Mglaser has uploaded a new change for review.
https://gerrit.wikimedia.org/r/136136
Change subject: SECURITY: Don't parse usernames as wikitext
......................................................................
SECURITY: Don't parse usernames as wikitext
On Special:PasswordReset, don't parse the username as wikitext since
the wikitext is parsed according to the wiki's configuration (might
include wgRawHtml), and the wiki may be private.
Bug: 65501
Change-Id: Ic3e5d42e1be5acc42ba89ae853c5ecbfec04fa91
---
M includes/specials/SpecialPasswordReset.php
1 file changed, 3 insertions(+), 2 deletions(-)
git pull ssh://gerrit.wikimedia.org:29418/mediawiki/core
refs/changes/36/136136/1
diff --git a/includes/specials/SpecialPasswordReset.php
b/includes/specials/SpecialPasswordReset.php
index 62731e9..628da4c 100644
--- a/includes/specials/SpecialPasswordReset.php
+++ b/includes/specials/SpecialPasswordReset.php
@@ -187,7 +187,8 @@
$firstUser = $users[0];
if ( !$firstUser instanceof User || !$firstUser->getID() ) {
- return array( array( 'nosuchuser', $data['Username'] )
);
+ // Don't parse username as wikitext (bug 65501)
+ return array( array( 'nosuchuser', wfEscapeWikiText(
$data['Username'] ) ) );
}
// Check against the rate limiter
@@ -210,7 +211,7 @@
// All the users will have the same email address
if ( $firstUser->getEmail() == '' ) {
// This won't be reachable from the email route, so
safe to expose the username
- return array( array( 'noemail', $firstUser->getName() )
);
+ return array( array( 'noemail', wfEscapeWikiText(
$firstUser->getName() ) ) );
}
// We need to have a valid IP address for the hook, but per bug
18347, we should
--
To view, visit https://gerrit.wikimedia.org/r/136136
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: newchange
Gerrit-Change-Id: Ic3e5d42e1be5acc42ba89ae853c5ecbfec04fa91
Gerrit-PatchSet: 1
Gerrit-Project: mediawiki/core
Gerrit-Branch: REL1_19
Gerrit-Owner: Mglaser <[email protected]>
Gerrit-Reviewer: CSteipp <[email protected]>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
