https://bugzilla.wikimedia.org/show_bug.cgi?id=25281

           Summary: Privacy issue: ResourceLoader lets you request other
                    user's preferences
           Product: MediaWiki
           Version: 1.17-svn
          Platform: All
        OS/Version: All
            Status: NEW
          Severity: major
          Priority: Normal
         Component: Resource Loader
        AssignedTo: tpars...@wikimedia.org
        ReportedBy: paul.copper...@gmail.com
                CC: roan.katt...@gmail.com


With load.php?modules=user.options&user=OtherUser you can easily retrieve
someone else's preferences including the watchlist token.

Needs a check against $wgUser I think.

-- 
Configure bugmail: https://bugzilla.wikimedia.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

_______________________________________________
Wikibugs-l mailing list
Wikibugs-l@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/wikibugs-l

Reply via email to