'];
- }
}
// limits for anons and for newbie logged-in users
@@ -2000,6 +1996,11 @@ class User implements IDBAccessObject {
}
}
+ // limits for newbie logged-in users (override all the normal user limits)
+ if ( $id !== 0 && $isNewbie && isset( $limits['newbie'] ) ) {
+ $userLimit = $limits['newbie'];
+ }
+
// Set the user limit key
if ( $userLimit !== false ) {
list( $max, $period ) = $userLimit;
--
2.8.1.windows.1
File Metadata
Details
Attached
Mime Type
text/x-diff
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
4754335
Default Alt Text
0001-Make-newbie-limit-in-wgRateLimits-really-override-us.patch (1 KB)
Attached To
Mode
T169545: $wgRateLimits (rate limit / ping limiter) entry for 'user' overrides that for 'newbie' (CVE-2018-0503)
Attached
Detach File
Event Timeline
Log In to Comment