SECURITY: Make 'newbie' limit in $wgRateLimits really override 'user' limit
authorChad Horohoe <chadh@wikimedia.org>
Tue, 13 Mar 2018 18:43:30 +0000 (18:43 +0000)
committerReedy <reedy@wikimedia.org>
Thu, 20 Sep 2018 21:26:11 +0000 (22:26 +0100)
The order of operations was incorrect.

Bug: T169545
Change-Id: Ia910aa2a494914d3b0017daac9ab294ea9fa8705

includes/user/User.php

index d6d4db2..84b95b4 100644 (file)
@@ -2165,10 +2165,6 @@ class User implements IDBAccessObject, UserIdentity {
                        if ( isset( $limits['user'] ) ) {
                                $userLimit = $limits['user'];
                        }
                        if ( isset( $limits['user'] ) ) {
                                $userLimit = $limits['user'];
                        }
-                       // limits for newbie logged-in users
-                       if ( $isNewbie && isset( $limits['newbie'] ) ) {
-                               $keys[$cache->makeKey( 'limiter', $action, 'user', $id )] = $limits['newbie'];
-                       }
                }
 
                // limits for anons and for newbie logged-in users
                }
 
                // limits for anons and for newbie logged-in users
@@ -2200,6 +2196,11 @@ class User implements IDBAccessObject, UserIdentity {
                        }
                }
 
                        }
                }
 
+               // limits for newbie logged-in users (override all the normal user limits)
+               if ( $id !== 0 && $isNewbie && isset( $limits['newbie'] ) ) {
+                       $userLimit = $limits['newbie'];
+               }
+
                // Set the user limit key
                if ( $userLimit !== false ) {
                        list( $max, $period ) = $userLimit;
                // Set the user limit key
                if ( $userLimit !== false ) {
                        list( $max, $period ) = $userLimit;