Difference between revisions of "T234862: Do not show oversighted edit summaries in CheckUser API (CVE-2019-18611)"

Latest revision as of 14:08, 16 October 2020

Phabricator Link	T234862
Status	resolved
Priority	Medium (orange)
Points
Phabricator Task Created	2019/10/07 05:23 PM
Wiki Page Created	2019/10/28 05:44 PM
Phabricator Task Last Modified	2020/10/16 01:41 PM
Wiki Page Last Updated	2020/10/16 03:08 PM
Phabricator Task Closed	2019/10/29 11:50 AM
Authored By	sbassett (Scott Bassett)
Assigned To	Urbanecm
Projects	CheckUser (Backlog) MW-1.35-notes (1.35.0-wmf.4; 2019-10-29) MediaWiki-API (Non-core-API stuff) Security User-Urbanecm (Waiting on review) Vuln-Infoleak
Platform Engineering Initiative Column
Platform Team Workboards Column
Subtasks
Parent Tasks

Column Transitions: (Added project: ⇑, Removed project: ⇓,Entered column: ⇒, Exited column: ⇐)

Project	Column	Date
⇑ acl*security		7 October 2019
⇑ MediaWiki-API		7 October 2019
⇑ Vuln-Infoleak		7 October 2019
⇑ CheckUser		7 October 2019
⇑ Platform Engineering		7 October 2019
MediaWiki-API	⇐ Unsorted	7 October 2019
MediaWiki-API	⇒ Non-core-API stuff	7 October 2019
Platform Engineering	⇐ Inbox	8 October 2019
Platform Engineering	⇒ Triage Meeting Inbox	8 October 2019
⇓ Platform Engineering		8 October 2019
⇑ Platform Team Workboards (Clinic Duty Team)		8 October 2019
Platform Team Workboards (Clinic Duty Team)	⇐ Inbox	8 October 2019
Platform Team Workboards (Clinic Duty Team)	⇒ Discussing	8 October 2019
⇑ User-Urbanecm		8 October 2019
User-Urbanecm	⇐ Backlog	11 October 2019
User-Urbanecm	⇒ Working on	11 October 2019
Platform Team Workboards (Clinic Duty Team)	⇐ Discussing	18 October 2019
Platform Team Workboards (Clinic Duty Team)	⇒ Waiting for deployment	18 October 2019
acl*security	⇐ Backlog / Other	18 October 2019
acl*security	⇒ Pending deployment / release	18 October 2019
⇑ user-sbassett		18 October 2019
user-sbassett	⇐ Backlog	18 October 2019
user-sbassett	⇒ Waiting	18 October 2019
User-Urbanecm	⇐ Working on	23 October 2019
User-Urbanecm	⇒ Waiting on review	23 October 2019
⇑ Patch-For-Review		28 October 2019
⇑ MW-1.35-notes (1.35.0-wmf.4; 2019-10-29)		28 October 2019
⇓ Patch-For-Review		28 October 2019
⇓ Platform Team Workboards (Clinic Duty Team)		29 October 2019
user-sbassett	⇐ Waiting	29 October 2019
user-sbassett	⇒ Done	29 October 2019
⇓ user-sbassett		29 October 2019
⇑ Security		10 February 2020
⇓ acl*security		20 February 2020

