Revision: 48485
Author: werdna
Date: 2009-03-17 13:18:33 +0000 (Tue, 17 Mar 2009)
Log Message:
-----------
Prevent leaking of hidden filters through history interface.
Modified Paths:
--------------
trunk/extensions/AbuseFilter/AbuseFilter.class.php
trunk/extensions/AbuseFilter/AbuseFilter.i18n.php
trunk/extensions/AbuseFilter/Views/AbuseFilterViewHistory.php
Modified: trunk/extensions/AbuseFilter/AbuseFilter.class.php
===================================================================
--- trunk/extensions/AbuseFilter/AbuseFilter.class.php 2009-03-17 09:40:33 UTC
(rev 48484)
+++ trunk/extensions/AbuseFilter/AbuseFilter.class.php 2009-03-17 13:18:33 UTC
(rev 48485)
@@ -202,6 +202,16 @@
return strval($row->af_pattern);
}
+
+ public static function filterHidden( $filter ) {
+ $dbr = wfGetDB( DB_SLAVE );
+ $hidden = $dbr->selectField( 'abuse_filter',
+ 'af_hidden',
+ array( 'af_id'
=> $filter ),
+ __METHOD__
+ );
+ return $hidden ? true : false;
+ }
public static function ajaxCheckFilterWithVars( $filter, $vars ) {
global $wgUser;
Modified: trunk/extensions/AbuseFilter/AbuseFilter.i18n.php
===================================================================
--- trunk/extensions/AbuseFilter/AbuseFilter.i18n.php 2009-03-17 09:40:33 UTC
(rev 48484)
+++ trunk/extensions/AbuseFilter/AbuseFilter.i18n.php 2009-03-17 13:18:33 UTC
(rev 48485)
@@ -301,6 +301,7 @@
'abusefilter-history-select-user' => 'User:',
'abusefilter-history-select-submit' => 'Refine',
'abusefilter-history-diff' => 'Changes',
+ 'abusefilter-history-error-hidden' => 'The filter you requested is
hidden, and you cannot view its history.',
// Exceptions
'abusefilter-exception-unexpectedatend' => 'Unexpected "$2" at
character $1.',
Modified: trunk/extensions/AbuseFilter/Views/AbuseFilterViewHistory.php
===================================================================
--- trunk/extensions/AbuseFilter/Views/AbuseFilterViewHistory.php
2009-03-17 09:40:33 UTC (rev 48484)
+++ trunk/extensions/AbuseFilter/Views/AbuseFilterViewHistory.php
2009-03-17 13:18:33 UTC (rev 48485)
@@ -21,9 +21,17 @@
$wgOut->setPageTitle( wfMsg( 'abusefilter-history',
$filter ) );
else
$wgOut->setPageTitle( wfMsg( 'abusefilter-filter-log' )
);
+
+ ## Check perms
+ if ( $filter &&
+ !$wgUser->isAllowed( 'abusefilter-modify' ) &&
+ AbuseFilter::filterHidden( $filter ) ) {
+ $wgOut->addWikiMsg( 'abusefilter-history-error-hidden'
);
+ return;
+ }
+ ## Useful links
$sk = $wgUser->getSkin();
-
$links = array();
if ($filter)
$links['abusefilter-history-backedit'] =
$this->getTitle( $filter );
@@ -35,12 +43,14 @@
$backlinks = $wgLang->pipeList( $links );
$wgOut->addHTML( Xml::tags( 'p', null, $backlinks ) );
+ ## For user
$user = $wgRequest->getText( 'user' );
if ($user) {
$wgOut->setSubtitle(
wfMsg(
'abusefilter-history-foruser',
- $sk->userLink( 1 /* We don't really
need to get a user ID */, $user )
+ $sk->userLink( 1 /* We don't really
need to get a user ID */, $user ),
+ $user // For GENDER
)
);
}
@@ -187,31 +197,47 @@
function getQueryInfo() {
$info = array(
- 'tables' => 'abuse_filter_history',
+ 'tables' => array( 'abuse_filter_history',
'abuse_filter' ),
'fields' => array(
- 'afh_filter',
- 'afh_timestamp',
- 'afh_user_text',
- 'afh_public_comments',
- 'afh_flags',
- 'afh_comments',
- 'afh_actions',
- 'afh_id',
- 'afh_user',
- 'afh_changed_fields',
- 'afh_pattern',
- 'afh_id' ),
+ 'afh_filter',
+ 'afh_timestamp',
+ 'afh_user_text',
+ 'afh_public_comments',
+ 'afh_flags',
+ 'afh_comments',
+ 'afh_actions',
+ 'afh_id',
+ 'afh_user',
+ 'afh_changed_fields',
+ 'afh_pattern',
+ 'afh_id',
+ 'af_hidden'
+ ),
'conds' => array(),
+ 'join_conds' => array(
+ 'abuse_filter' =>
+ array(
+ 'LEFT JOIN',
+ 'afh_filter=af_id',
+ ),
+ ),
);
- global $wgRequest;
+ global $wgRequest, $wgUser;
+
if ($this->mUser) {
$info['conds']['afh_user_text'] = $this->mUser;
}
+
if ( $this->mFilter ) {
$info['conds']['afh_filter'] = $this->mFilter;
}
+ if ( !$wgUser->isAllowed( 'abusefilter-modify' ) ) {
+ // Hide data the user can't see.
+ $info['conds']['af_hidden'] = 0;
+ }
+
return $info;
}
_______________________________________________
MediaWiki-CVS mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-cvs
