Page MenuHomePhabricator
Create Task
Maniphest T407977

Extension:TemplateSandbox does not respect $wgNonincludableNamespaces for pages under the sandbox prefix
Closed, ResolvedPublicSecurity
Actions

Description

For example, if the namespace Foo is protected by $wgNonincludableNamespaces, people can still bypass the transclusion restriction to access Foo:Bar/Test by using the Foo:Bar prefix and previewing the wikitext {{:Test}}.

Event Timeline

Leo768 created this task.Oct 22 2025, 1:11 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptOct 22 2025, 1:12 PM
Leo768 added projects: MediaWiki-extensions-TemplateSandbox, MediaWiki-extensions-Lockdown, Vuln-Infoleak.Oct 22 2025, 1:13 PM
Leo768 added subscribers: Lakejason0, Dianliang233.
sbassett moved this task from Incoming to Watching on the Security-Team board.Oct 27 2025, 4:33 PM
sbassett added a project: SecTeam-Processed.
sbassett added a subscriber: Jackmcbarn.
SomeRandomDeveloper added a project: User-SomeRandomDeveloper.Jul 13 2026, 11:21 PM
SomeRandomDeveloper subscribed.

@Leo768 can you still reproduce this issue? I think I fixed it in core in T299359 / https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1306214, and I cannot reproduce this bug locally anymore, unless I undo the core fix.

SomeRandomDeveloper moved this task from Backlog to Waiting on the User-SomeRandomDeveloper board.Jul 13 2026, 11:21 PM
Lakejason0 added a comment.Jul 14 2026, 4:52 AM
在T407977#12117420中，@SomeRandomDeveloper写道：

@Leo768 can you still reproduce this issue? I think I fixed it in core in T299359 / https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1306214, and I cannot reproduce this bug locally anymore, unless I undo the core fix.

I have confirmed with Leo768 that on my site (MediaWiki 1.46.0) this is actually not reproducible now.

sbassett subscribed.Jul 14 2026, 2:22 PM

Happy to make this bug public if there's nothing left to be done here.

Leo768 added a comment.Jul 14 2026, 8:03 PM

It's really easy to realise T407974 when investigating this bug, so I'd prefer not to make this public until T407974 is fixed as well.

sbassett added a comment.Jul 14 2026, 8:05 PM

Ok, we can keep this task private for now then.

SomeRandomDeveloper moved this task from Waiting to Done on the User-SomeRandomDeveloper board.Jul 14 2026, 9:22 PM
Rscout subscribed.Aug 6 2026, 2:32 PM

T407974 is deployed at this time.

SomeRandomDeveloper closed this task as Resolved.Aug 14 2026, 9:48 PM
SomeRandomDeveloper claimed this task.

Closing as T407974 is fixed now

Rscout changed the visibility from "Custom Policy" to "Public (No Login Required)".Aug 17 2026, 4:10 PM
sbassett changed the edit policy from "Custom Policy" to "All Users".Aug 17 2026, 4:10 PM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits