wbmergeitems doesn't need a token to merge items
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	Lucie
	Mar 20 2015, 3:00 PM

Description

When you click on the example links in the api you would automatically merge the Items in Wikidata. You don't need a edit token or anything. We probably don't want that.

Details

Related Changes in Gerrit:

	Subject	Repo	Branch	Lines +/-
	Make the merge item API require an edit token	mediawiki/extensions/Wikibase	wmf/1.25wmf22	+9 -1
	Make the merge item API require an edit token	mediawiki/extensions/Wikibase	master	+9 -1

Customize query in gerrit

Related Objects

Mentioned In: rEWBAa5a40763e729: Make the merge item API require an edit token
rEWBAdf074f0db0d7: Make the merge item API require an edit token
rMEXTe9f1c3dd9a8b: Updated mediawiki/extensions Project: mediawiki/extensions/Wikibase…

Event Timeline

Maniphest changed the visibility from "Public (No Login Required)" to "Custom Policy".Mar 20 2015, 3:00 PM

Maniphest changed the edit policy from "All Users" to "Custom Policy".

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptMar 20 2015, 3:00 PM

Lucie created this task.Mar 20 2015, 3:00 PM

Lucie updated the task description. (Show Details)

Lucie added projects: Wikidata, acl*security.

Lucie changed Security from None to Software security bug.

Lucie edited subscribers, added: Lucie, aude, daniel; removed: Aklapper.

Fix:

Add the following to MergeItems.php

	public function needsToken() {
		return true;
	}

The module should also require a POST request

In T93365#1135464, @Legoktm wrote:

The module should also require a POST request

Oh, indeed, yes.

0001-SECURITY-action-wbmergeitems-needs-a-csrf-token.patch979 BDownload

I guess we also need a patch for the Wikidata repository for deployment?

In T93365#1135490, @Legoktm wrote:

0001-SECURITY-action-wbmergeitems-needs-a-csrf-token.patch979 BDownload

I guess we also need a patch for the Wikidata repository for deployment?

Yes... we'll take care of everything.

tried the patch locally, doing a get request with token parameter and get "The 'token' parameter was found in the query string, but must be in the POST body"

thus, I think the patch is good and sufficient.

thanks legoktm!

hoo added a subscriber: Lydia_Pintscher.Mar 20 2015, 3:29 PM

0001-SECURITY-Make-action-wbmergeitems-need-a-csrf-token.patch1 KBDownload

Applies cleanly to both 1.25wmf19 and 1.25wmf22 of Wikidata (the deployed branches).

greg subscribed.Mar 20 2015, 3:47 PM

Patch applied, verified and deployed. I will close/ publish this bug once we fix this on master.

• csteipp added a project: Vuln-CSRF.Mar 20 2015, 7:24 PM

hoo changed Security from Software security bug to None.Mar 23 2015, 2:37 PM

hoo changed the visibility from "Custom Policy" to "Public (No Login Required)".Mar 23 2015, 3:34 PM

hoo changed the edit policy from "Custom Policy" to "All Users".

Change 198736 had a related patch set uploaded (by Hoo man):
Make the merge item API require an edit token

https://gerrit.wikimedia.org/r/198736

gerritbot added a project: Patch-For-Review.Mar 23 2015, 3:35 PM

@Magnus: I think your tools are fine but just in case you run into trouble...
@Ladsgroup, @Multichill, @Sjoerddebruin: for your info as well in case you see any bot user having issues

hoo closed this task as Resolved.Mar 23 2015, 3:39 PM

hoo claimed this task.

Change 198736 merged by jenkins-bot:
Make the merge item API require an edit token

https://gerrit.wikimedia.org/r/198736

Looks like Pywikibot already uses a token and posts it, see https://git.wikimedia.org/blob/pywikibot%2Fcore.git/3c097590364c81d35502ab99baaa742493db70c6/pywikibot%2Fsite.py#L5821

As far as I could tell, the merge gadget and Magnus' tools all do the right thing and use post + token, which means they shouldn't be affected by this change.

Diffusion mentioned this in rMEXTe9f1c3dd9a8b: Updated mediawiki/extensions Project: mediawiki/extensions/Wikibase….Mar 23 2015, 3:56 PM

hoo mentioned this in rEWBAdf074f0db0d7: Make the merge item API require an edit token.Mar 23 2015, 3:57 PM