T410560.patch
Daimona
Actions

Authored By

	Daimona
	Nov 24 2025, 3:24 PM

Size

3 KB

Referenced Files

None

Subscribers

None

T410560.patch
View Options

	From 81cd23724e66bfa0b3432e4a6dabb167783ad792 Mon Sep 17 00:00:00 2001
	From: Daimona Eaytoy <daimona.wiki@gmail.com>
	Date: Mon, 24 Nov 2025 16:18:04 +0100
	Subject: [PATCH] SECURITY: Rest: temporarily exclude meeting and chat URL from
	GET event

	These should only be included if the performer is authorized to see
	them, as is already the case in EventPageDecorator and
	EventDetailsModule.

	This patch temporarily drops these fields from the response. A proper
	fix will be implemented publicly at a later time. API users would be
	temporarily broken, but no known users exist, and this endpoint isn't
	currently used by the extension itself.

	Bug: T410560
	Change-Id: Ib762ef770cb5cee8abb25ebae26e8f24dd8c5f04
	---
	src/Rest/GetEventRegistrationHandler.php \| 5 +++--
	tests/phpunit/unit/Rest/GetEventRegistrationHandlerTest.php \| 4 +++-
	2 files changed, 6 insertions(+), 3 deletions(-)

	diff --git a/src/Rest/GetEventRegistrationHandler.php b/src/Rest/GetEventRegistrationHandler.php
	index 77a7c926..9bbcba20 100644
	--- a/src/Rest/GetEventRegistrationHandler.php
	+++ b/src/Rest/GetEventRegistrationHandler.php
	@@ -54,6 +54,7 @@ class GetEventRegistrationHandler extends SimpleHandler {
	$wikis = $registration->getWikis();
	$participationOptions = $registration->getParticipationOptions();
	$address = $registration->getAddress();
	+
	$respVal = [
	'id' => $registration->getID(),
	'name' => $registration->getName(),
	@@ -69,11 +70,11 @@ class GetEventRegistrationHandler extends SimpleHandler {
	'topics' => $registration->getTopics(),
	'online_meeting' => ( $participationOptions & EventRegistration::PARTICIPATION_OPTION_ONLINE ) !== 0,
	'inperson_meeting' => ( $participationOptions & EventRegistration::PARTICIPATION_OPTION_IN_PERSON ) !== 0,
	- 'meeting_url' => $registration->getMeetingURL(),
	+ // 'meeting_url' => $registration->getMeetingURL(), XXX T410560
	'meeting_country_code' => $address?->getCountryCode(),
	'meeting_address' => $address?->getAddressWithoutCountry(),
	'tracking_tools' => $trackingToolsData,
	- 'chat_url' => $registration->getChatURL(),
	+ // 'chat_url' => $registration->getChatURL(), XXX T410560
	'is_test_event' => $registration->getIsTestEvent(),
	'questions' => $registration->getParticipantQuestions(),
	];
	diff --git a/tests/phpunit/unit/Rest/GetEventRegistrationHandlerTest.php b/tests/phpunit/unit/Rest/GetEventRegistrationHandlerTest.php
	index 065ba70d..b07856d1 100644
	--- a/tests/phpunit/unit/Rest/GetEventRegistrationHandlerTest.php
	+++ b/tests/phpunit/unit/Rest/GetEventRegistrationHandlerTest.php
	@@ -127,7 +127,9 @@ class GetEventRegistrationHandlerTest extends MediaWikiUnitTestCase {
	// TODO Check the type when the endpoint will accept it
	$expected = array_diff_key(
	$eventData,
	- [ 'type' => 1, 'timezone' => 1, 'tracking_tool_id' => 1, 'tracking_tool_event_id' => 1 ]
	+ [ 'type' => 1, 'timezone' => 1, 'tracking_tool_id' => 1, 'tracking_tool_event_id' => 1 ],
	+ // XXX T410560
	+ [ 'meeting_url' => 1, 'chat_url' => 1 ],
	);
	$expected['timezone'] = $timezoneName;
	$expected['tracking_tools'] = [
	--
	2.43.0

File Metadata

Mime Type: text/x-diff
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 22542273
Default Alt Text: T410560.patch (3 KB)

T410560.patchDaimonaActions

T410560.patchView Options

File Metadata

Event Timeline

T410560.patch
Daimona
Actions

T410560.patch
View Options