brion(a)svn.wikimedia.org schreef: I don't see how this is bad: you can try and trick another user into doing something *logged in as you*, so it will appear as if *you* did it. Why not do it yourself if it's gonna be logged under your name anyway? Besides, this login session substitution only works for the API: the UI completely ignores the lg* stuff, and your cookies aren't overwritten. Now if this provided a way for a non-sysop to trick a sysop into deleting an article, I would acknowledge that that's a security issue. I don't see the issue here, however: the delete, or whatever it is you're trying to do, is gonna be logged with the attacker's name, checked against the attacker's permissions, etc. Also, the session is not really a session: the API doesn't spit out any cookies outside of the login module (that I'm aware of, anyway). I fail to see the security issue here. Roan Kattouw (Catrope)

brion(a)svn.wikimedia.org schreef: I don't see how this is bad: you can try and trick another user into doing something *logged in as you*, so it will appear as if *you* did it. Why not do it yourself if it's gonna be logged under your name anyway? Besides, this login session substitution only works for the API: the UI completely ignores the lg* stuff, and your cookies aren't overwritten.

Now if this provided a way for a non-sysop to trick a sysop into deleting an article, I would acknowledge that that's a security issue. I don't see the issue here, however: the delete, or whatever it is you're trying to do, is gonna be logged with the attacker's name, checked against the attacker's permissions, etc. Also, the session is not really a session: the API doesn't spit out any cookies outside of the login module (that I'm aware of, anyway). I fail to see the security issue here.