Page MenuHomePhabricator

Changing email address throws Exception due to bad return value from "logPrefsHook" (live hack)
Closed, ResolvedPublic

Description

Author: tomasz.sienicki

Description:
Any attempt to change the email address in preferences results in the following error:

#0 /usr/local/apache/common-local/php-1.5/includes/SpecialPreferences.php(336): wfRunHooks('PrefsEmailAudit', Array)
#1 /usr/local/apache/common-local/php-1.5/includes/SpecialPreferences.php(117): PreferencesForm->savePreferences()
#2 /usr/local/apache/common-local/php-1.5/includes/SpecialPreferences.php(14): PreferencesForm->execute()
#3 /usr/local/apache/common-local/php-1.5/includes/SpecialPage.php(653): wfSpecialPreferences(NULL, Object(SpecialPage))
#4 /usr/local/apache/common-local/php-1.5/includes/SpecialPage.php(459): SpecialPage->execute(NULL)
#5 /usr/local/apache/common-local/php-1.5/includes/Wiki.php(203): SpecialPage::executePath(Object(Title))
#6 /usr/local/apache/common-local/php-1.5/includes/Wiki.php(45): MediaWiki->initializeSpecialCases(Object(Title), Object(OutputPage), Object(WebRequest))
#7 /usr/local/apache/common-local/php-1.5/index.php(89): MediaWiki->initialize(Object(Title), Object(OutputPage), Object(User), Object(WebRequest))
#8 /usr/local/apache/common-local/live-1.5/index.php(3): require('/usr/local/apac...')
#9 {main}


Version: unspecified
Severity: major

Details

Reference
bz10388

Event Timeline

bzimport raised the priority of this task from to High.Nov 21 2014, 9:53 PM
bzimport set Reference to bz10388.
bzimport added a subscriber: Unknown Object (MLST).

tomasz.sienicki wrote:

The error header is: "Invalid NULL return from broken hook logPrefsEmail".

ayg wrote:

Never mind, confirmed on English Wikipedia.

ayg wrote:

I can't find any use of that hook anywhere in trunk. Either I'm blind or this is a non-versioned hack of some sort. If I had to guess I'd suspect it's something related to the recent password-cracking issue, with e-mail and password changes being privately logged. Thus it presumably escaped the crackdown on improper returns just now.

robchur wrote:

It appears to be a live hack. Bumping to shell attention.