jenkins-bot has submitted this change and it was merged. Change subject: Validate $type variable to prevent accidental injection ......................................................................
Validate $type variable to prevent accidental injection Change-Id: I97bd6344580831057fe0b4bc44f7ee9fd978dc76 --- M includes/Hooks.php 1 file changed, 7 insertions(+), 0 deletions(-) Approvals: Catrope: Looks good to me, approved jenkins-bot: Verified diff --git a/includes/Hooks.php b/includes/Hooks.php index 1a23775..31f5de9 100644 --- a/includes/Hooks.php +++ b/includes/Hooks.php @@ -561,6 +561,13 @@ return; } + if ( !ctype_lower( $type ) ) { + throw new Exception( + "Invalid value for parameter 'type': '$type'. " . + 'Restricted to one lower case word to prevent accidental injection.' + ); + } + $dbr = \wfGetDB( DB_REPLICA ); $threshold = self::getThreshold( $type, $user ); $tables["ores_${type}_mdl"] = 'ores_model'; -- To view, visit https://gerrit.wikimedia.org/r/325302 To unsubscribe, visit https://gerrit.wikimedia.org/r/settings Gerrit-MessageType: merged Gerrit-Change-Id: I97bd6344580831057fe0b4bc44f7ee9fd978dc76 Gerrit-PatchSet: 3 Gerrit-Project: mediawiki/extensions/ORES Gerrit-Branch: master Gerrit-Owner: Sbisson <sbis...@wikimedia.org> Gerrit-Reviewer: Catrope <r...@wikimedia.org> Gerrit-Reviewer: Thiemo Mättig (WMDE) <thiemo.maet...@wikimedia.de> Gerrit-Reviewer: jenkins-bot <> _______________________________________________ MediaWiki-commits mailing list MediaWiki-commits@lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits