r76080 MediaWiki - Code Review archive

Repository:MediaWiki
Revision:< r76079‎ | r76080 | r76081 >
Date:11:54, 5 November 2010
Author:catrope
Status:ok
Tags:
Comment:
Revert r76077, r76079, they were an overreaction to a security bug that wasn't really a security issue at all. The API will currently echo your session cookie back at you, but an attacker can only read that output using same-domain AJAX, and if they can do that they can do worse things (and steal the user's session in easier ways).
Modified paths:
  • /trunk/phase3/RELEASE-NOTES (modified) (history)
  • /trunk/phase3/includes/api/ApiLogin.php (modified) (history)

Diff [purge]

Index: trunk/phase3/includes/api/ApiLogin.php
——@@ -87,12 +87,14 @@
8888 $result['lgusername'] = $wgUser->getName();
8989 $result['lgtoken'] = $wgUser->getToken();
9090 $result['cookieprefix'] = $wgCookiePrefix;
 91+ $result['sessionid'] = session_id();
9192 break;
9293
9394 case LoginForm::NEED_TOKEN:
9495 $result['result'] = 'NeedToken';
9596 $result['token'] = $loginForm->getLoginToken();
9697 $result['cookieprefix'] = $wgCookiePrefix;
 98+ $result['sessionid'] = session_id();
9799 break;
98100
99101 case LoginForm::WRONG_TOKEN:
Index: trunk/phase3/RELEASE-NOTES
——@@ -490,8 +490,6 @@
491491 * (bug 25741) Add more data to list=search's srprop
492492 * (bug 25760) counter property still reported by the API when
493493 $wgDisableCounters enabled
494 -* (bug 25793) Session IDs no longer output by action=login to protect against
495 - session hijacking
496494
497495 === Languages updated in 1.17 ===
498496

Past revisions this follows-up on

RevisionCommit summaryAuthorDate
r76077(bug 25793) Don't output the session ID over HTTP, allows session hijacking b...catrope11:42, 5 November 2010
r76079RELEASE-NOTES for r76077catrope11:48, 5 November 2010

Status & tagging log