Page MenuHomePhabricator

SQL injection point in BlogPage::getEditorsList() *and* BlogPage::getVotersList()
Closed, ResolvedPublic

Description

2006 called, they want their non-escaping "escaping" back.

Proposed and tested patch:

Index: BlogPageClass.php
===================================================================
diff --git a/trunk/BlogPageClass.php b/trunk/BlogPageClass.php
--- a/trunk/BlogPageClass.php	(revision 83)
+++ b/trunk/BlogPageClass.php	(working copy)
@@ -506,7 +506,7 @@
 
 			// Get authors and exclude them
 			foreach ( $this->authors as $author ) {
-				$where[] = 'rev_user_text <> \'' . $author['user_name'] . '\'';
+				$where[] = 'rev_user_text <> ' . $dbr->addQuotes( $author['user_name'] );
 			}
 
 			$res = $dbr->select(
@@ -599,7 +599,7 @@
 			// Exclude the authors of the blog post from the list of recent
 			// voters
 			foreach ( $this->authors as $author ) {
-				$where[] = 'username <> \'' . $author['user_name'] . '\'';
+				$where[] = 'username <> ' . $dbr->addQuotes( $author['user_name'] );
 			}
 
 			$res = $dbr->select(

cc @lcawte (ShoutWiki), @SamanthaNguyen (Brickimedia)

Event Timeline

Bawolff added a project: Vuln-Inject.
Bawolff subscribed.

Proposed and tested patch:

+1 to this. Said patch would fix the issue.

As an aside, also in this extension

  • if ( !preg_match( '/' . $blogUserCat . '/', $tag ) ) { - Minor issue, but should use preg_quote (Could lead to DOS). Ditto for line 159 of BlogPageClass.php
  • Line 998 of BlogPageClass.php - "#comment-{$comment['comment_id']}\" title=\"{$page_title->getText()}\">{$comment_text}</a></span>"; - $page_title could contain a quote character. This could lead to a XSS.
  • CreateBlogPost.js line 12. Consider using something other than innerHTML. (e.g. jquery's .text() ), since html isn't needed and makes the function unnecessarily dangerous.
ashley claimed this task.

Now that the patch has been merged, this is resolved.

matmarex changed the visibility from "Custom Policy" to "Public (No Login Required)".Dec 20 2016, 4:00 PM