Last modified: 2014-10-08 21:14:03 UTC
This allows non-home owners to take over the homewiki account without knowing the password.
I was wrong... Just lets you attach your account to the homewiki global account, but the global account still gets the homewiki's password. So the attacker still doesn't have access to the global account. Combined with bug 70469, this lets the owner of the homewiki take over an account they don't own, but that's less serious.
Created attachment 16495 [details] Check home wiki password before merge Just like we do in the dry run, check the home wiki's password before doing the actual merge.
Created attachment 16497 [details] Check home wiki password before merge - 1.24 wmf22 Rebased on top of Gerrit change #158578. After this is public, I'll make all those bool flags an options array.
+2, patch looks good. Only thing is we reverted the commit out of 1.24wmf22, so attachment 16495 [details] should go with 1.24wmf22, and attachment 16497 [details] should go with 1.25wmf1 and master.
From SAL: 19:15 AaronS: Deployed security patches to CentralAuth
I put up https://gerrit.wikimedia.org/r/#/c/163225/ as a draft. Apparently there is some wiki farm that uses CA too...so they will have to be notified first before that is merged.
Created attachment 16725 [details] Check home wiki password before merge - 1.24wmf3 (after file reorg)
