Page MenuHomePhabricator
Create Task
Maniphest T30449

Unauthorised access to transwiki import
Closed, ResolvedPublic
Actions

Description

MediaWiki developer Happy-Melon discovered that the transwiki import feature ($wgImportSources) neglected to perform access control checks on form submission. Access control checks were only done before form display. Thus, a specially constructed POST request could be used to perform transwiki import without proper authorisation.

Transwiki import is not enabled by default. When it is enabled, it allows wiki pages to be copied from the wikis listed in $wgImportSources in LocalSettings.php.

Version: 1.16.x
Severity: normal

Details

Reference
bz28449

Event Timeline

• bzimport raised the priority of this task from to Medium.Nov 21 2014, 11:35 PM
• bzimport added a project: MediaWiki-Core-Snapshots.
• bzimport set Reference to bz28449.
• bzimport added a subscriber: Unknown Object (MLST).
tstarling created this task.Apr 7 2011, 3:27 AM
• bzimport added a comment.Apr 7 2011, 10:13 AM

happy.melon.wiki wrote:

This was fixed in r85005 and r85099; it has been ported to the 1.17, 1.17wmf1 and 1.16 branches.

• csteipp added a project: acl*security.Mar 26 2015, 8:39 PM
• chasemp added a project: Security.Feb 10 2020, 10:59 PM
• chasemp removed a project: acl*security.Feb 20 2020, 8:18 PM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL