The form to confirm a permanent deletion doesn't use a CSRF token, allowing a malicious page to permanently delete arbitrary pages for any wikis which the user is logged in to and has permission to use the DeletePagesForGood extension.
https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)
| Subject | Repo | Branch | Lines +/- | |
|---|---|---|---|---|
| Use FormAction instead of UnknownAction hook, Security fix | mediawiki/extensions/DeletePagesForGood | master | +100 -99 |
@Aklapper do you know how I can get help on fixing this security issue since if I set the task to security then no one would see it.
Set to "Software Security bug" but note that this task was filled publicly.
@Paladox: See https://www.mediawiki.org/wiki/Security_for_developers
@Aklapper I am not sure if https://gerrit.wikimedia.org/r/#/c/250007/ fixes the security problem.
I have not specificly looked at that patch, but in general htmlform will fix this problem for you automatically
@Bawolff thanks. I am extending the class FormAction in this extension in that patch I linked.
Should I merge that since it would be important the only reason why I haven't merged it yet is because @saper suggested to use better error calling in one of the if statements. But that can be done in a separate patch since this is a security problem which needs fixing.
I am getting this error
Warning: unlink() [function.unlink]: Unable to find the wrapper "mwstore" - did you forget to enable it when you configured PHP? in /home/paladox1/public_html/extensions/DeletePagesForGood/DeletePagesForGood.class.php on line 196
Warning: unlink(local-backend/local-public/c/c0/Screenshot_(1).png) [function.unlink]: No such file or directory in /home/paladox1/public_html/extensions/DeletePagesForGood/DeletePagesForGood.class.php on line 196
using the new patch. Its to do with line 183 of DeletePagesForGood.class.php.
Patch has https://gerrit.wikimedia.org/r/#/c/250007/ been merged. Do I close this task now as resolved. And open it for public viewing.
Patch has https://gerrit.wikimedia.org/r/#/c/250007/ been merged. Do I close this task now as resolved. And open it for public viewing.
It looks like the security issue is fixed with that commit, so if you're happy with the fix, go ahead and close this and make it public.