From 861b97d96b59e513663fdd08754777f472a3d5f8 Mon Sep 17 00:00:00 2001
From: Martin Urbanec <martin.urbanec@wikimedia.cz>
Date: Sun, 10 Nov 2019 23:11:34 +0100
Subject: [PATCH] SECURITY: Make sure provided filter id match provided history
 ID in history view

AbuseFilterViewEdit does privilege checks based on filter ID,
and displays what is hidden under given history ID, but doesn't
make sure those two IDs actually belong to one filter.

That means user can easily change filter ID to a public
filter and view old versions of nowadays private filters.

Bug: T237887
Change-Id: Ic12790bd33982473f77551bde9599ed083a3e1f1
---
 includes/Views/AbuseFilterViewEdit.php | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/includes/Views/AbuseFilterViewEdit.php b/includes/Views/AbuseFilterViewEdit.php
index 8dd4eb7c..26d3cd75 100644
--- a/includes/Views/AbuseFilterViewEdit.php
+++ b/includes/Views/AbuseFilterViewEdit.php
@@ -156,6 +156,10 @@ class AbuseFilterViewEdit extends AbuseFilterView {
 
 		// Load from request OR database.
 		list( $row, $actions ) = $this->loadRequest( $filter, $history_id );
+		if ( $row->af_id !== $filter ) {
+			throw new MWException( "Filter ID $history_id doesn't match filter ID $filter" );
+			return;
+		}
 
 		if ( !$row ) {
 			$out->addHTML(
-- 
2.17.1