Gergő Tisza has uploaded a new change for review.
https://gerrit.wikimedia.org/r/318443
Change subject: SECURITY: Check that the loginwiki account is attached when
logging in
......................................................................
SECURITY: Check that the loginwiki account is attached when logging in
For Special:CentralAutoLogin/checkLoggedIn, we make sure the loginwiki
user is attached. For good measure, the same is done in /validateSession
and /refreshCookies even though we shouldn't have gotten to this point
if it isn't. We don't do it for the edge wiki in /createSession or
/setCookies for reasons already explained in the comment on line 435.
For Special:CentralLogin/start, we now raise an error if the local
loginwiki account exists but isn't attached. If it doesn't exist
locally, we don't error because we assume it'll be auto-created later.
For Special:CentralLogin/complete, we check that the local edge wiki
account is attached too, even though we shouldn't have gotten to this
point if it isn't.
Bug: T137551
Change-Id: Ib2018d13ced726b6d7416fce0502d678a123f638
---
M includes/specials/SpecialCentralAutoLogin.php
M includes/specials/SpecialCentralLogin.php
2 files changed, 18 insertions(+), 2 deletions(-)
git pull ssh://gerrit.wikimedia.org:29418/mediawiki/extensions/CentralAuth
refs/changes/43/318443/1
diff --git a/includes/specials/SpecialCentralAutoLogin.php
b/includes/specials/SpecialCentralAutoLogin.php
index 4befd4c..ea65157 100644
--- a/includes/specials/SpecialCentralAutoLogin.php
+++ b/includes/specials/SpecialCentralAutoLogin.php
@@ -166,7 +166,7 @@
CentralAuthUtils::setP3P();
$centralUser = CentralAuthUser::getInstance(
$this->getUser() );
- if ( $centralUser && $centralUser->getId() ) {
+ if ( $centralUser && $centralUser->getId() &&
$centralUser->isAttached() ) {
$centralSession = $this->getCentralSession(
$centralUser, $this->getUser() );
// Refresh 'remember me' preference
@@ -253,6 +253,15 @@
// We're pretty sure this user is logged in, so pass
back
// headers to prevent caching, just in case
$this->getOutput()->enableClientCache( false );
+
+ // Sanity check: If the loginwiki account isn't
attached, things are broken (T137551)
+ if ( !$centralUser->isAttached() ) {
+ $this->doFinalOutput( false,
+ 'Account on central wiki is not
attached (this shouldn\'t happen)',
+ self::getInlineScript( 'anon-set.js' )
+ );
+ return;
+ }
$memcData = array( 'gu_id' => $centralUser->getId() );
$token = MWCryptRand::generateHex( 32 );
@@ -365,6 +374,7 @@
$memcData['wikiid'] !== $wikiid ||
!$centralUser ||
!$centralUser->getId() ||
+ !$centralUser->isAttached() ||
$memcData['gu_id'] != $centralUser->getId()
) {
$this->doFinalOutput( false, 'Invalid
parameters' );
diff --git a/includes/specials/SpecialCentralLogin.php
b/includes/specials/SpecialCentralLogin.php
index 77ae66e..e5c9a88 100644
--- a/includes/specials/SpecialCentralLogin.php
+++ b/includes/specials/SpecialCentralLogin.php
@@ -74,11 +74,14 @@
return;
}
- $centralUser = CentralAuthUser::getInstanceByName(
$info['name'] );
+ $user = User::newFromName( $info['name'] );
+ $centralUser = CentralAuthUser::getInstance( $user );
if ( !$centralUser->exists() ) { // sanity
throw new Exception( "Global user '{$info['name']}'
does not exist." );
} elseif ( $centralUser->getId() !== $info['guid'] ) { // sanity
throw new Exception( "Global user does not have ID
'{$info['guid']}'." );
+ } elseif ( !$centralUser->isAttached() && !$user->isAnon() ) {
// sanity
+ throw new Exception( "User '{$info['name']}' exists
locally but is not attached." );
}
$session = CentralAuthUtils::getCentralSession();
@@ -201,6 +204,9 @@
}
$centralUser = CentralAuthUser::getInstance( $user );
if ( !$centralUser->getId() ) { // sanity
+ throw new Exception( "The central user account does not
exist." );
+ }
+ if ( !$centralUser->isAttached() ) { // sanity
throw new Exception( "The user account is not
attached." );
}
--
To view, visit https://gerrit.wikimedia.org/r/318443
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: newchange
Gerrit-Change-Id: Ib2018d13ced726b6d7416fce0502d678a123f638
Gerrit-PatchSet: 1
Gerrit-Project: mediawiki/extensions/CentralAuth
Gerrit-Branch: master
Gerrit-Owner: Gergő Tisza <[email protected]>
Gerrit-Reviewer: Anomie <[email protected]>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
