From d21b3eb46fd42725ae21acde92b169f4568923bd Mon Sep 17 00:00:00 2001 From: SomeRandomDeveloper Date: Sun, 3 Aug 2025 02:55:08 +0200 Subject: [PATCH] SECURITY: Check read permissions in ApiQueryRevisionsBase list=allrevisions and other lists inheriting from ApiQueryRevisionsBase can be used to bypass read restrictions set by the Lockdown extensions. Bug: T401053 Change-Id: I7fc6b201181ca9d1a87572617987b9994db58f99 --- includes/api/ApiQueryRevisionsBase.php | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/includes/api/ApiQueryRevisionsBase.php b/includes/api/ApiQueryRevisionsBase.php index 0d7fe95b1c0..621954936fc 100644 --- a/includes/api/ApiQueryRevisionsBase.php +++ b/includes/api/ApiQueryRevisionsBase.php @@ -538,6 +538,8 @@ abstract class ApiQueryRevisionsBase extends ApiQueryGeneratorBase { // @todo Move this into extractSlotInfo() (and remove its $content parameter) // when extractDeprecatedContent() is no more. if ( $content ) { + $this->checkTitleUserPermissions( $revision->getPage(), 'read' ); + /** @var Content $content */ $model = $content->getModel(); $format = $this->slotContentFormats[$role] ?? $content->getDefaultFormat(); @@ -637,6 +639,8 @@ abstract class ApiQueryRevisionsBase extends ApiQueryGeneratorBase { $vals = []; $title = Title::newFromPageIdentity( $revision->getPage() ); + $this->checkTitleUserPermissions( $title, 'read' ); + if ( $this->fld_parsetree || ( $this->fld_content && $this->generateXML ) ) { if ( $content->getModel() === CONTENT_MODEL_WIKITEXT ) { /** @var WikitextContent $content */ -- 2.50.1