Templates are parsed in AbuseLog
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	MaxSem
	Jul 29 2016, 11:23 PM

Description

In the abuse filter log (Special:AbuseLog), the description of the filter (see line 769 and 826 of "includes/special/SpecialAbuseLog.php" in AbuseFilter extension), should not be parsed.

For example, see https://en.wikipedia.org/w/index.php?title=Special:AbuseLog&wpSearchUser=MaxSem

Details

	Subject	Repo	Branch	Lines +/-
	Always show abuse filter public comments as plain text	mediawiki/extensions/AbuseFilter	master	+10 -11

Customize query in gerrit

Related Objects

Mentioned In: T173249: AbuseFilter abusefilter-warning rendered with <div class="mw-parser-output"> in text
T182213: [Clonable] replace wfMessage()->rawParams() with wfMessage()->plaintextParams() where applicable
Mentioned Here: T26309: Some interface messages are broken if filter name contains template syntax

Event Timeline

MaxSem created this task.Jul 29 2016, 11:23 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJul 29 2016, 11:23 PM

MaxSem added a project: AbuseFilter.Jul 29 2016, 11:24 PM

This is probably not a security issue, unless you see the same thing somewhere else too. From what I see, at worst it makes viewing some logs annoying. The filter descriptions can only be edited by trusted users.

I just quickly logged this bug, needs checking what else is parsed. If it's only things editable by privileged groups, then it can be made public.

• dpatrick triaged this task as Medium priority.Aug 2 2016, 8:29 PM

@Bawolff, @dpatrick and I triaged this. Max, is the danger that someone can inject hyperlinks/etc in the AbuseLog?

Making public, I don't see any way to exploit this

Bawolff mentioned this in T182213: [Clonable] replace wfMessage()->rawParams() with wfMessage()->plaintextParams() where applicable.Dec 10 2017, 3:32 PM

Looks like a duplicate of T26309 to me.

matmarex unsubscribed.Dec 11 2017, 5:16 PM

Melos mentioned this in T173249: AbuseFilter abusefilter-warning rendered with <div class="mw-parser-output"> in text.Mar 7 2018, 4:38 PM

Change 418584 had a related patch set uploaded (by Melos; owner: Melos):
[mediawiki/extensions/AbuseFilter@master] Always show abuse filter public comments as plain text

https://gerrit.wikimedia.org/r/418584

gerritbot added a project: Patch-For-Review.Mar 10 2018, 1:47 PM

Daimona merged a task: T26309: Some interface messages are broken if filter name contains template syntax.Mar 12 2018, 5:17 PM

Daimona added subscribers: liangent, zhuyifei1999, Huji and 4 others.

Change 418584 merged by jenkins-bot:
[mediawiki/extensions/AbuseFilter@master] Always show abuse filter public comments as plain text

https://gerrit.wikimedia.org/r/418584

ReleaseTaggerBot added a project: MW-1.31-release-notes (WMF-deploy-2018-04-03 (1.31.0-wmf.28)).Mar 29 2018, 5:00 PM

matej_suchanek closed this task as Resolved.Mar 29 2018, 5:03 PM

matej_suchanek assigned this task to Melos.

matej_suchanek edited projects, added User-notice; removed Patch-For-Review.

matej_suchanek moved this task from To Triage to Announce in next Tech/News on the User-notice board.

matej_suchanek unsubscribed.