From 749e7fb2bae7bbda855de3c9e319435b9f698ff7 Mon Sep 17 00:00:00 2001 From: Pierre Schmitz Date: Mon, 3 Mar 2008 09:36:49 +0100 Subject: MediaWiki 1.11.2 released (security) --- includes/api/ApiMain.php | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'includes/api/ApiMain.php') diff --git a/includes/api/ApiMain.php b/includes/api/ApiMain.php index 31870449..00b3f63f 100644 --- a/includes/api/ApiMain.php +++ b/includes/api/ApiMain.php @@ -98,6 +98,14 @@ class ApiMain extends ApiBase { // If the current user cannot read, // Remove all modules other than login global $wgUser; + + if( $request->getVal( 'callback' ) !== null ) { + // JSON callback allows cross-site reads. + // For safety, strip user credentials. + wfDebug( "API: stripping user credentials for JSON callback\n" ); + $wgUser = new User(); + } + if (!$wgUser->isAllowed('read')) { self::$Modules = array( 'login' => self::$Modules['login'], -- cgit v1.2.2