In EditPage:

				$returntoquery = array_diff_key(
					$this->context->getRequest()->getValues(),
					[ 'title' => true, 'returnto' => true, 'returntoquery' => true ]
				);
				$out->wrapWikiMsg(
					"<div id='mw-anon-edit-warning' class='warningbox'>\n$1\n</div>",
					[ 'anoneditwarning',
						// Log-in link
						SpecialPage::getTitleFor( 'Userlogin' )->getFullURL( [
							'returnto' => $this->getTitle()->getPrefixedDBkey(),
							'returntoquery' => wfArrayToCgi( $returntoquery ),
						] ),
						// Sign-up link
						SpecialPage::getTitleFor( 'CreateAccount' )->getFullURL( [
							'returnto' => $this->getTitle()->getPrefixedDBkey(),
							'returntoquery' => wfArrayToCgi( $returntoquery ),
						] )
					]
				);

$returntoquery should use WebRequest::getQueryValues() instead of trying to embed all POST values in the URL too.

I'm guessing this may be a dupe... And probably doesn't need to be a security bug; I just filed it as such I didn't have to worry too much what params were actually in the pasted text

It seems that this is no longer reproducible (as far as I can tell, we only display this message when the form has not been POST-ed now), but it would still be nice to change this code, to avoid this bad pattern being copied elsewhere. (e.g. T309907)

@sbassett There's no security issue here, could you please make this task public?

(I submitted a patch at https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1091844)

Change #1091844 merged by jenkins-bot:

[mediawiki/core@master] Don't copy POST query params when generating link/redirect URLs

https://gerrit.wikimedia.org/r/1091844