Page Menu
Home
Phabricator
Search
Configure Global Search
Log In
Files
F2248
patch
Public
Actions
View File
Edit File
Delete File
View Transforms
Subscribe
Mute Notifications
Award Token
Flag For Later
Authored By
•
bzimport
Nov 21 2014, 8:46 PM
2014-11-21 20:46:56 (UTC+0)
Size
11 KB
Referenced Files
None
Subscribers
None
patch
View Options
Index: includes/Article.php
===================================================================
RCS file: /cvsroot/wikipedia/phase3/includes/Article.php,v
retrieving revision 1.376
diff -u -r1.376 Article.php
--- includes/Article.php 25 Aug 2005 04:23:13 -0000 1.376
+++ includes/Article.php 29 Aug 2005 20:00:26 -0000
@@ -758,7 +758,7 @@
}
if ( '' != $this->mRedirectedFrom ) {
$sk = $wgUser->getSkin();
- $redir = $sk->makeKnownLink( $this->mRedirectedFrom, '',
+ $redir = $sk->makeKnownLink( htmlspecialchars( $this->mRedirectedFrom ), '',
'redirect=no' );
$s = wfMsg( 'redirectedfrom', $redir );
$wgOut->setSubtitle( $s );
@@ -1505,7 +1505,7 @@
$wgOut->setRobotpolicy( 'noindex,follow' );
$link = $this->mTitle->getPrefixedText();
- $text = wfMsg( 'addedwatchtext', $link );
+ $text = wfMsg( 'addedwatchtext', htmlspecialchars( $link ) );
$wgOut->addWikiText( $text );
}
@@ -1540,7 +1540,7 @@
$wgOut->setRobotpolicy( 'noindex,follow' );
$link = $this->mTitle->getPrefixedText();
- $text = wfMsg( 'removedwatchtext', $link );
+ $text = wfMsg( 'removedwatchtext', htmlspecialchars( $link ) );
$wgOut->addWikiText( $text );
}
@@ -1866,7 +1866,7 @@
$wgOut->setRobotpolicy( 'noindex,nofollow' );
$loglink = '[[Special:Log/delete|' . wfMsg( 'deletionlog' ) . ']]';
- $text = wfMsg( 'deletedtext', $deleted, $loglink );
+ $text = wfMsg( 'deletedtext', htmlspecialchars( $deleted ), $loglink );
$wgOut->addWikiText( $text );
$wgOut->returnToMain( false );
Index: includes/Parser.php
===================================================================
RCS file: /cvsroot/wikipedia/phase3/includes/Parser.php,v
retrieving revision 1.501
diff -u -r1.501 Parser.php
--- includes/Parser.php 23 Aug 2005 21:49:48 -0000 1.501
+++ includes/Parser.php 29 Aug 2005 20:00:29 -0000
@@ -1883,7 +1883,7 @@
case MAG_CURRENTDAY:
return $varCache[$index] = $wgContLang->formatNum( date('j') );
case MAG_PAGENAME:
- return $this->mTitle->getText();
+ return Sanitizer::wikiSanitize( $this->mTitle->getText() );
case MAG_PAGENAMEE:
return $this->mTitle->getPartialURL();
case MAG_REVISIONID:
Index: includes/Sanitizer.php
===================================================================
RCS file: /cvsroot/wikipedia/phase3/includes/Sanitizer.php,v
retrieving revision 1.23
diff -u -r1.23 Sanitizer.php
--- includes/Sanitizer.php 23 Aug 2005 21:49:48 -0000 1.23
+++ includes/Sanitizer.php 29 Aug 2005 20:00:29 -0000
@@ -1017,6 +1017,49 @@
return $text;
}
+ /**
+ * Take a string and sanitize it for Wiki syntax. The result will be a string
+ * that can be displayed as though it were within <nowiki> tags. This is used
+ * by the PAGENAME variable. Consider the article entitled *, or '', or &, or
+ * ==foo==, or ;foo, or ----, or ~~~~
+ *
+ * NOTE: We assume $str consists of only 1 line! Easy enough to fix if the more
+ * general behavior is ever needed.
+ *
+ * @param string $str Text fragment
+ * @return string
+ */
+ function wikiSanitize( $str ) {
+ # Note the order of the arrays below is important. & has to go before #,
+ # which in turn has to go before all numeric references. If # is before &,
+ # then # gets replaced with &#35;. If * is before #, * gets replaced
+ # with &#42;.
+
+ # The PHP documentation doesn't appear to guarantee this behavior, so there's
+ # some danger it will change.
+
+ # Note _ has to be changed to _ to sanitize __NOTOC__ and related commands.
+ $str = str_replace(
+ array('&', '<', '>', '#', '\'', '*', '|',
+ '[', ']', '{', '}', '=',
+ ':', '-', '~', '_'),
+ array('&', '<', '>', '#, ''', '*', '|',
+ '[', ']', '{', '}', '=',
+ ':', '-', '~', '_'),
+ $str );
+
+ # Replace initial ; with ;. ; only has meaning in wiki syntax at the beginning
+ # of a line anyway, and we can't put it in the str_replace call above, because then
+ # & becomes &;.
