Page MenuHomePhabricator

Disallow the edit if blocking the user didn't succeed (CVE-2021-31548)
Closed, ResolvedPublicSecurity

Description

For instance if the user is partially blocked, the block won't be successful and the AF will allow the edit to go through.

Event Timeline

I think a fix for this might be pushed publicly on gerrit, but creating as sec-protected for now.

Daimona added a parent task: Restricted Task.Jan 19 2021, 2:19 PM

For now I'm going to push a hacky patch on gerrit, pretending it's a cleanup, then we can make the task public and discuss better strategies.

@matej_suchanek Thank you for merging the fix, I forgot to add you as subscriber here. Let's wait until the fix is deployed with the train next week, and then we can make this task public.

@matej_suchanek Thank you for merging the fix, I forgot to add you as subscriber here. Let's wait until the fix is deployed with the train next week, and then we can make this task public.

I already backported this yesterday, so considering this works as intended, and there's nothing to hide for now, I'm going to make this task public.

Urbanecm changed the visibility from "Custom Policy" to "Public (No Login Required)".
Urbanecm changed the edit policy from "Custom Policy" to "All Users".

Closing, fix is backported.

sbassett renamed this task from Disallow the edit if blocking the user didn't succeed to Disallow the edit if blocking the user didn't succeed (CVE-2021-31548).Apr 23 2021, 6:50 PM