r2980 MediaWiki - Code Review archive

Repository:MediaWiki
Revision:r2979‎ | r2980 | r2981 >
Date:01:25, 6 April 2004
Author:timstarling
Status:old
Tags:
Comment:
Cryptographic security in Special:Blockme, in response to reports of abuse
Modified paths:
  • /trunk/phase3/config/index.php (modified) (history)
  • /trunk/phase3/includes/DefaultSettings.php (modified) (history)
  • /trunk/phase3/includes/EditPage.php (modified) (history)
  • /trunk/phase3/includes/SpecialBlockme.php (modified) (history)

Diff [purge]

Index: trunk/phase3/config/index.php
@@ -620,6 +620,7 @@
621621 $convert = ($conf->ImageMagick ? $conf->ImageMagick : "/usr/bin/convert" );
622622 $pretty = ($conf->prettyURLs ? "" : "# ");
623623 $ugly = ($conf->prettyURLs ? "# " : "");
 624+ $proxyKey = Parser::getRandomString() . Parser::getRandomString();
624625
625626 $sep = (DIRECTORY_SEPARATOR == "\\") ? ";" : ":";
626627 return "
@@ -703,6 +704,7 @@
704705
705706 \$wgLanguageCode = \"{$conf->LanguageCode}\";
706707 " . ($conf->Encoding ? "\$wgInputEncoding = \$wgOutputEncoding = \"{$conf->Encoding}\";" : "" ) . "
 708+\$wgProxyKey = $proxyKey;
707709
708710 ";
709711 }
Index: trunk/phase3/includes/DefaultSettings.php
@@ -150,6 +150,7 @@
151151 $wgProxyPorts = array( 80, 81, 1080, 3128, 6588, 8000, 8080, 8888, 65506 );
152152 $wgProxyScriptPath = "$IP/proxy_check.php";
153153 $wgProxyMemcExpiry = 86400;
 154+$wgProxyKey = "W1svekXc5u6lZllTZOwnzEk1nbs";
154155
155156 # Client-side caching:
156157 $wgCachePages = true; # Allow client-side caching of pages
Index: trunk/phase3/includes/SpecialBlockme.php
@@ -1,17 +1,17 @@
22 <?php
33 function wfSpecialBlockme()
44 {
5 - global $wgIP, $wgBlockOpenProxies, $wgOut;
 5+ global $wgIP, $wgBlockOpenProxies, $wgOut, $wgProxyKey;
66
7 - if ( !$wgBlockOpenProxies ) {
 7+ if ( !$wgBlockOpenProxies || $_REQUEST['ip'] != md5( $wgIP . $wgProxyKey ) ) {
88 $wgOut->addWikiText( wfMsg( "disabled" ) );
99 return;
10 - }
 10+ }
1111
1212 $blockerName = wfMsg( "proxyblocker" );
1313 $reason = wfMsg( "proxyblockreason" );
1414 $success = wfMsg( "proxyblocksuccess" );
15 -
 15+
1616 $u = User::newFromName( $blockerName );
1717 $id = $u->idForName();
1818 if ( !$id ) {
Index: trunk/phase3/includes/EditPage.php
@@ -445,14 +445,16 @@
446446 # Fork the processes
447447 if ( !$skip ) {
448448 $title = Title::makeTitle( NS_SPECIAL, "Blockme" );
449 - $url = $title->getFullURL();
 449+ $iphash = md5( $wgIP . $wgProxyKey );
 450+ $url = wfFullUrl( $title->getPrefixedURL(), "ip=$iphash" );
 451+
450452 foreach ( $wgProxyPorts as $port ) {
451453 $params = implode( " ", array(
452 - escapeshellarg( $wgProxyScriptPath ),
453 - escapeshellarg( $wgIP ),
454 - escapeshellarg( $port ),
455 - escapeshellarg( $url )
456 - ));
 454+ escapeshellarg( $wgProxyScriptPath ),
 455+ escapeshellarg( $wgIP ),
 456+ escapeshellarg( $port ),
 457+ escapeshellarg( $url )
 458+ ));
457459 exec( "php $params &>/dev/null &" );
458460 }
459461 # Set MemCached key

Status & tagging log