Page Menu
Home
Phabricator
Search
Configure Global Search
Log In
Files
F71110037
T412068.patch
SomeRandomDeveloper
Actions
View File
Edit File
Delete File
View Transforms
Subscribe
Authored By
SomeRandomDeveloper
Dec 17 2025, 10:04 PM
2025-12-17 22:04:34 (UTC+0)
Size
1 KB
Referenced Files
None
Subscribers
None
T412068.patch
View Options
From 9f82d21b3815d496a1786b1b3ab53d5de5ca3e7c Mon Sep 17 00:00:00 2001
From: SomeRandomDeveloper <thisisnotmyname275@gmail.com>
Date: Wed, 17 Dec 2025 23:02:10 +0100
Subject: [PATCH] SECURITY: Replace magic words in InternalParseBeforeLinks
Bug: T412068
Change-Id: I4cfd5f9fbfd1cf95be1997405dc6c89de59dc037
---
extension.json | 2 +-
includes/ApprovedRevsHooks.php | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/extension.json b/extension.json
index 1cbf9f2..8ed0a50 100644
--- a/extension.json
+++ b/extension.json
@@ -108,7 +108,7 @@
"DiffTools": "ApprovedRevsHooks::addApprovalDiffLink",
"BeforeParserFetchTemplateRevisionRecord": "ApprovedRevsHooks::setTranscludedPageRev",
"GetMagicVariableIDs": "ApprovedRevsHooks::addMagicWordVariableIDs",
- "ParserAfterTidy": "ApprovedRevsHooks::handleMagicWords",
+ "InternalParseBeforeLinks": "ApprovedRevsHooks::handleMagicWords",
"ParserGetVariableValueSwitch": "ApprovedRevsHooks::assignAValue",
"ParserFirstCallInit": "ApprovedRevsHooks::registerFunctions",
"AdminLinks": "ApprovedRevsHooks::addToAdminLinks",
diff --git a/includes/ApprovedRevsHooks.php b/includes/ApprovedRevsHooks.php
index b124f13..933d09b 100644
--- a/includes/ApprovedRevsHooks.php
+++ b/includes/ApprovedRevsHooks.php
@@ -954,7 +954,7 @@ class ApprovedRevsHooks {
}
/**
- * Hook: ParserAfterTidy
+ * Hook: InternalParseBeforeLinks
*
* Set values in the page_props table based on the presence of the
* 'APPROVEDREVS' magic word in a page
--
2.52.0
File Metadata
Details
Attached
Mime Type
text/x-diff
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
22748463
Default Alt Text
T412068.patch (1 KB)
Attached To
Mode
T412068: CVE-2026-22712: ApprovedRevs allows bypassing the inline CSS sanitizer due to magic word replacement in ParserAfterTidy
Attached
Detach File
Event Timeline
Log In to Comment