From 2e8ec0a5d41fe84d4870d1d05e7d1204d88c7a6b Mon Sep 17 00:00:00 2001 From: Roan Kattouw Date: Fri, 7 Nov 2025 12:06:48 -0800 Subject: [PATCH] SECURITY: Check read permissions in ApiQueryAllRevisions Other API modules throw an error when trying to look at revisions of pages that the user doesn't have read permissions for. That doesn't make as much sense for list=allrevisions since it enumerates all revisions and could trigger this error just based on a restricted page having been edited recently. So instead, silently drop results from restricted pages. Bug: T401053 Change-Id: Ic28e12c5731c90b707aef0b243f6399765062f69 --- includes/Api/ApiQueryAllRevisions.php | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/includes/Api/ApiQueryAllRevisions.php b/includes/Api/ApiQueryAllRevisions.php index 485f5b9b033..7ba081321ba 100644 --- a/includes/Api/ApiQueryAllRevisions.php +++ b/includes/Api/ApiQueryAllRevisions.php @@ -218,6 +218,12 @@ class ApiQueryAllRevisions extends ApiQueryRevisionsBase { continue; } + $title = Title::newFromRow( $row ); + if ( !$this->getAuthority()->authorizeRead( 'read', $title ) ) { + // If the user doesn't have permission to read this title, pretend it doesn't exist + continue; + } + if ( $resultPageSet !== null ) { if ( $params['generatetitles'] ) { $generated[$row->rev_page] = $row->rev_page; @@ -225,13 +231,12 @@ class ApiQueryAllRevisions extends ApiQueryRevisionsBase { $generated[] = $row->rev_id; } } else { - $revision = $this->revisionStore->newRevisionFromRow( $row, 0, Title::newFromRow( $row ) ); + $revision = $this->revisionStore->newRevisionFromRow( $row, 0, $title ); $rev = $this->extractRevisionInfo( $revision, $row ); if ( !isset( $pageMap[$row->rev_page] ) ) { $index = $nextIndex++; $pageMap[$row->rev_page] = $index; - $title = Title::newFromPageIdentity( $revision->getPage() ); $a = [ 'pageid' => $title->getArticleID(), 'revisions' => [ $rev ], -- 2.43.0