Security Problem?

List overview All Threads
Download

newer

older

Delete-Log for Images

languageNl.php

Thomas Corell

26 May 2003 26 May '03

12:17 a.m.

Hello, what I tryed to get the oldest users was: select * from user order by user_touched limit 10; No problem, but a litle bit to much output. I modified: select user_id, user_name from user order by user_touched limit 50; and I got an error: 1143: SELECT command denied to user: 'wikisql(a)127.0.0.1' for column 'user_touched' in table 'user' Is our pretty MySQL to stupit to know that * includes user_touched? I know which permissions are set by users.sql, I'm only wondering. -- Smurf smurf(a)AdamAnt.mud.de ------------------------- Anthill inside! ---------------------------

Show replies by date

Brion Vibber

26 May 26 May

12:39 a.m.

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Je Dimanĉo 25 Majo 2003 14:17, Thomas Corell skribis:

...

and I got an error: 1143: SELECT command denied to user: 'wikisql(a)127.0.0.1' for column 'user_touched' in table 'user' Is our pretty MySQL to stupit to know that * includes user_touched? I know which permissions are set by users.sql, I'm only wondering.

Sysop queries aren't allowed to touch user_password, user_newpassword, or user_email. It looks like I didn't think to add user_touched to the permissions when that column was added; it is debatable whether allowing it would be a privacy issue (as it tracks the last time someone logged in, logged out, saved their preferences, had a message left on their talk page, or viewed their talk page, even if they have made not edits to the wiki and thus don't expect to be publicly tracked). - -- brion vibber (brion @ pobox.com)

...PGP SIGNATURE...

-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2 (GNU/Linux) iD8DBQE+0Tf8xVlOmwh1xjgRAjUKAJ0ZY/3N4afC9vAOj/3BgJVQ2ShXGACcCvbl Emz3kja4wY1WDNNSKEhK95g= =EIVm -----END PGP SIGNATURE-----

Thomas Corell

1:13 a.m.

Brion Vibber wrote:

...

Well, I only tested german wikipedia, of course. But I see all this values, which of course I could not edit. The other problem I remember: public access to user.sql via the download area. If you do this, forget all that restrictions. I can not test if the permissions in maintenance/users.sql are applied to the german wiki, but in that file they look right. If sysops are allowed that privacy data, well in contrast to Jimbos Mail about everything open for all, I've personally no problem with restrictions, but thats something for long term wikipedians, with the proper wikiquette in mind. PS: I only come across on my experiments for new SpecialPages. One Idea was to know about never used accounts. Coming along with the idea to delete them by software, in order to prevent things like the problematic deletion of one of our german members. -- Smurf smurf(a)AdamAnt.mud.de ------------------------- Anthill inside! ---------------------------

Brion Vibber

1:36 a.m.

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Je Dimanĉo 25 Majo 2003 15:13, Thomas Corell skribis:

...

Well, I only tested german wikipedia, of course. But I see all this values, which of course I could not edit.

Whoaaaaaaa, that's a horse of a different color. That's a serious bug. Okay: this correctly gives error: SELECT user_password from user limit 5 but this shows the password and e-mail fields: SELECT * from user limit 5 I'm disabling the queries until this is fixed.

...

The other problem I remember: public access to user.sql via the download area. If you do this, forget all that restrictions.

?????? urkkkk..... those should really not have been there. I assume Lee created them at some point when making backups, and forgot that they were world-accessible download directories. I've deleted them. - -- brion vibber (brion @ pobox.com)

...PGP SIGNATURE...

-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2 (GNU/Linux) iD8DBQE+0UVdxVlOmwh1xjgRAvbyAJ9nzkVuRkJ5f6yGtT37FxqAEIVRLwCaA4/f Ar2rncKtxIZ1uig7t8oIFYY= =WS1V -----END PGP SIGNATURE-----

Brion Vibber

2:42 a.m.

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Je Dimanĉo 25 Majo 2003 15:36, Brion Vibber skribis:

...

Okay: this correctly gives error: SELECT user_password from user limit 5 but this shows the password and e-mail fields: SELECT * from user limit 5

Okay, this is a MySQL bug. It's apparently fixed in 4.0.13, here's the changelog entry: * Fixed a security problem with SELECT and wildcarded select list, when user only had partial column SELECT privileges on the table. I'll install the upgrade, then reenable sql queries if all is well. - -- brion vibber (brion @ pobox.com)

...PGP SIGNATURE...

-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2 (GNU/Linux) iD8DBQE+0VTSxVlOmwh1xjgRAvG9AJ9JL/z/wBRbdTKgSB4AcbMA8Tc2cgCgjx3s 9PquvX075QowuEPrZrVhJ6k= =ogTu -----END PGP SIGNATURE-----

Brion Vibber

3:57 a.m.

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Je Dimanĉo 25 Majo 2003 16:42, Brion Vibber skribis:

...

4.0.13 is installed, it seems to have fixed the bug. SQL queries back open for business. - -- brion vibber (brion @ pobox.com)

...PGP SIGNATURE...

-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2 (GNU/Linux) iD8DBQE+0WZ8xVlOmwh1xjgRAnggAJ9AxQVgrvEcjoMQ7GVQSpj3SZfW7gCfYyBM +NVcCtA2mmPpLFsCi+SREkM= =WyoC -----END PGP SIGNATURE-----

Thomas Corell

8:02 a.m.

Brion Vibber wrote:

...

4.0.13 is installed, it seems to have fixed the bug. SQL queries back open for business.

Fine. One apache, one Mysql bug. Seems to be enought for a weekend. *grin demonically* Did I told that I like feature frezze? ;) -- Smurf Two for the records, one in mind. smurf(a)AdamAnt.mud.de ------------------------- Anthill inside! ---------------------------

Brion Vibber

8:02 a.m.

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Je Dimanĉo 25 Majo 2003 22:02, Thomas Corell skribis:

...

Fine. One apache, one Mysql bug. Seems to be enought for a weekend. *grin demonically*

Please don't find any kernel bugs; they don't have a more recent stable release of that yet. :D

...

Did I told that I like feature frezze? ;)

If only we could declare a bug freeze. :) - -- brion vibber (brion @ pobox.com)

...PGP SIGNATURE...

-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2 (GNU/Linux) iD8DBQE+0Z/8xVlOmwh1xjgRApgfAKCU1tZcIZa6k8zLop1qCspJ1JHKdwCgl0LA KDM3LWWePgPHDrD/9jHDoyw= =uXPC -----END PGP SIGNATURE-----