Page MenuHomePhabricator

DeleteBatch overwrites the global $wgUser context causing errors and session collisions.
Closed, ResolvedPublic

Description

When running a batch delete as the "Delete page script" user it overwrites the global $wgUser context. This causes all kinds of errors and pollutes user sessions. The changes fixes this to use the built in functionality to specify the deleting user. I did test for any potential security issues regarding this, but I was unable to create a situation in which two users doing the same action would get their sessions taken over. This also fixes the localized deletebatch-system-username not being used when creating the user.

https://gerrit.wikimedia.org/r/#/c/mediawiki/extensions/DeleteBatch/+/475839/

See the upper right of the screen shot where the logged in user's session was polluted and overwritten with the "Delete page script" user.

Event Timeline

Alexia created this task.Nov 26 2018, 9:33 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptNov 26 2018, 9:33 PM

The "MediaWiki-extensions-DeleteBatch" tag does not exist so I can not add it.

Change 475839 had a related patch set uploaded (by Alexia; owner: Alexia):
[mediawiki/extensions/DeleteBatch@master] Do not override the global $wgUser. Just pass the deleting user to the doDeleteArticle() function. Actually use the system message username for user creation.

https://gerrit.wikimedia.org/r/475839

Alexia added a subscriber: ashley.Nov 27 2018, 10:26 PM

@ashley: You might be interested in this one since you were working on it recently.

Alexia closed this task as Resolved.Nov 27 2018, 10:37 PM

Change 475839 merged by jenkins-bot:
[mediawiki/extensions/DeleteBatch@master] Do not override the global $wgUser. Just pass the deleting user to the doDeleteArticle() function. Actually use the system message username for user creation.

https://gerrit.wikimedia.org/r/475839