r48666 MediaWiki - Code Review archive

Repository:MediaWiki
Revision:r48665‎ | r48666 | r48667 >
Date:02:12, 22 March 2009
Author:werdna
Status:ok
Tags:
Comment:
Prevent leaking of filters through diffs
Modified paths:
  • /trunk/extensions/AbuseFilter/AbuseFilter.class.php (modified) (history)
  • /trunk/extensions/AbuseFilter/Views/AbuseFilterViewDiff.php (modified) (history)

Diff [purge]

Index: trunk/extensions/AbuseFilter/Views/AbuseFilterViewDiff.php
@@ -52,6 +52,13 @@
5353 static $dependentSpecs = array( 'prev', 'next' );
5454 static $cache = array();
5555
 56+ global $wgUser;
 57+
 58+ if ( AbuseFilter::filterHidden( $this->mFilter ) &&
 59+ !$wgUser->isAllowed( 'abusefilter-modify' ) ) {
 60+ return null;
 61+ }
 62+
5663 if ( isset( $cache[$spec] ) )
5764 return $cache[$spec];
5865
Index: trunk/extensions/AbuseFilter/AbuseFilter.class.php
@@ -425,12 +425,13 @@
426426 $curCount = $wgMemc->get( $countKey );
427427 $curTotal = $wgMemc->get( $totalKey );
428428
429 - $wgMemc->set( $totalKey, $curTotal + $time, 3600 );
430 -
431 - if ($curCount)
 429+ if ($curCount) {
 430+ $wgMemc->set( $totalKey, $curTotal + $time, 3600 );
432431 $wgMemc->incr( $countKey );
433 - else
 432+ } else {
434433 $wgMemc->set( $countKey, 1, 3600 );
 434+ $wgMemc->set( $totalKey, $time, 3600 );
 435+ }
435436 }
436437
437438 public static function getFilterProfile( $filter ) {
@@ -1259,7 +1260,9 @@
12601261 } else {
12611262 return null;
12621263 }
1263 - $vars->setVar( 'context', 'generated' );
 1264+ if ($vars)
 1265+ $vars->setVar( 'context', 'generated' );
 1266+
12641267 return $vars;
12651268 }
12661269

Status & tagging log