Page MenuHomePhabricator

improved validation of IP address in function "User::isIP"
Closed, DeclinedPublic

Description

Author: jimmy.collins

Description:
In User.php the function isIP verifies f.e. 300.300.300.300 as IP address.
Attached you will find a patch that will only verify valid IP (v4) addresses.

The patched function still verifies usemod usernames (see bug 3631).

Regards, Jiimmy


Version: 1.7.x
Severity: normal

Details

Reference
bz6198

Event Timeline

bzimport raised the priority of this task from to Lowest.Nov 21 2014, 9:21 PM
bzimport set Reference to bz6198.
bzimport added a subscriber: Unknown Object (MLST).

jimmy.collins wrote:

User.php.patch (trunk)

Attached:

As the source says:

  • Note: We match \d{1,3}\.\d{1,3}\.\d{1,3}\.xxx as an anonymous IP
  • address because the usemod software would "cloak" anonymous IP
  • addresses like this, if we allowed accounts like this to be created
  • new users could get the old edits of these anonymous users.

As far as I'm concerned, User::isIP() has two purposes: to prevent users registering
usernames which conflict with IP addresses, and to prevent registration of names which are
confusingly similar to IP addresses. If you need to perform only the first task for some
reason, you can use wfIP2Unsigned($ip) !== false.

jimmy.collins wrote:

(In reply to comment #2)

... and to prevent prevent registration of names which are confusingly similar

to IP addresses.

Tim, if this is wanted, a little comment in the source would be helpfull.

As far as I'm concerned this function sould verfiy a valid IP address (except
$.$.$.xxx).

Updated the comment in the source, not a bug, closing as wontfix.