Page MenuHomePhabricator
Files F4284745

T139565-REL1_23.patch
No One
Actions

Authored By
Bawolff
Jul 18 2016, 8:29 AM
Size
2 KB
Referenced Files
None
Subscribers
None

T139565-REL1_23.patch
View Options

From abd34395697e7f467b4cf81037153db2ccd18646 Mon Sep 17 00:00:00 2001
From: Brad Jorsch <bjorsch@wikimedia.org>
Date: Thu, 7 Jul 2016 09:40:57 -0400
Subject: [PATCH] SECURITY: API: Generate head items in the context of the
given title
$context->getOutput() returns an OutputPage tied to the main
RequestContext at the root of the chain, not to the modified context
we're actually using.
Bug: T139565
Change-Id: Ie086d7f2ad3f7b5f50e3a2f83b1680e760b85e5e
---
includes/api/ApiParse.php | 15 ++++++++++-----
1 file changed, 10 insertions(+), 5 deletions(-)
diff --git a/includes/api/ApiParse.php b/includes/api/ApiParse.php
index 03a6b42..52fdeda 100644
--- a/includes/api/ApiParse.php
+++ b/includes/api/ApiParse.php
@@ -333,16 +333,21 @@ class ApiParse extends ApiBase {
}
if ( isset( $prop['headitems'] ) || isset( $prop['headhtml'] ) ) {
- $context = $this->getContext();
+ $context = new DerivativeContext( $this->getContext() );
$context->setTitle( $titleObj );
- $context->getOutput()->addParserOutputNoText( $p_result );
+ $context->setWikiPage( $pageObj );
+
+ // We need an OutputPage tied to $context, not to the
+ // RequestContext at the root of the stack.
+ $output = new OutputPage( $context );
+ $output->addParserOutputNoText( $p_result );
if ( isset( $prop['headitems'] ) ) {
$headItems = $this->formatHeadItems( $p_result->getHeadItems() );
- $css = $this->formatCss( $context->getOutput()->buildCssLinksArray() );
+ $css = $this->formatCss( $output->buildCssLinksArray() );
- $scripts = array( $context->getOutput()->getHeadScripts() );
+ $scripts = array( $output->getHeadScripts() );
$result_array['headitems'] = array_merge( $headItems, $css, $scripts );
}
@@ -351,7 +356,7 @@ class ApiParse extends ApiBase {
$result_array['headhtml'] = array();
ApiResult::setContent(
$result_array['headhtml'],
- $context->getOutput()->headElement( $context->getSkin() )
+ $output->headElement( $context->getSkin() )
);
}
}
--
2.0.1

File Metadata

Mime Type
text/x-diff
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
3873714
Default Alt Text
T139565-REL1_23.patch (2 KB)

Event Timeline

Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits