| Index: trunk/phase3/includes/OutputPage.php |
| — | — | @@ -2029,7 +2029,13 @@ |
| 2030 | 2030 | || ( isset( $wgGroupPermissions['autoconfirmed'][$action] ) && $wgGroupPermissions['autoconfirmed'][$action] ) ) |
| 2031 | 2031 | ) { |
| 2032 | 2032 | $displayReturnto = null; |
| 2033 | | - $returnto = $this->getTitle(); |
| | 2033 | + |
| | 2034 | + # Due to bug 32276, if a user does not have read permissions, |
| | 2035 | + # $this->getTitle() will just give Special:Badtitle, which is |
| | 2036 | + # not especially useful as a returnto parameter. Use the title |
| | 2037 | + # from the request instead, if there was one. |
| | 2038 | + $request = $this->getRequest(); |
| | 2039 | + $returnto = Title::newFromURL( $request->getVal( 'title', '' ) ); |
| 2034 | 2040 | if ( $action == 'edit' ) { |
| 2035 | 2041 | $msg = 'whitelistedittext'; |
| 2036 | 2042 | $displayReturnto = $returnto; |
| — | — | @@ -2043,9 +2049,10 @@ |
| 2044 | 2050 | } |
| 2045 | 2051 | |
| 2046 | 2052 | $query = array(); |
| | 2053 | + |
| 2047 | 2054 | if ( $returnto ) { |
| 2048 | 2055 | $query['returnto'] = $returnto->getPrefixedText(); |
| 2049 | | - $request = $this->getRequest(); |
| | 2056 | + |
| 2050 | 2057 | if ( !$request->wasPosted() ) { |
| 2051 | 2058 | $returntoquery = $request->getValues(); |
| 2052 | 2059 | unset( $returntoquery['title'] ); |
| Index: trunk/phase3/includes/AjaxDispatcher.php |
| — | — | @@ -68,7 +68,7 @@ |
| 69 | 69 | * request. |
| 70 | 70 | */ |
| 71 | 71 | function performAction() { |
| 72 | | - global $wgAjaxExportList, $wgOut; |
| | 72 | + global $wgAjaxExportList, $wgOut, $wgUser; |
| 73 | 73 | |
| 74 | 74 | if ( empty( $this->mode ) ) { |
| 75 | 75 | return; |
| — | — | @@ -84,6 +84,13 @@ |
| 85 | 85 | 'Bad Request', |
| 86 | 86 | "unknown function " . (string) $this->func_name |
| 87 | 87 | ); |
| | 88 | + } elseif ( !in_array( 'read', User::getGroupPermissions( array( '*' ) ), true ) |
| | 89 | + && !$wgUser->isAllowed( 'read' ) ) |
| | 90 | + { |
| | 91 | + wfHttpError( |
| | 92 | + 403, |
| | 93 | + 'Forbidden', |
| | 94 | + 'You must log in to view pages.' ); |
| 88 | 95 | } else { |
| 89 | 96 | wfDebug( __METHOD__ . ' dispatching ' . $this->func_name . "\n" ); |
| 90 | 97 | |
| Index: trunk/phase3/includes/Wiki.php |
| — | — | @@ -133,7 +133,7 @@ |
| 134 | 134 | * @return void |
| 135 | 135 | */ |
| 136 | 136 | private function performRequest() { |
| 137 | | - global $wgServer, $wgUsePathInfo; |
| | 137 | + global $wgServer, $wgUsePathInfo, $wgTitle; |
| 138 | 138 | |
| 139 | 139 | wfProfileIn( __METHOD__ ); |
| 140 | 140 | |
| — | — | @@ -163,6 +163,20 @@ |
| 164 | 164 | // We will check again in Article::view(). |
| 165 | 165 | $permErrors = $title->getUserPermissionsErrors( 'read', $user ); |
| 166 | 166 | if ( count( $permErrors ) ) { |
| | 167 | + // Bug 32276: allowing the skin to generate output with $wgTitle or |
| | 168 | + // $this->context->title set to the input title would allow anonymous users to |
| | 169 | + // determine whether a page exists, potentially leaking private data. In fact, the |
| | 170 | + // curid and oldid request parameters would allow page titles to be enumerated even |
| | 171 | + // when they are not guessable. So we reset the title to Special:Badtitle before the |
| | 172 | + // permissions error is displayed. |
| | 173 | + // |
| | 174 | + // The skin mostly uses $this->context->getTitle() these days, but some extensions |
| | 175 | + // still use $wgTitle. |
| | 176 | + |
| | 177 | + $badTitle = SpecialPage::getTitleFor( 'Badtitle' ); |
| | 178 | + $this->context->setTitle( $badTitle ); |
| | 179 | + $wgTitle = $badTitle; |
| | 180 | + |
| 167 | 181 | wfProfileOut( __METHOD__ ); |
| 168 | 182 | throw new PermissionsError( 'read', $permErrors ); |
| 169 | 183 | } |
| Index: trunk/phase3/includes/SkinTemplate.php |
| — | — | @@ -544,11 +544,19 @@ |
| 545 | 545 | /* set up the default links for the personal toolbar */ |
| 546 | 546 | $personal_urls = array(); |
| 547 | 547 | |
| 548 | | - $page = $request->getVal( 'returnto', $this->thispage ); |
| 549 | | - $query = $request->getVal( 'returntoquery', $this->thisquery ); |
| 550 | | - $a = array( 'returnto' => $page ); |
| 551 | | - if( $query != '' ) { |
| 552 | | - $a['returntoquery'] = $query; |
| | 548 | + # Due to bug 32276, if a user does not have read permissions, |
| | 549 | + # $this->getTitle() will just give Special:Badtitle, which is |
| | 550 | + # not especially useful as a returnto parameter. Use the title |
| | 551 | + # from the request instead, if there was one. |
| | 552 | + $page = Title::newFromURL( $request->getVal( 'title', '' ) ); |
| | 553 | + $page = $request->getVal( 'returnto', $page ); |
| | 554 | + $a = array(); |
| | 555 | + if ( strval( $page ) !== '' ) { |
| | 556 | + $a['returnto'] = $page; |
| | 557 | + $query = $request->getVal( 'returntoquery', $this->thisquery ); |
| | 558 | + if( $query != '' ) { |
| | 559 | + $a['returntoquery'] = $query; |
| | 560 | + } |
| 553 | 561 | } |
| 554 | 562 | $returnto = wfArrayToCGI( $a ); |
| 555 | 563 | if( $this->loggedin ) { |