Page MenuHomePhabricator

DeleteBatch overwrites the global $wgUser context causing errors and session collisions.
Closed, ResolvedPublic

Description

When running a batch delete as the "Delete page script" user it overwrites the global $wgUser context. This causes all kinds of errors and pollutes user sessions. The changes fixes this to use the built in functionality to specify the deleting user. I did test for any potential security issues regarding this, but I was unable to create a situation in which two users doing the same action would get their sessions taken over. This also fixes the localized deletebatch-system-username not being used when creating the user.

https://gerrit.wikimedia.org/r/#/c/mediawiki/extensions/DeleteBatch/+/475839/

See the upper right of the screen shot where the logged in user's session was polluted and overwritten with the "Delete page script" user.

Zrzut+ekranu+(239).png (1×1 px, 160 KB)

Event Timeline

The "MediaWiki-extensions-DeleteBatch" tag does not exist so I can not add it.

Change 475839 had a related patch set uploaded (by Alexia; owner: Alexia):
[mediawiki/extensions/DeleteBatch@master] Do not override the global $wgUser. Just pass the deleting user to the doDeleteArticle() function. Actually use the system message username for user creation.

https://gerrit.wikimedia.org/r/475839

@ashley: You might be interested in this one since you were working on it recently.

Change 475839 merged by jenkins-bot:
[mediawiki/extensions/DeleteBatch@master] Do not override the global $wgUser. Just pass the deleting user to the doDeleteArticle() function. Actually use the system message username for user creation.

https://gerrit.wikimedia.org/r/475839