[Bug 70584] Security review of GlobalUserPage extension
https://bugzilla.wikimedia.org/show_bug.cgi?id=70584 --- Comment #2 from Chris Steipp cste...@wikimedia.org --- Sorry for the delay on this. Minor nitpick: The default central wiki is an http link, can you make that https, so we encourage that? That ties into the bigger issue with the extension-- The security of the each wiki becomes even more tied to that of the central wiki, since the parse is happening on the remote wiki. So we definitely want to be sure we're talking to the right remote server. But it also opens up some potential attacks that we haven't really had to deal with before. For example: * Someone who can add raw html to a page/template/message on the central wiki can add javascript to the local wiki, for any user. * If a url is blacklisted on the local wiki, but isn't blacklisted on the central wiki, a user can add it centrally and it gets rendered by the local wiki. * A local wiki oversighter can't delete/suppress content on the user page if they don't also have rights on the central wiki. Inside the WMF cluster, I don't think these will have a major impact, but I think https://www.mediawiki.org/wiki/Extension:GlobalUserPage should at least document that enabling this on a wiki means you totally trust the central wiki and the admins there. -- You are receiving this mail because: You are on the CC list for the bug. ___ Wikibugs-l mailing list Wikibugs-l@lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/wikibugs-l
[Bug 70584] Security review of GlobalUserPage extension
https://bugzilla.wikimedia.org/show_bug.cgi?id=70584 --- Comment #3 from Kunal Mehta (Legoktm) legoktm.wikipe...@gmail.com --- (In reply to Chris Steipp from comment #2) Sorry for the delay on this. Minor nitpick: The default central wiki is an http link, can you make that https, so we encourage that? https://gerrit.wikimedia.org/r/173461 That ties into the bigger issue with the extension-- The security of the each wiki becomes even more tied to that of the central wiki, since the parse is happening on the remote wiki. So we definitely want to be sure we're talking to the right remote server. But it also opens up some potential attacks that we haven't really had to deal with before. Yup, though I don't think this extension is opening up any new attack vectors (just new locations) since we already have things like CentralNotice and ForeignFileRepo. For example: * Someone who can add raw html to a page/template/message on the central wiki can add javascript to the local wiki, for any user. * If a url is blacklisted on the local wiki, but isn't blacklisted on the central wiki, a user can add it centrally and it gets rendered by the local wiki. * A local wiki oversighter can't delete/suppress content on the user page if they don't also have rights on the central wiki. They could create a blank userpage and full protect it to get rid of the globaluserpage (assuming oversighter sysop). Inside the WMF cluster, I don't think these will have a major impact, but I think https://www.mediawiki.org/wiki/Extension:GlobalUserPage should at least document that enabling this on a wiki means you totally trust the central wiki and the admins there. https://www.mediawiki.org/w/index.php?title=Extension%3AGlobalUserPagediff=1262378oldid=1141449 Do you want me to expand on the warning with specific examples? -- You are receiving this mail because: You are on the CC list for the bug. ___ Wikibugs-l mailing list Wikibugs-l@lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/wikibugs-l
[Bug 70584] Security review of GlobalUserPage extension
https://bugzilla.wikimedia.org/show_bug.cgi?id=70584 --- Comment #4 from Chris Steipp cste...@wikimedia.org --- (In reply to Kunal Mehta (Legoktm) from comment #3) (In reply to Chris Steipp from comment #2) https://www.mediawiki.org/w/index. php?title=Extension%3AGlobalUserPagediff=1262378oldid=1141449 Do you want me to expand on the warning with specific examples? Good enough, thanks! -- You are receiving this mail because: You are on the CC list for the bug. ___ Wikibugs-l mailing list Wikibugs-l@lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/wikibugs-l
[Bug 70584] Security review of GlobalUserPage extension
https://bugzilla.wikimedia.org/show_bug.cgi?id=70584 Chris Steipp cste...@wikimedia.org changed: What|Removed |Added Status|NEW |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are on the CC list for the bug. ___ Wikibugs-l mailing list Wikibugs-l@lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/wikibugs-l
[Bug 70584] Security review of GlobalUserPage extension
https://bugzilla.wikimedia.org/show_bug.cgi?id=70584 --- Comment #1 from MZMcBride b...@mzmcbride.com --- I'm a bit confused about the status of this bug. Should it be marked assigned? Does Chris have time to do this? -- You are receiving this mail because: You are on the CC list for the bug. ___ Wikibugs-l mailing list Wikibugs-l@lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/wikibugs-l
