From ffc9b124d65f8ec8e7f4a986592972ccba3e663b Mon Sep 17 00:00:00 2001 From: Martin Urbanec Date: Sun, 10 Nov 2019 23:11:34 +0100 Subject: [PATCH] SECURITY: Make sure provided filter id match provided history ID in history view AbuseFilterViewEdit does privilege checks based on filter ID, and displays what is hidden under given history ID, but doesn't make sure those two IDs actually belong to one filter. That means user can easily change filter ID to a public filter and view old versions of nowadays private filters. Bug: T237887 Change-Id: Ic12790bd33982473f77551bde9599ed083a3e1f1 --- includes/Views/AbuseFilterViewEdit.php | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/includes/Views/AbuseFilterViewEdit.php b/includes/Views/AbuseFilterViewEdit.php index 8dd4eb7c..46f3cd57 100644 --- a/includes/Views/AbuseFilterViewEdit.php +++ b/includes/Views/AbuseFilterViewEdit.php @@ -157,7 +157,11 @@ class AbuseFilterViewEdit extends AbuseFilterView { // Load from request OR database. list( $row, $actions ) = $this->loadRequest( $filter, $history_id ); - if ( !$row ) { + if ( + !$row || + // @fixme Temporary stopgap for T237887 + ( $history_id && $row->af_id !== $filter ) + ) { $out->addHTML( Xml::tags( 'p', -- 2.17.1