Page MenuHomePhabricator

Titleblacklist - Compromised Error Messages
Closed, DeclinedPublic

Description

Under the i18n default messages, error messages (titleblacklist-forbidden-edit, titleblacklist-forbidden-move, titleblacklist-forbidden-upload, titleblacklist-forbidden-new-account) contain the actual regex tripped. This severely compromises the effectiveness of such rules, despite the regex rules being publicly viewable, especially given that even wikimedia wikis remove the following from the relevant MediaWiki page:

It matches the following blacklist entry: <code>$1</code>

I am requesting that this default be removed from the i18n messages.

Edit: doesn't seem to be any interest, especially when all the regex is already public at mediawiki:titleblacklist anyways

Event Timeline

Vvjjkkii renamed this task from Titleblacklist - Compromised Error Messages to c0daaaaaaa.Jul 1 2018, 1:13 AM
Vvjjkkii triaged this task as High priority.
Vvjjkkii updated the task description. (Show Details)
Vvjjkkii removed a subscriber: Aklapper.
CommunityTechBot renamed this task from c0daaaaaaa to Titleblacklist - Compromised Error Messages.Jul 2 2018, 4:33 PM
CommunityTechBot raised the priority of this task from High to Needs Triage.
CommunityTechBot updated the task description. (Show Details)
CommunityTechBot added a subscriber: Aklapper.
SpookyGhost8 updated the task description. (Show Details)