Last modified: 2014-06-25 01:25:31 UTC

Wikimedia Bugzilla is closed!

Wikimedia migrated from Bugzilla to Phabricator. Bug reports are handled in Wikimedia Phabricator.
This static website is read-only and for historical purposes. It is not possible to log in and except for displaying bug reports and their history, links might be broken. See T62218, the corresponding Phabricator task for complete and up-to-date bug report information.

Bug 60218 - Flow: Can bypass any protection and blank pages


Summary:	Flow: Can bypass any protection and blank pages

Status:	RESOLVED FIXED

Product:	MediaWiki extensions
Classification:	Unclassified
Component:	Flow (Other open bugs)
Version:	unspecified
Hardware:	All All

Importance:	Immediate blocker (vote)
Target Milestone:	---
Assigned To:	Nobody - You can work on this!

URL:
Whiteboard:
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Reported:	2014-01-19 01:44 UTC by Kunal Mehta (Legoktm)
Modified:	2014-06-25 01:25 UTC (History)
CC List:	11 users (show)

See Also:	66994
Web browser:	---
Mobile Platform:	---
Assignee Huggle Beta Tester:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description Kunal Mehta (Legoktm) 2014-01-19 01:44:53 UTC

Examples: https://www.mediawiki.org/w/index.php?title=MediaWiki:I_hope_this_doesn%27t_work&action=history and https://www.mediawiki.org/w/index.php?title=User_talk:Legoktm/Foo&action=history

How to reproduce:

Go to [[mw:Special:ApiSandbox]]:

* action=flow
* page= page you want to blank
* params={"topic_list": {"topic": "Topic!", "content": "Content!"}}
* token=Flow token from API, +\ if you're logged out

Press Make request, and the page will be replaced with the string: "This talk page has been taken over by a [https://www.mediawiki.org/wiki/Special:MyLanguage/Flow_Portal Flow board]."

Quick fix: Stick a $title->userCan('edit', $this->getUser()) check in ApiFlow

Comment 1 Marc A. Pelletier 2014-01-19 01:46:22 UTC

That one's a bad one!

Comment 2 Marc A. Pelletier 2014-01-19 01:47:24 UTC

Bumping to highest (this should probably even be immediate).

Comment 3 Marc A. Pelletier 2014-01-19 01:50:38 UTC

After brief chat with James_F, bumping to immediate/blocker

Comment 4 Kunal Mehta (Legoktm) 2014-01-19 03:37:50 UTC

Ic331595ddc1014657e9582b657b0351044ae327d

Comment 5 Kunal Mehta (Legoktm) 2014-01-19 03:38:10 UTC

Err, didn't mean to change the fields.

Comment 6 Erik Bernhardson 2014-01-19 04:11:24 UTC

cherry-picked to 1.23wmf11 and deployed

Wikimedia Bugzilla is closed!

Search

Personal tools

Navigation

Links