Page MenuHomePhabricator

Flow: Can bypass any protection and blank pages
Closed, ResolvedPublic


Examples: and

How to reproduce:

Go to [[mw:Special:ApiSandbox]]:

  • action=flow
  • page= page you want to blank
  • params={"topic_list": {"topic": "Topic!", "content": "Content!"}}
  • token=Flow token from API, +\ if you're logged out

Press Make request, and the page will be replaced with the string: "This talk page has been taken over by a [ Flow board]."

Quick fix: Stick a $title->userCan('edit', $this->getUser()) check in ApiFlow

Version: unspecified
Severity: blocker
See Also:



Event Timeline

bzimport raised the priority of this task from to Unbreak Now!.Nov 22 2014, 3:05 AM
bzimport set Reference to bz60218.
bzimport added a subscriber: Unknown Object (MLST).

Bumping to highest (this should probably even be immediate).

After brief chat with James_F, bumping to immediate/blocker


Err, didn't mean to change the fields.

cherry-picked to 1.23wmf11 and deployed

Restricted Application added a subscriber: Luke081515. · View Herald Transcript