https://bugzilla.wikimedia.org/show_bug.cgi?id=18394
Summary: img_auth.php should use userCan
Product: MediaWiki
Version: 1.14-svn
Platform: All
OS/Version: All
Status: NEW
Severity: enhancement
Priority: Normal
Component: Page protection
AssignedTo: [email protected]
ReportedBy: [email protected]
If somebody is using img_auth, then they very likely are using userCan hook.
Just needs one line addition (sorry for not providing the patch as attachment):
if (!$title->userCanRead()) wfForbidden();
AFTER:
$title = Title::makeTitleSafe( NS_FILE, $name );
if( !$title instanceof Title ) {
wfDebugLog( 'img_auth', "Unable to construct a valid Title from
`{$name}`" );
wfForbidden();
}
--
Configure bugmail: https://bugzilla.wikimedia.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
You are on the CC list for the bug.
_______________________________________________
Wikibugs-l mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/wikibugs-l
