From f8594d61b6941bc5d1f6d6885ef5b55cb5704f0e Mon Sep 17 00:00:00 2001 From: Kunal Mehta Date: Thu, 9 Dec 2021 11:06:18 -0800 Subject: [PATCH] SECURITY: Restore check that undo revisions are on the same page This mostly reverts 05f06286f4def575fbde0c4e2df0760460b72f2f. When partial read restrictions are in place, such as $wgWhitelistRead, allowing access to arbitrary revisions without further checks allow unauthorized users to view and enumerate all revisions. EditPage now checks the revisions belong to the same page, with a much clearer comment indicating these checks are security sensitive. This will break the workflow outlined in T58184, but that could be reinstated in the future with better access control checks. Bug: T297322 Change-Id: I9f637a21271fc5e25d2167121ce4f278e05734aa --- includes/EditPage.php | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/includes/EditPage.php b/includes/EditPage.php index ca7deb474a..7998fd01d0 100644 --- a/includes/EditPage.php +++ b/includes/EditPage.php @@ -1303,10 +1303,14 @@ class EditPage implements IEditObject { # Make sure it's the right page, # the revisions exist and they were not deleted. + # These checks are all security sensitive, as allowing access + # to arbitrary revisions bypasses partial visiblity restrictions (T297322). # Otherwise, $content will be left as-is. if ( $undorev !== null && $oldrev !== null && !$undorev->isDeleted( RevisionRecord::DELETED_TEXT ) && - !$oldrev->isDeleted( RevisionRecord::DELETED_TEXT ) + !$oldrev->isDeleted( RevisionRecord::DELETED_TEXT ) && + Title::castFromLinkTarget( $undorev->getPageAsLinkTarget() )->equals( $this->mTitle ) && + Title::castFromLinkTarget( $oldrev->getPageAsLinkTarget() )->equals( $this->mTitle ) ) { if ( WikiPage::hasDifferencesOutsideMainSlot( $undorev, $oldrev ) || !$this->isSupportedContentModel( -- 2.33.1