Last modified: 2014-10-08 21:14:15 UTC

Wikimedia Bugzilla is closed!

Wikimedia migrated from Bugzilla to Phabricator. Bug reports are handled in Wikimedia Phabricator.
This static website is read-only and for historical purposes. It is not possible to log in and except for displaying bug reports and their history, links might be broken. See T72469, the corresponding Phabricator task for complete and up-to-date bug report information.

Bug 70469 - CentralAuth MergeAccount doesn't check edit token


Summary:	CentralAuth MergeAccount doesn't check edit token

Attachments
patch (986 bytes, patch) 2014-09-06 02:01 UTC, Kunal Mehta (Legoktm)	Details
Patch after file reorg (1022 bytes, patch) 2014-10-08 21:01 UTC, Chris Steipp	Details
Add an attachment (proposed patch, testcase, etc.)

Description Chris Steipp 2014-09-05 22:03:37 UTC

Special:MergeAccount puts an edit token in all of the forms, but never checks that they are valid.

Comment 1 Kunal Mehta (Legoktm) 2014-09-06 02:01:54 UTC

Created attachment 16390 [details]
patch

Comment 2 Chris Steipp 2014-09-16 19:20:04 UTC

Working fine in my testing, and fixes the problem. I'll get this deployed.

Comment 3 Tim Starling 2014-09-24 03:23:19 UTC

Privately cherry picked from 1.24wmf21 to 1.24wmf22.

Comment 4 Chris Steipp 2014-10-08 21:01:07 UTC

Created attachment 16723 [details]
Patch after file reorg