Change Details

Extension:Lockdown allows any user with `read` permission to access content protected by the extension via Action API module `compare`. Reproduction: ``` api.php?action=compare&fromid=<curid of protected article>&toid=1&prop=diff%7Cids%7Ctitle&formatversion=2 ``` Possibly relates to T297322 / CVE-2021-44858 Not discovered by me; this was exploited in the wild on https://lakeus.xyz/

Extension:Lockdown allows any user with `read` permission to access content protected by the extension via Action API module `compare`. Reproduction: ``` api.php?action=compare&fromid=<curid of protected article>&toid=1&prop=diff%7Cids%7Ctitle&formatversion=2 ``` Checked against `Special:ComparePages` and this cannot be reproduced at first glance Possibly relates to T297322 / CVE-2021-44858 Not discovered by me; this was exploited in the wild on https://lakeus.xyz/

Extension:Lockdown allows any user with `read` permission to access content protected by the extension via Action API module `compare`. Reproduction: ``` api.php?action=compare&fromid=<curid of protected article>&toid=1&prop=diff%7Cids%7Ctitle&formatversion=2 ``` Checked against `Special:ComparePages` and this cannot be reproduced at first glance Possibly relates to T297322 / CVE-2021-44858 Not discovered by me; this was exploited in the wild on https://lakeus.xyz/