CVE-2021-21275: Cross-Site Request Forgery (CSRF) (CWE-352)
value: The MediaWiki "Report" extension has a Cross-Site Request Forgery (CSRF) vulnerability. Before fixed version, there was no protection against CSRF checks on Special:Report, so requests to report a revision could be forged. The problem has been fixed in commit f828dc6 by making use of MediaWiki edit tokens.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 4.3
Published: 2021-01-25T23:15Z
Repository: https://github.com/Kenny2github/Report
Language: PHP
Files changed: SpecialReport.php
Commit date: 2021-01-21 19:24:06 +0000
Commit message: Add CSRF check for Special:Report

Also clean up a little of the logic

Diff: diff --git a/SpecialReport.php b/SpecialReport.php
index 933e1a6..2d74cc7 100644
--- a/SpecialReport.php
+++ b/SpecialReport.php
@@ -53,11 +53,11 @@ class SpecialReport extends SpecialPage {
 			));
 			return;
 		}
 		$request = $this->getRequest();
 		if ($request->wasPosted()) {
-			return self::onPost( $par, $out, $request );
+			return self::onPost( $par, $out, $request, $user );
 		}
 		$out->setIndexPolicy( 'noindex' );
 		$out->addHTML(
 			Html::rawElement(
 				'p',
@@ -85,10 +85,18 @@ class SpecialReport extends SpecialPage {
 			[
 				'name' => 'reason',
 				'id' => 'mw-report-form-reason'
 			]
 		));
+		$out->addHTML(Html::rawElement(
+			'input',
+			[
+				'type' => 'hidden',
+				'name' => 'token',
+				'value' => $user->getEditToken()
+			]
+		));
 		$out->addHTML(Html::rawElement(
 			'input',
 			[
 				'type' => 'submit',
 				'id' => 'mw-report-form-submit',
@@ -96,33 +104,35 @@ class SpecialReport extends SpecialPage {
 			]
 		));
 		$out->addHTML(Html::closeElement( 'form' ));
 	}
 
-	static public function onPost( $par, $out, $request ) {
-		global $wgUser;
+	static public function onPost( $par, $out, $request, $user ) {
+		if (!$user->matchEditToken($request->getText( 'token' ))) {
+			$out->addWikiMsg( 'sessionfailure' );
+			return;
+		}
 		if (!$request->getText('reason')) {
 			$out->addHTML(Html::rawElement(
 				'p',
 				[ 'class' => 'error '],
 				wfMessage( 'report-error-missing-reason' )->escaped()
 			));
-		} else {
-			$dbw = wfGetDB( DB_MASTER );
-			$dbw->startAtomic(__METHOD__);
-			$dbw->insert( 'report_reports', [
-				'report_revid' => (int)$par,
-				'report_reason' => $request->getText('reason'),
-				'report_user' => $wgUser->getId(),
-				'report_user_text' => $wgUser->getName(),
-				'report_timestamp' => wfTimestampNow()
-			], __METHOD__ );
-			$dbw->endAtomic(__METHOD__);
-			$out->addWikiMsg( 'report-success' );
-			$out->addWikiMsg( 'returnto', '[[' . SpecialPage::getTitleFor('Diff', $par)->getPrefixedText() . ']]' );
 			return;
 		}
+		$dbw = wfGetDB( DB_MASTER );
+		$dbw->startAtomic(__METHOD__);
+		$dbw->insert( 'report_reports', [
+			'report_revid' => (int)$par,
+			'report_reason' => $request->getText('reason'),
+			'report_user' => $user->getId(),
+			'report_user_text' => $user->getName(),
+			'report_timestamp' => wfTimestampNow()
+		], __METHOD__ );
+		$dbw->endAtomic(__METHOD__);
+		$out->addWikiMsg( 'report-success' );
+		$out->addWikiMsg( 'returnto', '[[' . SpecialPage::getTitleFor('Diff', $par)->getPrefixedText() . ']]' );
 	}
 
 	public function getGroupName() {
 		return 'wiki';
 	}

Vulnerable code: 			return self::onPost( $par, $out, $request );
	static public function onPost( $par, $out, $request ) {
		global $wgUser;
		} else {
			$dbw = wfGetDB( DB_MASTER );
			$dbw->startAtomic(__METHOD__);
			$dbw->insert( 'report_reports', [
				'report_revid' => (int)$par,
				'report_reason' => $request->getText('reason'),
				'report_user' => $wgUser->getId(),
				'report_user_text' => $wgUser->getName(),
				'report_timestamp' => wfTimestampNow()
			], __METHOD__ );
			$dbw->endAtomic(__METHOD__);
			$out->addWikiMsg( 'report-success' );
			$out->addWikiMsg( 'returnto', '[[' . SpecialPage::getTitleFor('Diff', $par)->getPrefixedText() . ']]' );
Fixed code: 			return self::onPost( $par, $out, $request, $user );
		$out->addHTML(Html::rawElement(
			'input',
			[
				'type' => 'hidden',
				'name' => 'token',
				'value' => $user->getEditToken()
			]
		));
	static public function onPost( $par, $out, $request, $user ) {
		if (!$user->matchEditToken($request->getText( 'token' ))) {
			$out->addWikiMsg( 'sessionfailure' );
			return;
		}
		$dbw = wfGetDB( DB_MASTER );
		$dbw->startAtomic(__METHOD__);
		$dbw->insert( 'report_reports', [
			'report_revid' => (int)$par,
			'report_reason' => $request->getText('reason'),
			'report_user' => $user->getId(),
			'report_user_text' => $user->getName(),
			'report_timestamp' => wfTimestampNow()
		], __METHOD__ );
		$dbw->endAtomic(__METHOD__);
		$out->addWikiMsg( 'report-success' );
		$out->addWikiMsg( 'returnto', '[[' . SpecialPage::getTitleFor('Diff', $par)->getPrefixedText() . ']]' );