Page MenuHomePhabricator

Titles containing a dot give HTTP 403 when accessed using action=raw and the short URL form
Closed, DeclinedPublic

Event Timeline

TTO created this task.Feb 8 2016, 1:27 AM
TTO updated the task description. (Show Details)
TTO raised the priority of this task from to Needs Triage.
TTO added a subscriber: TTO.
Restricted Application added subscribers: StudiesWorld, Aklapper. · View Herald TranscriptFeb 8 2016, 1:27 AM
TTO added a comment.Feb 8 2016, 1:36 AM

...unless something's changed since 1.26.2: https://translatewiki.net/wiki/Alt._BGN_Series?action=raw

I don't have a local MW copy to test with at the moment.

Krenair added a subscriber: Krenair.Feb 8 2016, 1:46 AM

This comes from WebRequest::checkUrlExtension

ShoutWiki does not have this issue because they run nginx, which is not listed in IEUrlExtension::haveUndecodedRequestUri

TTO added a comment.Feb 8 2016, 2:46 AM

It looks as though the IEUrlExtension code is there to prevent XSS attacks in IE6 and earlier. Is it worth keeping this security shim around for broken old browsers which we no longer support? (Obviously the implications here are different than, say, dropping JS support for old IEs, but I just wonder what our position is on maintaining server-side special cases for IE6 and earlier.)

BBlack added a subscriber: BBlack.Feb 8 2016, 4:35 AM

IE6 is effectively shut out of WMF wikis anyways, because we require HTTPS, and we don't support SSLv3 (or lower), which is the highest version that IE6 accepts.

BBlack added a comment.Feb 8 2016, 4:36 AM

(although I guess there are ways around that which wouldn't likely be popular - e.g. using IE6 behind some trusted proxy doing modern TLS to wikipedia for it)

Johsthao closed this task as a duplicate of T126250: <spam>.Feb 8 2016, 6:24 PM
matmarex reopened this task as Open.Feb 8 2016, 6:32 PM

Previously rejected as T85751 by @brion.

matmarex removed a subscriber: matmarex.Feb 10 2016, 3:38 AM
Krinkle closed this task as Declined.Nov 2 2016, 7:03 PM
Krinkle added a subscriber: Krinkle.

This works as intended. Per T85751, the canonical url for using the action parameter is to go through index.php. The virtual /wiki path is primarily meant for page views only.

This comment was removed by Green_Cardamom.