| Trijnstel | |
| Jul 13 2018, 2:14 PM |
| F27679696: 0001-SECURITY-API-Respect-wgBlockCIDRLimit-in-action-bloc.patch | |
| Dec 20 2018, 9:44 AM |
| F27267288: 0001-API-Respect-wgBlockCIDRLimit-in-action-block.patch | |
| Nov 21 2018, 3:58 AM |
| F23718953: 0001-SECURITY-API-Respect-wgBlockCIDRLimit-in-action-bloc.patch | |
| Jul 13 2018, 3:17 PM |
Coincidently I found out that an adminbot blocked IP ranges on ruwikiquote as big as /1 and /2. That's almost everyone...
ru.wikiquote.org
2018-Jun-20 — 2023-Jun-20: 128.0.0.0/1 blocked by QBA-bot ({{BlockedHosting}})
2018-Jun-20 — 2023-Jun-20: 128.0.0.0/2 blocked by QBA-bot ({{BlockedHosting}})
https://tools.wmflabs.org/meta/stalktoy/183.198.0.0%2F16
It shouldn't be possible on Wikimedia wikis to block such huge ranges. Probably a bug, so please correct it.
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | • dancy | T302086 Set scap minimum python version to 3.7 | |||
| Resolved | None | T247045 Migrate all of production metal and VMs to Buster or later | |||
| Resolved | akosiaris | T249724 Track and remove jessie based container images from production | |||
| Resolved | Jdforrester-WMF | T224908 Drop jessie testing support | |||
| Resolved | Jdforrester-WMF | T224907 Drop php55 testing support | |||
| Resolved | Reedy | T205039 Release MediaWiki 1.27.6/1.30.2/1.31.2/1.32.2 | |||
| Resolved | Reedy | T205041 Tracking bug for 1.27.6/1.30.2/1.31.2/1.32.2 security release | |||
| Resolved | Legoktm | T199540 Forbid blocking IP ranges as big as /1 and /2, as done on ruwikiquote using the API |
This task doesn't only affect Russian Sites, nor is it a consequence of the site being Russian
$wgBlockCIDRLimit = [ 'IPv4' => 16, # Blocks larger than a /16 (64k addresses) will not be allowed 'IPv6' => 19, ];
Somehow the limits are being bypassed?
It looks like it was broken by rMWb11b0c798d6f: * Moved Target field validation into a field validation callback to show erros… back in 2011, when the validation was moved out of SpecialBlock::processForm().
Code-Review+1
As a minor thing, SpecialBlock::checkUnblockSelf() is now called twice by the API, but that can probably be cleaned up at another time.
The call in ApiBlock results in an error message with the block info included, which the call from SpecialBlock::validateTarget() wouldn't. We want to keep that block info.
$this->mUser = User::newFromName( '128.0.0.0/16', false );
Eew. But I guess ok for a security patch to avoid further rewriting of the test class.
I think it's ready to deploy. I rebased it on to master since it didn't apply against the current deployment branch.
Deployed and verified on test.wikipedia.org. Final patch I used (just added SECURITY: to the commit message) is attached.
Change 514765 had a related patch set uploaded (by Reedy; owner: Legoktm):
[mediawiki/core@REL1_27] SECURITY: API: Respect $wgBlockCIDRLimit in action=block
Change 514765 merged by Reedy:
[mediawiki/core@REL1_27] SECURITY: API: Respect $wgBlockCIDRLimit in action=block
Change 514776 had a related patch set uploaded (by Reedy; owner: Legoktm):
[mediawiki/core@REL1_30] SECURITY: API: Respect $wgBlockCIDRLimit in action=block
Change 514776 merged by Reedy:
[mediawiki/core@REL1_30] SECURITY: API: Respect $wgBlockCIDRLimit in action=block
Change 514756 merged by jenkins-bot:
[mediawiki/core@master] SECURITY: API: Respect $wgBlockCIDRLimit in action=block
Change 514852 had a related patch set uploaded (by Reedy; owner: Legoktm):
[mediawiki/core@REL1_31] SECURITY: API: Respect $wgBlockCIDRLimit in action=block
Change 514952 had a related patch set uploaded (by Reedy; owner: Legoktm):
[mediawiki/core@REL1_32] SECURITY: API: Respect $wgBlockCIDRLimit in action=block
Change 514852 merged by jenkins-bot:
[mediawiki/core@REL1_31] SECURITY: API: Respect $wgBlockCIDRLimit in action=block
Change 514976 had a related patch set uploaded (by Reedy; owner: Legoktm):
[mediawiki/core@REL1_33] SECURITY: API: Respect $wgBlockCIDRLimit in action=block
Change 514952 merged by jenkins-bot:
[mediawiki/core@REL1_32] SECURITY: API: Respect $wgBlockCIDRLimit in action=block
Change 514976 merged by jenkins-bot:
[mediawiki/core@REL1_33] SECURITY: API: Respect $wgBlockCIDRLimit in action=block