| Index: branches/REL1_12/phase3/includes/User.php |
| — | — | @@ -1762,7 +1762,11 @@ |
| 1763 | 1763 | // In the spirit of DWIM |
| 1764 | 1764 | return true; |
| 1765 | 1765 | |
| 1766 | | - return in_array( $action, $this->getRights() ); |
| | 1766 | + // PHP is stupid. |
| | 1767 | + // > $f = array( 'foo', 'bar', 'baz', 0, 'anne' ); |
| | 1768 | + // > print in_array( 'blah', $f ); |
| | 1769 | + // 1 |
| | 1770 | + return in_array( $action, $this->getRights(), true ); |
| 1767 | 1771 | } |
| 1768 | 1772 | |
| 1769 | 1773 | /** |
| Index: branches/REL1_12/phase3/RELEASE-NOTES |
| — | — | @@ -4,8 +4,9 @@ |
| 5 | 5 | setting since version 1.2.0. If you have it on, turn it *off* if you can. |
| 6 | 6 | |
| 7 | 7 | == MediaWiki 1.12.1 == |
| | 8 | +* Security: Work around misconfiguration by requiring strict comparisons for |
| | 9 | + in_array in User::isAllowed(). |
| 8 | 10 | |
| 9 | | - |
| 10 | 11 | Changes since 1.12.0: |
| 11 | 12 | |
| 12 | 13 | * (bug 13522) Fix fatal error in Parser::extractTagsAndParams |