Last modified: 2013-11-15 11:08:18 UTC

Wikimedia Bugzilla is closed!

Wikimedia migrated from Bugzilla to Phabricator. Bug reports are handled in Wikimedia Phabricator.
This static website is read-only and for historical purposes. It is not possible to log in and except for displaying bug reports and their history, links might be broken. See T54404, the corresponding Phabricator task for complete and up-to-date bug report information.

Bug 52404 - Scribunto: Sysop can cause PHP fatal errors, mostly breaking the wiki


Summary:	Scribunto: Sysop can cause PHP fatal errors, mostly breaking the wiki

Status:	RESOLVED FIXED

Product:	MediaWiki extensions
Classification:	Unclassified
Component:	Scribunto (Other open bugs)
Version:	unspecified
Hardware:	All All

Importance:	Unprioritized normal (vote)
Target Milestone:	---
Assigned To:	Brad Jorsch

URL:
Whiteboard:
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Reported:	2013-08-01 16:37 UTC by Brad Jorsch
Modified:	2013-11-15 11:08 UTC (History)
CC List:	5 users (show)

See Also:
Web browser:	---
Mobile Platform:	---
Assignee Huggle Beta Tester:	---

Attachments
Fix the bug (1.12 KB, patch) 2013-08-01 16:37 UTC, Brad Jorsch	Details
Show Obsolete (1) Add an attachment (proposed patch, testcase, etc.)

Description Brad Jorsch 2013-08-01 16:37:51 UTC

Created attachment 13048 [details]
Fix the bug

If bogus text is put into MediaWiki:Scribunto-doc-page-name, it can cause a PHP fatal error in Scribunto::isDocPage:

  Call to a member function getPrefixedText() on a non-object

Since this function is called from the ArticleViewHeader hook, and could be triggered by placing an {{#invoke}} in messages used for other actions, it's a possibility to effectively break the entire site. This is mitigated by the bug requiring the 'editinterface' right, since people who have that should be trustworthy enough to not break things.

Patch to fix it is attached.

Comment 1 Chris Steipp 2013-08-01 17:58:43 UTC

Actually, I think we can address this publicly. There are plenty of ways someone with editinterface could DoS the wiki, so I don't think we probably need to keep this hidden. But thanks for addressing it!

Comment 2 Brad Jorsch 2013-08-22 14:17:33 UTC

Ok, patch in Gerrit momentarily.

Comment 3 Gerrit Notification Bot 2013-08-22 14:17:45 UTC

Change 80376 had a related patch set uploaded by Anomie:
Fix possible fatal error

https://gerrit.wikimedia.org/r/80376

Comment 4 Gerrit Notification Bot 2013-08-22 22:28:28 UTC

Change 80376 merged by jenkins-bot:
Fix possible fatal error

https://gerrit.wikimedia.org/r/80376

Comment 5 Gerrit Notification Bot 2013-11-14 15:20:28 UTC

Change 95416 had a related patch set uploaded by MarkAHershberger:
Fix possible fatal error

https://gerrit.wikimedia.org/r/95416

Comment 6 Gerrit Notification Bot 2013-11-14 16:46:36 UTC

Change 95416 abandoned by MarkAHershberger:
Fix possible fatal error

https://gerrit.wikimedia.org/r/95416

Comment 7 Andre Klapper 2013-11-15 11:08:18 UTC

No open patches to review here (backport patches got abandoned), hence resetting status to RESOLVED FIXED. Backport_to_Stable flag might be set to "-" by hexmode.

Wikimedia Bugzilla is closed!

Search

Personal tools

Navigation

Links