From 83fc654bfe3e0a85286835e83d9bdacf7b30caed Mon Sep 17 00:00:00 2001 From: Roan Kattouw Date: Fri, 7 Nov 2025 12:29:03 -0800 Subject: [PATCH] SECURITY: Check read permissions in ApiQueryRevisionsBase If the user doesn't have permission to read a page, don't output the content of any revisions associated with that page. Bug: T401053 Change-Id: Ia72aa0cc74cd6bc951135f3c33fe9abbc32b9bac --- includes/Api/ApiQueryRevisionsBase.php | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/includes/Api/ApiQueryRevisionsBase.php b/includes/Api/ApiQueryRevisionsBase.php index 49d3d7227a2..d83e1056264 100644 --- a/includes/Api/ApiQueryRevisionsBase.php +++ b/includes/Api/ApiQueryRevisionsBase.php @@ -524,7 +524,7 @@ abstract class ApiQueryRevisionsBase extends ApiQueryGeneratorBase { $vals['slots'][$role] = $this->extractSlotInfo( $slot, $revDel, $content ); // @todo Move this into extractSlotInfo() (and remove its $content parameter) // when extractDeprecatedContent() is no more. - if ( $content ) { + if ( $content && $this->getAuthority()->authorizeRead( 'read', $revision->getPage() ) ) { /** @var Content $content */ $model = $content->getModel(); $format = $this->slotContentFormats[$role] ?? $content->getDefaultFormat(); @@ -624,6 +624,10 @@ abstract class ApiQueryRevisionsBase extends ApiQueryGeneratorBase { $vals = []; $title = Title::newFromPageIdentity( $revision->getPage() ); + if ( !$this->getAuthority()->authorizeRead( 'read', $title ) ) { + return []; + } + if ( $this->fld_parsetree || ( $this->fld_content && $this->generateXML ) ) { if ( $content->getModel() === CONTENT_MODEL_WIKITEXT ) { /** @var WikitextContent $content */ -- 2.43.0