https://bugzilla.wikimedia.org/show_bug.cgi?id=63282

--- Comment #3 from Bawolff (Brian Wolff) <[email protected]> ---
(In reply to Stephan Matthiesen from comment #2)
> (In reply to Bawolff (Brian Wolff) from comment #1)
> > Maybe private only wikis cause api to be disabled.
> 
> API is not disabled completely. All other API calls seem to work, only image
> search is affected.
> 
> The following workaround in LocalSettings.php also works:
> 
> if ( strpos($_SERVER['REQUEST_URI'], "prop=imageinfo") > 0 ) {
>     $wgGroupPermissions['*']['read'] = true;
> }
> 
> This disables read protection selectively for the image search.

Actually that can be exploited to get around read protection everywhere
(including normal web requests). Any url can have that string in it.

-- 
You are receiving this mail because:
You are the assignee for the bug.
You are on the CC list for the bug.
_______________________________________________
Wikibugs-l mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/wikibugs-l

Reply via email to