Page MenuHomeMiraheze
Create Task
Maniphest T2011

CentralAuth vulnerability
Closed, ResolvedPublic
Actions

Description

https://www.mail-archive.com/mediawiki-l@lists.wikimedia.org/msg17415.html

  1. XSS in Special:GlobalGroupPermissions (

https://phabricator.wikimedia.org/T134863 )

  1. Open redirect in AutoLogin ( https://phabricator.wikimedia.org/T134931 )

We'll need to update ASAP.

Details

From Email
Yongmin Hong <revi@pobox.com>

Related Objects

Event Timeline

revi created this task.Jul 19 2017, 07:03
revi updated the task description. (Show Details)
revi subscribed.
Herald added subscribers: Southparkfan, Brynda1231. · View Herald TranscriptJul 19 2017, 07:03
revi added projects: MediaWiki, acl*security, revi.Jul 19 2017, 07:04
Herald added subscribers: Void, ImBoPhil, Reception123, NDKilla. · View Herald TranscriptJul 19 2017, 07:04
Reception123 added a comment.Jul 19 2017, 07:12

I'll update the extension on the REL1_29 branch, but it won't be in effect until T1827 is done.

Reception123 added a comment.Jul 19 2017, 07:13

Oh, wait. It got backported to REL1_28 so it will be possible after all.

Reception123 added a comment.Jul 19 2017, 08:35

REL1_28 branch updated.

REL1_29 is missing the last update from upstream, I will update that as well as soon as it's upstream updates it

John subscribed.Jul 19 2017, 14:31

1.29 has all the security changes.

Reception123 added a comment.Jul 19 2017, 14:38
This comment was removed by Reception123.
Reception123 closed this task as Resolved.Jul 19 2017, 14:42
Reception123 claimed this task.

Oh, it was added previously, so then it's already there.

Therefore this issue is resolved.

revi moved this task from Incoming to misc-mediawiki on the revi board.Dec 4 2017, 16:38
Herald added a subscriber: CnocBride. · View Herald TranscriptDec 4 2017, 16:38
• Rappy_4187 reopened this task as Open.Aug 12 2018, 08:58
• Rappy_4187 removed Reception123 as the assignee of this task.
• Rappy_4187 triaged this task as Unbreak Now! priority.
• Rappy_4187 added projects: ACL*Code of Conduct Commission, Amanda Catherine.
Reception123 closed this task as Resolved.Aug 12 2018, 10:01
Reception123 claimed this task.
Reception123 lowered the priority of this task from Unbreak Now! to Normal.
Reception123 removed projects: Amanda Catherine, ACL*Code of Conduct Commission.