Wikimedia Bugzilla is closed!

Wikimedia migrated from Bugzilla to Phabricator. Bug reports are handled in Wikimedia Phabricator.
This static website is read-only and for historical purposes. It is not possible to log in and except for displaying bug reports and their history, links might be broken. See T22496, the corresponding Phabricator task for complete and up-to-date bug report information.

Bug 20496 - 'changedfilter' parameter accepts arbitrary wikitext

Summary:	'changedfilter' parameter accepts arbitrary wikitext

Status: RESOLVED FIXED Product: MediaWiki extensions Classification: Unclassified Component: AbuseFilter (Other open bugs) Version: unspecified Hardware: All All Importance: Normal minor (vote) Target Milestone: --- Assigned To: Andrew Garrett URL: Whiteboard: Keywords: Depends on: Blocks:   Show dependency tree / graph		Reported: 2009-09-03 21:04 UTC by Gurch Modified: 2009-09-18 14:30 UTC (History) CC List: 1 user (show) wikibugs-l See Also: Web browser: --- Mobile Platform: --- Assignee Huggle Beta Tester: ---

Attachments Add an attachment (proposed patch, testcase, etc.)

Description Gurch 2009-09-03 21:04:10 UTC e.g. http://en.wikipedia.org/wiki/Special:AbuseFilter?result=success&changedfilter={{Special:Recentchanges}} I don't think this allows for any bad things to happen but it might be better to validate the parameter. Comment 1 Andrew Garrett 2009-09-18 14:30:33 UTC Resolved in r56602.