Page MenuHomePhabricator

Block::updateTimestamp() updates expiry of all blocks for the IP
Closed, ResolvedPublic

Description

If a wiki hasn't seen enough traffic that Block::purgeExpired() is called, it's possible that there are expired blocks plus autoblocks, and when those autoblocks are extended, the expired block will get extended as well.

Event Timeline

Legoktm created this task.Mar 3 2016, 2:45 AM

Change 274623 had a related patch set uploaded (by Legoktm):
Use ipb_id when updating expiry in Block::updateTimestamp()

https://gerrit.wikimedia.org/r/274623

Change 274623 merged by jenkins-bot:
Use ipb_id when updating expiry in Block::updateTimestamp()

https://gerrit.wikimedia.org/r/274623

Legoktm closed this task as Resolved.Mar 14 2016, 10:07 PM

we should probably get T128695 backported into the security release?

Maybe. Its not an exploit us bug, and it might be too late for the current release. Ill mark it blocking the release bug and let @demon and @csteipp decide

Change 304114 had a related patch set uploaded (by Chad):
Use ipb_id when updating expiry in Block::updateTimestamp()

https://gerrit.wikimedia.org/r/304114

Change 304115 had a related patch set uploaded (by Chad):
Use ipb_id when updating expiry in Block::updateTimestamp()

https://gerrit.wikimedia.org/r/304115

demon added a comment.Aug 10 2016, 9:09 PM

Went ahead and just backported to REL1_23 and REL1_25 so they get caught up in the next release.

Change 304115 merged by jenkins-bot:
Use ipb_id when updating expiry in Block::updateTimestamp()

https://gerrit.wikimedia.org/r/304115

Change 304114 merged by jenkins-bot:
Use ipb_id when updating expiry in Block::updateTimestamp()

https://gerrit.wikimedia.org/r/304114