jenkins-bot has submitted this change and it was merged.
Change subject: SECURITY: Add edit token to Special:ExpandTemplates
......................................................................
SECURITY: Add edit token to Special:ExpandTemplates
On wikis that allow raw HTML, it is not safe to preview wikitext coming from
an untrusted source such as a cross-site request. Thus add an edit token to
the form, and when raw HTML is allowed, ensure the token is provided before
showing the preview.
Unfortunately, MediaWiki does not currently provide logged-out users with
CSRF protection; in that case, do not show the preview unless anonymous
editing is allowed (such wikis have been, and are still, vulnerable).
Backported from MediaWiki 1.23 (c1d6638704e6 in mediawiki/core).
Bug: T73111
Change-Id: I2f1caa57e8fc705ef52fc4b6f351a174b72b33cb
---
M ExpandTemplates.i18n.php
M ExpandTemplates_body.php
2 files changed, 37 insertions(+), 0 deletions(-)
Approvals:
CSteipp: Looks good to me, approved
jenkins-bot: Verified
diff --git a/ExpandTemplates.i18n.php b/ExpandTemplates.i18n.php
index e8103e1..0307ffd 100644
--- a/ExpandTemplates.i18n.php
+++ b/ExpandTemplates.i18n.php
@@ -25,6 +25,13 @@
'expand_templates_remove_nowiki' => 'Suppress <nowiki> tags in
result',
'expand_templates_generate_xml' => 'Show XML parse tree',
'expand_templates_preview' => 'Preview',
+ 'expand_templates_preview_fail_html' => '<em>Because {{SITENAME}} has
raw HTML enabled and there was a loss of session data, the preview is hidden as
a precaution against JavaScript attacks.</em>
+
+<strong>If this is a legitimate preview attempt, please try again.</strong>
+If it still does not work, try [[Special:UserLogout|logging out]] and logging
back in.',
+ 'expand_templates_preview_fail_html_anon' => '<em>Because {{SITENAME}}
has raw HTML enabled and you are not logged in, the preview is hidden as a
precaution against JavaScript attacks.</em>
+
+<strong>If this is a legitimate preview attempt, please
[[Special:UserLogin|log in]] and try again.</strong>',
);
/** Message documentation (Message documentation)
@@ -51,6 +58,8 @@
'expand_templates_remove_nowiki' => 'Option on
[[Special:Expandtemplates]]',
'expand_templates_generate_xml' => 'Used as checkbox label.',
'expand_templates_preview' => '{{Identical|Preview}}',
+ 'expand_templates_preview_fail_html' => 'Used as error message in
Preview section of [[Special:ExpandTemplates]] page.',
+ 'expand_templates_preview_fail_html_anon' => 'Used as error message in
Preview section of [[Special:ExpandTemplates]] page.',
);
/** Afrikaans (Afrikaans)
diff --git a/ExpandTemplates_body.php b/ExpandTemplates_body.php
index 345e61d..712b30b 100644
--- a/ExpandTemplates_body.php
+++ b/ExpandTemplates_body.php
@@ -93,6 +93,9 @@
*/
private function makeForm( $title, $input ) {
$self = $this->getTitle();
+ $request = $this->getRequest();
+ $user = $this->getUser();
+
$form = Xml::openElement(
'form',
array( 'method' => 'post', 'action' =>
$self->getLocalUrl() )
@@ -143,6 +146,7 @@
array( 'accesskey' => 's' )
) . '</p>';
$form .= "</fieldset>\n";
+ $form .= Html::hidden( 'wpEditToken', $user->getEditToken( '',
$request ) );
$form .= Xml::closeElement( 'form' );
return $form;
}
@@ -179,6 +183,30 @@
$pout = $wgParser->parse( $text, $title, $popts );
$lang = $title->getPageViewLanguage();
$out->addHTML( "<h2>" . $this->msg( 'expand_templates_preview'
)->escaped() . "</h2>\n" );
+
+ global $wgRawHtml;
+ if ( $wgRawHtml ) {
+ $request = $this->getRequest();
+ $user = $this->getUser();
+
+ // To prevent cross-site scripting attacks, don't show
the preview if raw HTML is
+ // allowed and a valid edit token is not provided (bug
71111). However, MediaWiki
+ // does not currently provide logged-out users with
CSRF protection; in that case,
+ // do not show the preview unless anonymous editing is
allowed.
+ if ( $user->isAnon() && !$user->isAllowed( 'edit' ) ) {
+ $error = array(
'expand_templates_preview_fail_html_anon' );
+ } elseif ( !$user->matchEditToken( $request->getVal(
'wpEditToken' ), '', $request ) ) {
+ $error = array(
'expand_templates_preview_fail_html' );
+ } else {
+ $error = false;
+ }
+
+ if ( $error ) {
+ $out->wrapWikiMsg( "<div
class='previewnote'>\n$1\n</div>", $error );
+ return;
+ }
+ }
+
$out->addHTML( Html::openElement( 'div', array(
'class' => 'mw-content-' . $lang->getDir(),
'dir' => $lang->getDir(),
--
To view, visit https://gerrit.wikimedia.org/r/176303
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: merged
Gerrit-Change-Id: I2f1caa57e8fc705ef52fc4b6f351a174b72b33cb
Gerrit-PatchSet: 1
Gerrit-Project: mediawiki/extensions/ExpandTemplates
Gerrit-Branch: REL1_22
Gerrit-Owner: PleaseStand <[email protected]>
Gerrit-Reviewer: CSteipp <[email protected]>
Gerrit-Reviewer: Mglaser <[email protected]>
Gerrit-Reviewer: Siebrand <[email protected]>
Gerrit-Reviewer: jenkins-bot <>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
