Last modified: 2014-10-19 17:52:24 UTC

Wikimedia Bugzilla is closed!

Wikimedia migrated from Bugzilla to Phabricator. Bug reports are handled in Wikimedia Phabricator.
This static website is read-only and for historical purposes. It is not possible to log in and except for displaying bug reports and their history, links might be broken. See T55068, the corresponding Phabricator task for complete and up-to-date bug report information.

Bug 53068 - Permissions info should not be stored in JSON


Summary:	Permissions info should not be stored in JSON

Status:	PATCH_TO_REVIEW

Product:	MediaWiki extensions
Classification:	Unclassified
Component:	Annotator (Other open bugs)
Version:	unspecified
Hardware:	All All

Importance:	Low normal (vote)
Target Milestone:	---
Assigned To:	richa jain

URL:
Whiteboard:
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Reported:	2013-08-19 19:51 UTC by Matthew Flaschen
Modified:	2014-10-19 17:52 UTC (History)
CC List:	2 users (show)

See Also:
Web browser:	---
Mobile Platform:	---
Assignee Huggle Beta Tester:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description Matthew Flaschen 2013-08-19 19:51:30 UTC

Although "user" is treated correctly, the "permissions" object is currently written and returned directly from the JSON.

It should also be stripped on create/update, and generated from the user column in populateAnnotation.  This is for security reasons; as is the owner of the annotation can e.g. give update and admin rights to anyone.

Comment 1 Matthew Flaschen 2013-08-19 19:52:48 UTC

Also, $annotation->user should start as an empty object (so there are no stray properties besides id and username).

Comment 2 Gerrit Notification Bot 2014-01-30 15:41:07 UTC

Change 110378 had a related patch set uploaded by Chiborg:
Remove permission info from JSON

https://gerrit.wikimedia.org/r/110378

Wikimedia Bugzilla is closed!

Search

Personal tools

Navigation

Links