Last modified: 2006-09-09 09:35:13 UTC

Wikimedia Bugzilla is closed!

Wikimedia migrated from Bugzilla to Phabricator. Bug reports are handled in Wikimedia Phabricator.
This static website is read-only and for historical purposes. It is not possible to log in and except for displaying bug reports and their history, links might be broken. See T8886, the corresponding Phabricator task for complete and up-to-date bug report information.

Bug 6886 - PHP undefined offset on bad input to Special:Revisiondelete


Summary:	PHP undefined offset on bad input to Special:Revisiondelete

Status:	RESOLVED FIXED

Product:	MediaWiki
Classification:	Unclassified
Component:	Special pages (Other open bugs)
Version:	1.8.x
Hardware:	All All

Importance:	Low minor (vote)
Target Milestone:	---
Assigned To:	Nobody - You can work on this!

URL:
Whiteboard:
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Reported:	2006-08-01 06:46 UTC by Nick Jenkins
Modified:	2006-09-09 09:35 UTC (History)
CC List:	0 users

See Also:
Web browser:	---
Mobile Platform:	---
Assignee Huggle Beta Tester:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description Nick Jenkins 2006-08-01 06:46:13 UTC

CURL example:
curl --silent --include  -F 'target'='x'
'192.168.0.64/wiki/index.php?title=Special:Revisiondelete'

or as URL:
http://192.168.0.64/wiki/index.php?title=Special:Revisiondelete&target=XXXXXXXYZ

HTML output (with E_ALL errors):
===================================
<br />
<b>Notice</b>:  Undefined offset:  0 in
<b>/var/www/hosts/mediawiki/phase3/includes/SpecialRevisiondelete.php</b> on
line <b>61</b><br />
<br />
<b>Notice</b>:  Undefined variable: rev in
<b>/var/www/hosts/mediawiki/phase3/includes/SpecialRevisiondelete.php</b> on
line <b>94</b><br />
<br />
<b>Fatal error</b>:  Call to a member function isDeleted() on a non-object in
<b>/var/www/hosts/mediawiki/phase3/includes/SpecialRevisiondelete.php</b> on
line <b>94</b><br />
===================================

Comment 1 wclark 2006-09-08 22:20:47 UTC

These errors occur because $this->revisions is null rather than being an array.
 One fix would be to add a check for null at line 60 in RevisionDeleteForm::show
in includes/SpecialRevisiondelete.php... except that I don't know if the
function should immediately return or should output some friendly message.  I'll
need to configure my local mediawiki so that I can test this myself to see what
would be most appropriate.

Comment 2 Rotem Liss 2006-09-09 09:35:13 UTC

Fixed in r16454.

Wikimedia Bugzilla is closed!

Search

Personal tools

Navigation

Links