MediaWiki 1.11.2 released (security)

1 files changed, 8 insertions, 0 deletions

diff --git a/includes/api/ApiMain.php b/includes/api/ApiMain.php
index 31870449..00b3f63f 100644
--- a/includes/api/ApiMain.php
+++ b/includes/api/ApiMain.php
@@ -98,6 +98,14 @@ class ApiMain extends ApiBase {
 			// If the current user cannot read, 
 			// Remove all modules other than login
 			global $wgUser;
+			
+			if( $request->getVal( 'callback' ) !== null ) {
+				// JSON callback allows cross-site reads.
+				// For safety, strip user credentials.
+				wfDebug( "API: stripping user credentials for JSON callback\n" );
+				$wgUser = new User();
+			}
+			
 			if (!$wgUser->isAllowed('read')) {
 				self::$Modules = array(
 					'login' => self::$Modules['login'],