SECURITY: Make Special:MyPage and friends fake redirect to prevent info leak
authorcsteipp <csteipp@wikimedia.org>
Mon, 5 Oct 2015 23:58:42 +0000 (16:58 -0700)
committerChad Horohoe <chadh@wikimedia.org>
Fri, 18 Dec 2015 09:46:03 +0000 (01:46 -0800)
commit1461ff2ecfef40caef35a5d91cfb5849631564ee
tree190aa62818601d974f6acdd1ef6422d43a82f60c
parent47528dcf6a8a40ad0a1ea99fb49113aa9309b460
SECURITY: Make Special:MyPage and friends fake redirect to prevent info leak

This prevents a malicious person from using external resources on their
website to cause the victim's web browser to load
Special:MyPage -> User:Username, and then looking it up in the page hit
statistics in order to correlate IPs from the malicious person's server
log, with usernames on wiki.

This feature can be disabled with $wgHideIdentifiableRedirects.

Bug: T109724
Signed-off-by: Chad Horohoe <chadh@wikimedia.org>
Change-Id: Ia0e742dc92c77af4832174dfa24c6dcaa6ee80e9
includes/DefaultSettings.php
includes/MediaWiki.php
includes/specialpage/RedirectSpecialPage.php
includes/specials/SpecialMyLanguage.php
includes/specials/SpecialMyRedirectPages.php