[Pkg-mediawiki-commits] r292 - in mediawiki/squeeze/debian: . patches
Jonathan Wiltshire
jmw at alioth.debian.org
Fri Jan 13 12:13:18 UTC 2012
Author: jmw
Date: 2012-01-13 12:13:18 +0000 (Fri, 13 Jan 2012)
New Revision: 292
Added:
mediawiki/squeeze/debian/patches/CVE-2012-0046.patch
Modified:
mediawiki/squeeze/debian/changelog
mediawiki/squeeze/debian/patches/series
Log:
Backport fix for CVE-2012-0046
Modified: mediawiki/squeeze/debian/changelog
===================================================================
--- mediawiki/squeeze/debian/changelog 2012-01-13 09:55:38 UTC (rev 291)
+++ mediawiki/squeeze/debian/changelog 2012-01-13 12:13:18 UTC (rev 292)
@@ -1,3 +1,10 @@
+mediawiki (1:1.15.5-2squeeze3) stable; urgency=low
+
+ * debian/patches/CVE-2012-0046.patch: security fix for unintended exposure
+ of hidden content through cache pollution, CVE-2012-0046 (Closes: #655694)
+
+ -- Jonathan Wiltshire <jmw at debian.org> Fri, 13 Jan 2012 10:54:43 +0000
+
mediawiki (1:1.15.5-2squeeze2) stable-security; urgency=low
* Security fixes from upstream (Closes: #650434):
Added: mediawiki/squeeze/debian/patches/CVE-2012-0046.patch
===================================================================
--- mediawiki/squeeze/debian/patches/CVE-2012-0046.patch (rev 0)
+++ mediawiki/squeeze/debian/patches/CVE-2012-0046.patch 2012-01-13 12:13:18 UTC (rev 292)
@@ -0,0 +1,17 @@
+Description: prevent cache pollution exposing previously deleted text to
+ users behind caching proxy
+Author: Tim Starling
+Bug: https://bugzilla.wikimedia.org/show_bug.cgi?id=33117
+Last-Update: 2012-01-12
+
+--- mediawiki-1.15.5.orig/includes/api/ApiQueryRevisions.php
++++ mediawiki-1.15.5/includes/api/ApiQueryRevisions.php
+@@ -113,7 +113,7 @@
+ $difftoRev = Revision::newFromID($params['diffto']);
+ if (!$difftoRev)
+ $this->dieUsageMsg(array('nosuchrevid', $params['diffto']));
+- if (!$difftoRev->userCan(Revision::DELETED_TEXT)) {
++ if ($difftoRev->isDeleted(Revision::DELETED_TEXT)) {
+ $this->setWarning("Couldn't diff to r{$difftoRev->getID()}: content is hidden");
+ $params['diffto'] = null;
+ }
Modified: mediawiki/squeeze/debian/patches/series
===================================================================
--- mediawiki/squeeze/debian/patches/series 2012-01-13 09:55:38 UTC (rev 291)
+++ mediawiki/squeeze/debian/patches/series 2012-01-13 12:13:18 UTC (rev 292)
@@ -13,3 +13,4 @@
CVE-2011-1587.patch
CVE-2011-4360.patch
CVE-2011-4361.patch
+CVE-2012-0046.patch
More information about the Pkg-mediawiki-commits
mailing list