r26321 MediaWiki - Code Review archive

Repository:MediaWiki
Revision:r26320‎ | r26321 | r26322 >
Date:18:18, 2 October 2007
Author:brion
Status:old
Tags:
Comment:
Further security fix -- enforce assertions about attached state on the form submission handlers, not just on showing the form.
Ensures that unattached users have to put in the global pass, not their own pass, to attach. :)
Modified paths:
  • /trunk/extensions/CentralAuth/SpecialMergeAccount.php (modified) (history)

Diff [purge]

Index: trunk/extensions/CentralAuth/SpecialMergeAccount.php
@@ -256,6 +256,10 @@
257257 throw new MWException( "User doesn't exist -- race condition?" );
258258 }
259259
 260+ if( !$globalUser->isAttached() ) {
 261+ throw new MWException( "Can't cleanup merge if not already attached." );
 262+ }
 263+
260264 if( $wgCentralAuthDryRun ) {
261265 return $this->dryRunError();
262266 }
@@ -288,6 +292,10 @@
289293 throw new MWException( "User doesn't exist -- race condition?" );
290294 }
291295
 296+ if( $globalUser->isAttached() ) {
 297+ throw new MWException( "Already attached -- race condition?" );
 298+ }
 299+
292300 if( $wgCentralAuthDryRun ) {
293301 return $this->dryRunError();
294302 }

Status & tagging log