SECURITY: Fix variable usage in ApiQueryUserContributions

$from was being used instead of $fromName in the handling for
ucuserprefix, causing broken SQL.

Bug: T190507
Change-Id: I0759637ea5f35853271167ca0aaaabd3b7ab69f9

diff --git a/includes/api/ApiQueryUserContributions.php b/includes/api/ApiQueryUserContributions.php
index bb4a2ef..816c56c 100644 (file)
--- a/includes/api/ApiQueryUserContributions.php
+++ b/includes/api/ApiQueryUserContributions.php
@@ -82,19 +82,20 @@ class ApiQueryContributions extends ApiQueryBase {
                        $userIter = call_user_func( function () use ( $dbSecondary, $sort, $op, $fname ) {
                                global $wgActorTableSchemaMigrationStage;
 
-                               $from = $fromName = false;
+                               $fromName = false;
                                if ( !is_null( $this->params['continue'] ) ) {
                                        $continue = explode( '|', $this->params['continue'] );
                                        $this->dieContinueUsageIf( count( $continue ) != 4 );
                                        $this->dieContinueUsageIf( $continue[0] !== 'name' );
                                        $fromName = $continue[1];
-                                       $from = "$op= " . $dbSecondary->addQuotes( $fromName );
                                }
                                $like = $dbSecondary->buildLike( $this->params['userprefix'], $dbSecondary->anyString() );
 
                                $limit = 501;
 
                                do {
+                                       $from = $fromName ? "$op= " . $dbSecondary->addQuotes( $fromName ) : false;
+
                                        // For the new schema, pull from the actor table. For the
                                        // old, pull from rev_user. For migration a FULL [OUTER]
                                        // JOIN would be what we want, except MySQL doesn't support
@@ -158,15 +159,15 @@ class ApiQueryContributions extends ApiQueryBase {
                                        }
 
                                        $count = 0;
-                                       $from = null;
+                                       $fromName = false;
                                        foreach ( $res as $row ) {
                                                if ( ++$count >= $limit ) {
-                                                       $from = $row->user_name;
+                                                       $fromName = $row->user_name;
                                                        break;
                                                }
                                                yield User::newFromRow( $row );
                                        }
-                               } while ( $from !== null );
+                               } while ( $fromName !== false );
                        } );
                        // Do the actual sorting client-side, because otherwise
                        // prepareQuery might try to sort by actor and confuse everything.