+
+ # Note that we could do the same thing for *, =, -, and :. Only makes a difference
+ # for {{subst:PAGENAME}} anyway.
+ if ($str[0] == ';')
+ $str = ';' . substr($str, 1);
+
+ return $str;
+ }
+
}
?>
Index: includes/Skin.php
===================================================================
RCS file: /cvsroot/wikipedia/phase3/includes/Skin.php,v
retrieving revision 1.377
diff -u -r1.377 Skin.php
--- includes/Skin.php 25 Aug 2005 00:39:07 -0000 1.377
+++ includes/Skin.php 29 Aug 2005 20:00:30 -0000
@@ -567,7 +567,7 @@
}
return wfMsg( $msg,
$this->makeKnownLink(
- $wgContLang->SpecialPage( 'Undelete/' . $wgTitle->getPrefixedDBkey() ),
+ $wgContLang->SpecialPage( 'Undelete/' . htmlspecialchars( $wgTitle->getPrefixedDBkey() ) ),
wfMsg( 'restorelink' . ($n == 1 ? '1' : ''), $n ) ) );
}
return '';
Index: includes/SpecialMovepage.php
===================================================================
RCS file: /cvsroot/wikipedia/phase3/includes/SpecialMovepage.php,v
retrieving revision 1.67
diff -u -r1.67 SpecialMovepage.php
--- includes/SpecialMovepage.php 26 Aug 2005 21:40:21 -0000 1.67
+++ includes/SpecialMovepage.php 29 Aug 2005 20:00:30 -0000
@@ -128,7 +128,7 @@
<table border='0'>
<tr>
<td align='right'>{$movearticle}:</td>
- <td align='left'><strong>{$oldTitle}</strong></td>
+ <td align='left'><strong>{$encOldTitle}</strong></td>
</tr>
<tr>
<td align='right'>{$newtitle}:</td>
@@ -179,8 +179,8 @@
# Variables beginning with 'o' for old article 'n' for new article
- $ot = Title::newFromText( $this->oldTitle );
- $nt = Title::newFromText( $this->newTitle );
+ $ot = Title::newFromText( htmlspecialchars( $this->oldTitle ) );
+ $nt = Title::newFromText( htmlspecialchars( $this->newTitle ) );
# Delete to make way if requested
if ( $wgUser->isAllowed( 'delete' ) && $this->deleteAndMove ) {
@@ -243,7 +243,7 @@
$newtitle = $wgRequest->getVal('newtitle');
$talkmoved = $wgRequest->getVal('talkmoved');
- $text = wfMsg( 'pagemovedtext', $oldtitle, $newtitle );
+ $text = wfMsg( 'pagemovedtext', htmlspecialchars( $oldtitle ), htmlspecialchars( $newtitle ) );
# Temporarily disable raw html wikitext option out of XSS paranoia
$marchingantofdoom = $wgRawHtml;
Index: includes/SpecialUndelete.php
===================================================================
RCS file: /cvsroot/wikipedia/phase3/includes/SpecialUndelete.php,v
retrieving revision 1.64
diff -u -r1.64 SpecialUndelete.php
--- includes/SpecialUndelete.php 20 Aug 2005 18:46:06 -0000 1.64
+++ includes/SpecialUndelete.php 29 Aug 2005 20:00:31 -0000
@@ -491,7 +491,7 @@
if( !is_null( $this->mTargetObj ) ) {
$archive = new PageArchive( $this->mTargetObj );
if( $archive->undelete( $this->mTargetTimestamp ) ) {
- $wgOut->addWikiText( wfMsg( "undeletedtext", $this->mTarget ) );
+ $wgOut->addWikiText( wfMsg( "undeletedtext", htmlspecialchars( $this->mTarget ) ) );
if (NS_IMAGE == $this->mTargetObj->getNamespace()) {
/* refresh image metadata cache */
Index: includes/SpecialWatchlist.php
===================================================================
RCS file: /cvsroot/wikipedia/phase3/includes/SpecialWatchlist.php,v
retrieving revision 1.68
diff -u -r1.68 SpecialWatchlist.php
--- includes/SpecialWatchlist.php 28 Aug 2005 00:29:14 -0000 1.68
+++ includes/SpecialWatchlist.php 29 Aug 2005 20:00:31 -0000
@@ -177,9 +177,9 @@
htmlspecialchars( $s->wl_title ) . '" in namespace ' . $s->wl_namespace . " -->\n"
);
} else {
- $t = $t->getPrefixedText();
+ $t = htmlspecialchars( $t->getPrefixedText() );
$wgOut->addHTML(
- '<li><input type="checkbox" name="id[]" value="' . htmlspecialchars($t) . '" />' .
+ '<li><input type="checkbox" name="id[]" value="' . $t . '" />' .
$sk->makeLink( $t, $t ) .