@@ Line 1: / Line 1: @@
 {{Phabricator Task
-|name=Verify that the MediaWiki API is not leaking Oversighted edit summaries within CheckUser results
+|name=Do not show oversighted edit summaries in CheckUser API (CVE-2019-18611)
-|status=open
+|status=resolved
 |color=orange
+|points=
 |dateCreated=1570483425
-|dateModified=1572300636
+|dateModified=1602870096
+|dateClosed=1572364244
 |author={{Phabricator User
 |type=author
@@ Line 18: / Line 20: @@
 |name=MW-1.35-notes
 |column=1.35.0-wmf.4; 2019-10-29
+|entryDate=1570483425
 }}{{Phabricator Project
 |name=CheckUser
 |column=Backlog
-}}{{Phabricator Project
+|entryDate=1570483425
-|name=Core Platform Team Workboards (Clinic Duty Team)
-|column=Waiting for deployment
 }}{{Phabricator Project
 |name=MediaWiki-API
 |column=Non-core-API stuff
+|entryDate=1570485549
 }}{{Phabricator Project
 |name=Security
-|column=Pending deployment / release
+|entryDate=1570483425
 }}{{Phabricator Project
 |name=User-Urbanecm
 |column=Waiting on review
+|entryDate=1571814213
 }}{{Phabricator Project
 |name=Vuln-Infoleak
+|entryDate=1570483425
+}}
+|transitions={{Transition
+|date=1582229785
+|type=Removed Project
+|project=acl*security
+}}{{Transition
+|date=1581375399
+|type=Added Project
+|project=Security
+}}{{Transition
+|date=1572364426
+|type=Removed Project
+|project=user-sbassett
+}}{{Transition
+|date=1572364378
+|type=Entered Column
+|project=user-sbassett
+|column=Done
+}}{{Transition
+|date=1572364378
+|type=Exited Column
+|project=user-sbassett
+|column=Waiting
+}}{{Transition
+|date=1572362332
+|type=Removed Project
+|project=Platform Team Workboards (Clinic Duty Team)
+}}{{Transition
+|date=1572300636
+|type=Removed Project
+|project=Patch-For-Review
+}}{{Transition
+|date=1572300059
+|type=Added Project
+|project=MW-1.35-notes (1.35.0-wmf.4; 2019-10-29)
+}}{{Transition
+|date=1572297886
+|type=Added Project
+|project=Patch-For-Review
+}}{{Transition
+|date=1571814213
+|type=Entered Column
+|project=User-Urbanecm
+|column=Waiting on review
+}}{{Transition
+|date=1571814213
+|type=Exited Column
+|project=User-Urbanecm
+|column=Working on
+}}{{Transition
+|date=1571423841
+|type=Entered Column
+|project=user-sbassett
+|column=Waiting
+}}{{Transition
+|date=1571423841
+|type=Exited Column
+|project=user-sbassett
+|column=Backlog
+}}{{Transition
+|date=1571423819
+|type=Added Project
+|project=user-sbassett
+}}{{Transition
+|date=1571414536
+|type=Entered Column
+|project=acl*security
+|column=Pending deployment / release
+}}{{Transition
+|date=1571414536
+|type=Exited Column
+|project=acl*security
+|column=Backlog / Other
+}}{{Transition
+|date=1571414520
+|type=Entered Column
+|project=Platform Team Workboards (Clinic Duty Team)
+|column=Waiting for deployment
+}}{{Transition
+|date=1571414520
+|type=Exited Column
+|project=Platform Team Workboards (Clinic Duty Team)
+|column=Discussing
+}}{{Transition
+|date=1570793992
+|type=Entered Column
+|project=User-Urbanecm
+|column=Working on
+}}{{Transition
+|date=1570793992
+|type=Exited Column
+|project=User-Urbanecm
+|column=Backlog
+}}{{Transition
+|date=1570572112
+|type=Added Project
+|project=User-Urbanecm
+}}{{Transition
+|date=1570560080
+|type=Entered Column
+|project=Platform Team Workboards (Clinic Duty Team)
+|column=Discussing
+}}{{Transition
+|date=1570560080
+|type=Exited Column
+|project=Platform Team Workboards (Clinic Duty Team)
+|column=Inbox
+}}{{Transition
+|date=1570560069
+|type=Removed Project
+|project=Platform Engineering
+}}{{Transition
+|date=1570560069
+|type=Added Project
+|project=Platform Team Workboards (Clinic Duty Team)
+}}{{Transition
+|date=1570540717
+|type=Entered Column
+|project=Platform Engineering
+|column=Triage Meeting Inbox
+}}{{Transition
+|date=1570540717
+|type=Exited Column
+|project=Platform Engineering
+|column=Inbox
+}}{{Transition
+|date=1570485549
+|type=Entered Column
+|project=MediaWiki-API
+|column=Non-core-API stuff
+}}{{Transition
+|date=1570485549
+|type=Exited Column
+|project=MediaWiki-API
+|column=Unsorted
+}}{{Transition
+|date=1570483574
+|type=Added Project
+|project=Platform Engineering
+}}{{Transition
+|date=1570483572
+|type=Added Project
+|project=CheckUser
+}}{{Transition
+|date=1570483572
+|type=Added Project
+|project=MediaWiki-API
+}}{{Transition
+|date=1570483572
+|type=Added Project
+|project=Vuln-Infoleak
+}}{{Transition
+|date=1570483425
+|type=Added Project
+|project=acl*security
 }}
 }}