Page MenuHomePhabricator

Pattern field is broken
Closed, DuplicatePublic

Description

Apart from the usability issues, currently the pattern field is (justifiedly so) escaped to prevent SQL injection. However, the way it is does not allow any pattern characters in the pattern, only exact match, making the field pretty much useless.

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptDec 29 2016, 7:34 AM

Verified on https://www.mediawiki.org/wiki/Special:Nuke

Steps to reproduce:

  1. Find a new page title in https://www.mediawiki.org/wiki/Special:NewPages (open a page, copy the title from the URL so that you have the underscores, for instance Wikimedia_Developer_Summit/2017/Room_Setup).
  2. Enter the title in the pattern field at https://www.mediawiki.org/wiki/Special:Nuke and submit.

I. Observed: The page is found and selected for deletion.

  1. Repeat (2) with a truncated title and % wildcard (e.g. Wikimedia%).

II. Observed: the form is reloaded with an error message "there are no new pages in recent changes" and the field gets emptied.

Nemo_bis triaged this task as High priority.Dec 29 2016, 7:42 AM
Krinkle added a subscriber: Krinkle.Feb 6 2017, 9:45 PM

Caused by 6bb05450766e2df4ea568adf377cbbd237c09b91 (T153988; https://gerrit.wikimedia.org/r/328850) which changed the field name from pattern to nuke-pattern, but did not update the caller.

Change 336357 had a related patch set uploaded (by Ladsgroup):
Update callers

https://gerrit.wikimedia.org/r/336357

Ladsgroup claimed this task.Feb 7 2017, 2:20 AM
Restricted Application added a project: User-Ladsgroup. · View Herald TranscriptFeb 7 2017, 2:20 AM

Once this gets merged. I will backport it for SWAT.

I think you got the wrong bug here. This was reported for the pre-OOUI conversion.

Change 336357 merged by jenkins-bot:
Update callers

https://gerrit.wikimedia.org/r/336357

Ladsgroup moved this task from Incoming to In progress on the User-Ladsgroup board.Feb 8 2017, 4:01 AM
Ladsgroup removed Ladsgroup as the assignee of this task.Feb 10 2017, 9:31 PM
Ladsgroup added a subscriber: Ladsgroup.

I don't have time to work on this. Specially, it's security-related and I'm too sloppy to handle such cases.

This comment was removed by Johnywhy.