Page MenuHomePhabricator
Create Task
Maniphest T209585

Special:CheckUserLog is accessible while a user with checkuser-log right is blocked
Closed, ResolvedPublic
Actions

Description

Per T157883 blocked users are not allowed to run checkuser queries but Special:CheckUserLog is still accessible to them.

Details

SubjectRepoBranchLines +/-
SECURITY: Don't allow blocked users to view check user logsmediawiki/extensions/CheckUserwmf/1.33.0-wmf.4+6 -0
SECURITY: Don't allow blocked users to view check user logsmediawiki/extensions/CheckUsermaster+6 -0
Customize query in gerrit

Related Objects

Event Timeline

Melos created this task.Nov 15 2018, 1:48 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptNov 15 2018, 1:48 PM
Bawolff added a project: CheckUser.Nov 15 2018, 1:56 PM
Bawolff added subscribers: Huji, Bawolff.

Given the relative severity of this, I think it'd be ok to work on this in public.

Melos added a comment.EditedNov 15 2018, 2:14 PM

Per comments in https://gerrit.wikimedia.org/r/#/c/mediawiki/extensions/CheckUser/+/473730/

T209585.patch1 KBDownload

Huji added a comment.Nov 15 2018, 10:31 PM

Melos, this patch looks good. Please post it publicly and I will +2 it. Like Brian, I think it is okay to work on this in public.

Melos added a comment.Nov 16 2018, 6:44 AM
In T209585#4752268, @Huji wrote:

Melos, this patch looks good. Please post it publicly and I will +2 it. Like Brian, I think it is okay to work on this in public.

Done. https://gerrit.wikimedia.org/r/474077

Melos added a subscriber: acl*stewards.Nov 16 2018, 7:07 PM
MarcoAurelio subscribed.Nov 20 2018, 7:24 PM

https://gerrit.wikimedia.org/r/#/c/mediawiki/extensions/CheckUser/+/474077/ was merged & cherry-picked. Close as resolved?

Platonides closed this task as Resolved.Nov 20 2018, 11:05 PM
Bawolff changed the visibility from "Custom Policy" to "Public (No Login Required)".Dec 10 2018, 10:46 AM
• chasemp added a project: Security.Feb 10 2020, 10:51 PM
• chasemp removed a project: acl*security.Feb 20 2020, 8:12 PM
MarcoAurelio removed a subscriber: acl*stewards.Nov 28 2020, 12:04 PM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL