Last modified: 2012-08-24 09:32:18 UTC
Created attachment 9975 [details] Trivial patch. Hi, If user does not have "comment" right, hiding edit field is not enough. Sever must also validate user rights and reject comments coming from user with no "comment" right, otherwise smart guys can post comment.
The same issue for voting. See the next function, wfCommentVote: > // Blocked users cannot vote, obviously > if( $wgUser->isBlocked() ) { > return ''; > } Must be > // Blocked users cannot vote, obviously > if( ! $wgUser->isAllowed( 'comment' ) || $wgUser->isBlocked() ) { > return ''; > }
Hmm... Similar issue for other conditions: checking conditions on UI side is not enough. For example, hiding vote buttons at user's own messages is not enough, server side should recheck all the conditions and reject invalid operations. I was able to add a vote to y own messages...
Hey, Van, I'm adding the "patch" and "need-review" keywords here to indicate that the patch awaits review. There's been a bit of a delay in the review of patches here -- as we prepare to get a new version out, we're in a "code slush" during which we concentrate on reviewing code that has already been committed to our source code repository (see http://thread.gmane.org/gmane.science.linguistics.wikipedia.technical/57950 for more details). But we'll try to respond to your contribution soon. Thanks for the patch!
If you provide a fuller patch covering all the conditions you think should be covered, then I can apply it. Please see https://www.mediawiki.org/wiki/How_to_become_a_MediaWiki_hacker#Submit_your_changes for more info on how to do this, if needed.
Thanks for the patch Van, I've committed a patch based on yours to SVN in r115613, which adds user rights checking to two AJAX functions, wfCommentSubmit and wfCommentVote. Now the AJAX interface correctly enforeces user rights and users who do not have the 'comment' user right can no longer submit new comments or vote on existing comments. I believe that this should be about it and I'm suggesting closing this as RESOLVED FIXED, unless new issues pop up.
Hi, I thought process is: If you committed the fix, please move it to RESOLVED state. When I check the fix I will move record to VERIFIED state. Then you can move it to CLOSED.
Closing the bug as the fix has been committed a while ago.
