Maniphest T8171

DataDump Does Not Care About User's Block Status
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	Redmin
	Oct 14 2021, 17:07

Tags

Referenced Files

None

Subscribers

Universal_Omega

Description

If a user has, for example, the delete-dump right, they can delete dumps even if they are blocked.

Event Timeline

Redmin created this task.Oct 14 2021, 17:07

Herald added subscribers: Agent_Isai, Universal_Omega, RhinosF1 and 2 others. · View Herald TranscriptOct 14 2021, 17:07

Redmin added a project: DataDump.Oct 14 2021, 17:07

Herald added projects: Universal Omega, MediaWiki (SRE). · View Herald TranscriptOct 14 2021, 17:07

Redmin moved this task from Backlog to Bugs on the DataDump board.Oct 14 2021, 17:07

Have prepared a patch.

https://github.com/miraheze/DataDump/security/advisories/GHSA-g7rp-6h29-428f - private fork available for sending

In T8171#164714, @RhinosF1 wrote:

https://github.com/miraheze/DataDump/security/advisories/GHSA-g7rp-6h29-428f - private fork available for sending

https://github.com/miraheze/DataDump/security/advisories/GHSA-9vf9-ff5x-vcpc is the correct one.

Universal_Omega closed this task as Resolved.Oct 18 2021, 23:41

Universal_Omega changed the visibility from "Custom Policy" to "Public (No Login Required)".

Universal_Omega changed the edit policy from "Custom Policy" to "All Users".