Gergő Tisza has uploaded a new change for review.
https://gerrit.wikimedia.org/r/318025
Change subject: Do not return unsafe users from CentralIdLookup::checkAudience()
......................................................................
Do not return unsafe users from CentralIdLookup::checkAudience()
It would result in an infinite loop when the lookup is performed
in a session provider.
Bug: T149150
Change-Id: I8fb79f8ca5eca43d4e109e40b36c886795f7700e
---
M includes/user/CentralIdLookup.php
M tests/phpunit/includes/user/CentralIdLookupTest.php
2 files changed, 15 insertions(+), 1 deletion(-)
git pull ssh://gerrit.wikimedia.org:29418/mediawiki/core
refs/changes/25/318025/1
diff --git a/includes/user/CentralIdLookup.php
b/includes/user/CentralIdLookup.php
index 2ced6e2..7809e7b 100644
--- a/includes/user/CentralIdLookup.php
+++ b/includes/user/CentralIdLookup.php
@@ -20,6 +20,8 @@
* @file
*/
+use MediaWiki\Logger\LoggerFactory;
+
/**
* The CentralIdLookup service allows for connecting local users with
* cluster-wide IDs.
@@ -86,7 +88,13 @@
*/
protected function checkAudience( $audience ) {
if ( $audience instanceof User ) {
- return $audience;
+ if ( !$audience->isSafeToLoad() ) {
+ LoggerFactory::getInstance( 'centralid'
)->warning( 'unsafe user passed to '
+ . __METHOD__ );
+ return new User;
+ } else {
+ return $audience;
+ }
}
if ( $audience === self::AUDIENCE_PUBLIC ) {
return new User;
diff --git a/tests/phpunit/includes/user/CentralIdLookupTest.php
b/tests/phpunit/includes/user/CentralIdLookupTest.php
index feac641..592f52f 100644
--- a/tests/phpunit/includes/user/CentralIdLookupTest.php
+++ b/tests/phpunit/includes/user/CentralIdLookupTest.php
@@ -54,6 +54,12 @@
$this->assertNull( $mock->checkAudience(
CentralIdLookup::AUDIENCE_RAW ) );
+ $unsafeUser = $this->getMock( 'User' );
+ $unsafeUser->expects( $this->any() )->method( 'isSafeToLoad'
)->willReturn( false );
+ $user = $mock->checkAudience( $unsafeUser );
+ $this->assertSame( 0, $user->getId() );
+ $this->assertNotSame( $unsafeUser, $user );
+
try {
$mock->checkAudience( 100 );
$this->fail( 'Expected exception not thrown' );
--
To view, visit https://gerrit.wikimedia.org/r/318025
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: newchange
Gerrit-Change-Id: I8fb79f8ca5eca43d4e109e40b36c886795f7700e
Gerrit-PatchSet: 1
Gerrit-Project: mediawiki/core
Gerrit-Branch: master
Gerrit-Owner: Gergő Tisza <gti...@wikimedia.org>
_______________________________________________
MediaWiki-commits mailing list
MediaWiki-commits@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
