Page MenuHomePhabricator

Namespace hiding on Special:Search
Closed, ResolvedPublic

Description

mediawiki hooks

Special:Search has longtime been a hole for security extensions wanting to hide page content.
I provide here several new Search hooks to close that, when full namespaces are to be hidden, along the code for lockdown to make use of them.


Version: 1.16.x
Severity: enhancement

Attached:

Details

Reference
bz19996

Event Timeline

bzimport raised the priority of this task from to Medium.Nov 21 2014, 10:42 PM
bzimport added a project: MediaWiki-Search.
bzimport set Reference to bz19996.

lockdown implementation

Attached:

brion added a comment.Jul 30 2009, 4:55 PM

I'm a bit leery of adding another hook point that would need to be handled and maintained... would it be better to stick with checking page permissions here, so only one point needs to be handled in the lockdown?

SearchGetNearMatchComplete could be handled directly by Special:Search (and SearchGetNearMatchBefore was added for completeness), but it's probably also interesting for extensions wishing to expand the Go options.

OTOH SearchEngineReplacePrefixesComplete and SearchableNamespaces are needed.
SpecialSearch already handles the case of going to show a page which you shouldn't see, by removing the sumamry and leaking just the title (if it removed the entry it would break pagination). Those two hooks adjust the namespaces where search is performed to include just those you are allowed to read.

Committed in r61150 & r61151