← Back to branch summary

~ubuntu-branches/ubuntu/quantal/mediawiki/quantal

« back to all changes in this revision

Viewing changes to .pc/CVE-2011-4361.patch/includes/AjaxDispatcher.php

  • Committer: Package Import Robot
  • Author(s): Jonathan Wiltshire, Thorsten Glaser, Jonathan Wiltshire
  • Date: 2011-11-30 22:42:52 UTC
  • mfrom: (16.1.12 sid)
  • Revision ID: package-import@ubuntu.com-20111130224252-zhag0n99qzf8jc7x
Tags: 1:1.15.5-4
http://bugs.debian.org/615983
http://bugs.debian.org/650434
[ Thorsten Glaser ]
* debian/patches/fix_invalid_sql.patch: new (Closes: #615983)

[ Jonathan Wiltshire ]
* Security fixes from upstream (Closes: #650434):
  CVE-2011-4360 - page titles on private wikis could be exposed
  bypassing different page ids to index.php
  CVE-2011-4361 - action=ajax requests were dispatched to the
  relevant function without any read permission checks being done

Show diffs side-by-side

added added

removed removed

Lines of Context:
.pc/CVE-2011-4361.patch/includes/AjaxDispatcher.php
 
1
<?php
 
2
/**
 
3
 * @defgroup Ajax Ajax
 
4
 *
 
5
 * @file
 
6
 * @ingroup Ajax
 
7
 * Handle ajax requests and send them to the proper handler.
 
8
 */
 
9
 
 
10
if( !(defined( 'MEDIAWIKI' ) && $wgUseAjax ) ) {
 
11
        die( 1 );
 
12
}
 
13
 
 
14
require_once( 'AjaxFunctions.php' );
 
15
 
 
16
/**
 
17
 * Object-Oriented Ajax functions.
 
18
 * @ingroup Ajax
 
19
 */
 
20
class AjaxDispatcher {
 
21
        /** The way the request was made, either a 'get' or a 'post' */
 
22
        private $mode;
 
23
 
 
24
        /** Name of the requested handler */
 
25
        private $func_name;
 
26
 
 
27
        /** Arguments passed */
 
28
        private $args;
 
29
 
 
30
        /** Load up our object with user supplied data */
 
31
        function __construct() {
 
32
                wfProfileIn( __METHOD__ );
 
33
 
 
34
                $this->mode = "";
 
35
 
 
36
                if (! empty($_GET["rs"])) {
 
37
                        $this->mode = "get";
 
38
                }
 
39
 
 
40
                if (!empty($_POST["rs"])) {
 
41
                        $this->mode = "post";
 
42
                }
 
43
 
 
44
                switch( $this->mode ) {
 
45
 
 
46
                case 'get':
 
47
                        $this->func_name = isset( $_GET["rs"] ) ? $_GET["rs"] : '';
 
48
                        if (! empty($_GET["rsargs"])) {
 
49
                                $this->args = $_GET["rsargs"];
 
50
                        } else {
 
51
                                $this->args = array();
 
52
                        }
 
53
                break;
 
54
 
 
55
                case 'post':
 
56
                        $this->func_name = isset( $_POST["rs"] ) ? $_POST["rs"] : '';
 
57
                        if (! empty($_POST["rsargs"])) {
 
58
                                $this->args = $_POST["rsargs"];
 
59
                        } else {
 
60
                                $this->args = array();
 
61
                        }
 
62
                break;
 
63
 
 
64
                default:
 
65
                        wfProfileOut( __METHOD__ );
 
66
                        return;
 
67
                        # Or we could throw an exception:
 
68
                        #throw new MWException( __METHOD__ . ' called without any data (mode empty).' );
 
69
 
 
70
                }
 
71
 
 
72
                wfProfileOut( __METHOD__ );
 
73
        }
 
74
 
 
75
        /** Pass the request to our internal function.
 
76
         * BEWARE! Data are passed as they have been supplied by the user,
 
77
         * they should be carefully handled in the function processing the
 
78
         * request.
 
79
         */
 
80
        function performAction() {
 
81
                global $wgAjaxExportList, $wgOut;
 
82
 
 
83
                if ( empty( $this->mode ) ) {
 
84
                        return;
 
85
                }
 
86
                wfProfileIn( __METHOD__ );
 
87
 
 
88
                if (! in_array( $this->func_name, $wgAjaxExportList ) ) {
 
89
                        wfDebug( __METHOD__ . ' Bad Request for unknown function ' . $this->func_name . "\n" );
 
90
 
 
91
                        wfHttpError( 400, 'Bad Request',
 
92
                                "unknown function " . (string) $this->func_name );
 
93
                } else {
 
94
                        wfDebug( __METHOD__ . ' dispatching ' . $this->func_name . "\n" );
 
95
 
 
96
                        if ( strpos( $this->func_name, '::' ) !== false ) {
 
97
                                $func = explode( '::', $this->func_name, 2 );
 
98
                        } else {
 
99
                                $func = $this->func_name;
 
100
                        }
 
101
                        try {
 
102
                                $result = call_user_func_array($func, $this->args);
 
103
 
 
104
                                if ( $result === false || $result === NULL ) {
 
105
                                        wfDebug( __METHOD__ . ' ERROR while dispatching ' 
 
106
                                                        . $this->func_name . "(" . var_export( $this->args, true ) . "): " 
 
107
                                                        . "no data returned\n" );
 
108
 
 
109
                                        wfHttpError( 500, 'Internal Error',
 
110
                                                "{$this->func_name} returned no data" );
 
111
                                }
 
112
                                else {
 
113
                                        if ( is_string( $result ) ) {
 
114
                                                $result= new AjaxResponse( $result );
 
115
                                        }
 
116
 
 
117
                                        $result->sendHeaders();
 
118
                                        $result->printText();
 
119
 
 
120
                                        wfDebug( __METHOD__ . ' dispatch complete for ' . $this->func_name . "\n" );
 
121
                                }
 
122
 
 
123
                        } catch (Exception $e) {
 
124
                                wfDebug( __METHOD__ . ' ERROR while dispatching ' 
 
125
                                                . $this->func_name . "(" . var_export( $this->args, true ) . "): " 
 
126
                                                . get_class($e) . ": " . $e->getMessage() . "\n" );
 
127
 
 
128
                                if (!headers_sent()) {
 
129
                                        wfHttpError( 500, 'Internal Error',
 
130
                                                $e->getMessage() );
 
131
                                } else {
 
132
                                        print $e->getMessage();
 
133
                                }
 
134
                        }
 
135
                }
 
136
 
 
137
                wfProfileOut( __METHOD__ );
 
138
                $wgOut = null;
 
139
        }
 
140
}