Page MenuHomePhabricator

Unauthorised access to transwiki import
Closed, ResolvedPublic


MediaWiki developer Happy-Melon discovered that the transwiki import feature ($wgImportSources) neglected to perform access control checks on form submission. Access control checks were only done before form display. Thus, a specially constructed POST request could be used to perform transwiki import without proper authorisation.

Transwiki import is not enabled by default. When it is enabled, it allows wiki pages to be copied from the wikis listed in $wgImportSources in LocalSettings.php.

Version: 1.16.x
Severity: normal



Event Timeline

bzimport raised the priority of this task from to Medium.Nov 21 2014, 11:35 PM
bzimport set Reference to bz28449.
bzimport added a subscriber: Unknown Object (MLST). wrote:

This was fixed in r85005 and r85099; it has been ported to the 1.17, 1.17wmf1 and 1.16 branches.