From 8a00ddbf357831129b6565d0e0f7858f3514b582 Mon Sep 17 00:00:00 2001 From: Brad Jorsch Date: Sun, 17 Apr 2016 10:32:56 -0400 Subject: [PATCH] SECURITY: Rate limit moves via the API While rate limiting has been applied to moves via the web UI since rate limiting was first added, it appears that it was overlooked when ApiMove was created. This follows the same model as is followed by the web UI: each submission to ApiMove is one "hit" for the rate limiter, even though that submission might result in multiple pages being moved (e.g. the page, its talk page, and its subpages) depending on the options and user rights. Bug: T132874 Change-Id: I564d8bfcc7dd3ad6d92dbbc33519a589697c0d4e Signed-off-by: Chad Horohoe --- includes/api/ApiMove.php | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/includes/api/ApiMove.php b/includes/api/ApiMove.php index 2fbd50e2e5..29e67b07cd 100644 --- a/includes/api/ApiMove.php +++ b/includes/api/ApiMove.php @@ -72,6 +72,11 @@ class ApiMove extends ApiBase { } } + // Rate limit + if ( $user->pingLimiter( 'move' ) ) { + $this->dieUsageMsg( 'actionthrottledtext' ); + } + // Move the page $toTitleExists = $toTitle->exists(); $status = $this->movePage( $fromTitle, $toTitle, $params['reason'], !$params['noredirect'] ); -- 2.20.1