jenkins-bot has submitted this change and it was merged.
Change subject: SECURITY: Don't cache when a call could autocreate
......................................................................
SECURITY: Don't cache when a call could autocreate
Fixes for action=raw (used when sites include other site's javascript),
and stashed images.
Bug: 53032
Change-Id: I8f915f6a4756f750c74d9ee9bec58f7ba6c0c827
---
M includes/actions/RawAction.php
M includes/specials/SpecialUploadStash.php
2 files changed, 5 insertions(+), 0 deletions(-)
Approvals:
CSteipp: Looks good to me, approved
jenkins-bot: Verified
diff --git a/includes/actions/RawAction.php b/includes/actions/RawAction.php
index d1d457c..12ce9f9 100644
--- a/includes/actions/RawAction.php
+++ b/includes/actions/RawAction.php
@@ -94,6 +94,9 @@
# Output may contain user-specific data;
# vary generated content for open sessions on private wikis
$privateCache = !User::groupHasPermission( '*', 'read' ) && (
$smaxage == 0 || session_id() != '' );
+ // Bug 53032 - make this private if user is logged in,
+ // so we don't accidentally cache cookies
+ $privateCache = $privateCache ?: $this->getUser()->isLoggedIn();
# allow the client to cache this for 24 hours
$mode = $privateCache ? 'private' : 'public';
$response->header( 'Cache-Control: ' . $mode . ', s-maxage=' .
$smaxage . ', max-age=' . $maxage );
diff --git a/includes/specials/SpecialUploadStash.php
b/includes/specials/SpecialUploadStash.php
index ddf0c6d..066dcfc 100644
--- a/includes/specials/SpecialUploadStash.php
+++ b/includes/specials/SpecialUploadStash.php
@@ -303,6 +303,8 @@
header( "Content-Type: $contentType", true );
header( 'Content-Transfer-Encoding: binary', true );
header( 'Expires: Sun, 17-Jan-2038 19:14:07 GMT', true );
+ // Bug 53032 - It shouldn't be a problem here, but let's be
safe and not cache
+ header( 'Cache-Control: private' );
header( "Content-Length: $size", true );
}
--
To view, visit https://gerrit.wikimedia.org/r/95546
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: merged
Gerrit-Change-Id: I8f915f6a4756f750c74d9ee9bec58f7ba6c0c827
Gerrit-PatchSet: 1
Gerrit-Project: mediawiki/core
Gerrit-Branch: REL1_21
Gerrit-Owner: CSteipp <[email protected]>
Gerrit-Reviewer: CSteipp <[email protected]>
Gerrit-Reviewer: jenkins-bot
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
