From da38d057d3ec5e5655335a723b451d81ad600a13 Mon Sep 17 00:00:00 2001 From: Tim Starling Date: Thu, 28 Jan 2021 05:50:00 +0000 Subject: [PATCH] SECURITY: Non-admin deleted enwiki page in fast double move Bug: T272386 --- includes/MovePage.php | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/includes/MovePage.php b/includes/MovePage.php index a5d0af4a10..7c4c3d4049 100644 --- a/includes/MovePage.php +++ b/includes/MovePage.php @@ -216,7 +216,9 @@ class MovePage { if ( $this->oldTitle->equals( $this->newTitle ) ) { $status->fatal( 'selfmove' ); - } elseif ( $this->newTitle->getArticleID() && !$this->isValidMoveTarget() ) { + } elseif ( $this->newTitle->getArticleID( Title::READ_LATEST /* T272386 */ ) + && !$this->isValidMoveTarget() + ) { // The move is allowed only if (1) the target doesn't exist, or (2) the target is a // redirect to the source, and has no history (so we can undo bad moves right after // they're done). -- 2.27.0