r50368 MediaWiki - Code Review archive

Repository:MediaWiki
Revision:r50367‎ | r50368 | r50369 >
Date:14:00, 9 May 2009
Author:btongminh
Status:ok (Comments)
Tags:
Comment:
Verify IP whitelisting on login and account creation as well.
Modified paths:
  • /trunk/extensions/ConfirmEdit/ConfirmEdit_body.php (modified) (history)

Diff [purge]

Index: trunk/extensions/ConfirmEdit/ConfirmEdit_body.php
@@ -214,6 +214,22 @@
215215 }
216216
217217 /**
 218+ * Check if the IP is allowed to skip captchas
 219+ */
 220+ function isIPWhitelisted() {
 221+ global $wgCaptchaWhitelistIP;
 222+ if( !empty( $wgCaptchaWhitelistIP ) ) {
 223+ $ip = wfGetIp();
 224+ foreach ( $wgCaptchaWhitelistIP as $range ) {
 225+ if ( IP::isInRange( $ip, $range ) ) {
 226+ return true;
 227+ }
 228+ }
 229+ }
 230+ return false;
 231+ }
 232+
 233+ /**
218234 * Internal cache key for badlogin checks.
219235 * @return string
220236 * @access private
@@ -268,15 +284,8 @@
269285 wfDebug( "ConfirmEdit: user group allows skipping captcha\n" );
270286 return false;
271287 }
272 - global $wgCaptchaWhitelistIP;
273 - if( !empty( $wgCaptchaWhitelistIP ) ) {
274 - $ip = wfGetIp();
275 - foreach ( $wgCaptchaWhitelistIP as $range ) {
276 - if ( IP::isInRange( $ip, $range ) ) {
277 - return false;
278 - }
279 - }
280 - }
 288+ if( $this->isIPWhitelisted() )
 289+ return false;
281290
282291
283292 global $wgEmailAuthentication, $ceAllowConfirmedEmail;
@@ -523,6 +532,9 @@
524533 wfDebug( "ConfirmEdit: user group allows skipping captcha on account creation\n" );
525534 return true;
526535 }
 536+ if( $this->isIPWhitelisted() )
 537+ return true;
 538+
527539 $this->trigger = "new account '" . $u->getName() . "'";
528540 if( !$this->passCaptcha() ) {
529541 $message = wfMsg( 'captcha-createaccount-fail' );
@@ -540,6 +552,9 @@
541553 */
542554 function confirmUserLogin( $u, $pass, &$retval ) {
543555 if( $this->isBadLoginTriggered() ) {
 556+ if( $this->isIPWhitelisted() )
 557+ return true;
 558+
544559 $this->trigger = "post-badlogin login '" . $u->getName() . "'";
545560 if( !$this->passCaptcha() ) {
546561 $message = wfMsg( 'captcha-badlogin-fail' );

Comments

#Comment by Brion VIBBER (talk | contribs)   17:40, 11 May 2009

This looks like it would disable captcha rate limiting for login attempts when logged in with a privileged IP. This seems a little sketchy to me?

#Comment by Bryan (talk | contribs)   21:19, 12 May 2009

Isn't that the whole point of privileging an IP?

Status & tagging log