"</li>\n"
);
Index: includes/Title.php
===================================================================
RCS file: /cvsroot/wikipedia/phase3/includes/Title.php,v
retrieving revision 1.230
diff -u -r1.230 Title.php
--- includes/Title.php 27 Aug 2005 03:56:58 -0000 1.230
+++ includes/Title.php 29 Aug 2005 20:00:32 -0000
@@ -1732,7 +1732,7 @@
$wgLinkCache->clearLink( $nt->getPrefixedDBkey() );
# Recreate the redirect, this time in the other direction.
- $redirectText = $wgMwRedir->getSynonym( 0 ) . ' [[' . $nt->getPrefixedText() . "]]\n";
+ $redirectText = $wgMwRedir->getSynonym( 0 ) . ' [[' . htmlspecialchars( $nt->getPrefixedText() ) . "]]\n";
$redirectArticle = new Article( $this );
$newid = $redirectArticle->insertOn( $dbw );
$redirectRevision = new Revision( array(
@@ -1808,7 +1808,7 @@
$wgLinkCache->clearLink( $nt->getPrefixedDBkey() );
# Insert redirect
- $redirectText = $wgMwRedir->getSynonym( 0 ) . ' [[' . $nt->getPrefixedText() . "]]\n";
+ $redirectText = $wgMwRedir->getSynonym( 0 ) . ' [[' . htmlspecialchars( $nt->getPrefixedText() ) . "]]\n";
$redirectArticle = new Article( $this );
$newid = $redirectArticle->insertOn( $dbw );
$redirectRevision = new Revision( array(
Index: languages/Language.php
===================================================================
RCS file: /cvsroot/wikipedia/phase3/languages/Language.php,v
retrieving revision 1.665
diff -u -r1.665 Language.php
--- languages/Language.php 28 Aug 2005 00:15:12 -0000 1.665
+++ languages/Language.php 29 Aug 2005 20:00:35 -0000
@@ -839,7 +839,7 @@
'preferences' => 'Preferences',
'prefsnologin' => 'Not logged in',
'prefsnologintext' => "You must be [[Special:Userlogin|logged in]] to set user preferences.",
-'prefslogintext' => "You are logged in as \"$1\".
+'prefslogintext' => "You are logged in as \"<nowiki>$1</nowiki>\".
Your internal ID number is $2.
See [[Project:User preferences help]] for help deciphering the options.",
@@ -1205,14 +1205,14 @@
'watchnologin' => 'Not logged in',
'watchnologintext' => 'You must be [[Special:Userlogin|logged in]] to modify your watchlist.',
'addedwatch' => 'Added to watchlist',
-'addedwatchtext' => "The page \"$1\" has been added to your [[Special:Watchlist|watchlist]].
+'addedwatchtext' => "The page \"<nowiki>$1</nowiki>\" has been added to your [[Special:Watchlist|watchlist]].
Future changes to this page and its associated Talk page will be listed there,
and the page will appear '''bolded''' in the [[Special:Recentchanges|list of recent changes]] to
make it easier to pick out.
<p>If you want to remove the page from your watchlist later, click \"Unwatch\" in the sidebar.",
'removedwatch' => 'Removed from watchlist',
-'removedwatchtext' => "The page \"$1\" has been removed from your watchlist.",
+'removedwatchtext' => "The page \"<nowiki>$1</nowiki>\" has been removed from your watchlist.",
'watch' => 'Watch',
'watchthispage' => 'Watch this page',
'unwatch' => 'Unwatch',
@@ -1289,7 +1289,7 @@
consequences, and that you are doing this in accordance with
[[Project:Policy]].",
'actioncomplete' => 'Action complete',
-'deletedtext' => "\"$1\" has been deleted.
+'deletedtext' => "\"<nowiki>$1</nowiki>\" has been deleted.
See $2 for a record of recent deletions.",
'deletedarticle' => "deleted \"[[$1]]\"",
'dellogpage' => 'Deletion_log',
@@ -1347,7 +1347,7 @@
'undeletebtn' => 'Restore!',
'undeletedarticle' => "restored \"[[$1]]\"",
'undeletedrevisions' => "$1 revisions restored",
-'undeletedtext' => "[[$1]] has been successfully restored.
+'undeletedtext' => "[[:<nowiki>$1</nowiki>]] has been successfully restored.
See [[Special:Log/delete]] for a record of recent deletions and restorations.",
# Namespace form on various pages
@@ -1556,7 +1556,7 @@
'newtitle' => 'To new title',
'movepagebtn' => 'Move page',
'pagemovedsub' => 'Move succeeded',
-'pagemovedtext' => "Page \"[[$1]]\" moved to \"[[$2]]\".",
+'pagemovedtext' => "Page \"[[<nowiki>$1</nowiki>]]\" moved to \"[[<nowiki>$2</nowiki>]]\".",
'articleexists' => 'A page of that name already exists, or the
name you have chosen is not valid.
Please choose another name.',
File Metadata
Details
Attached
Mime Type
text/x-diff
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
1824
Default Alt Text
patch (11 KB)
Attached To
Mode
T5243: & in page titles is not appropriately escaped in various cases
Attached
Detach File
Event Timeline
Log In to Comment