Author: sent

Description:
I also had found some familiar bug (http://bugzilla.wikimedia.org/show_bug.cgi?id=5253), but this one is kind of different:

I created a generic Wiki-Markup extension (http://www.mediawiki.org/wiki/Extending_wiki_markup), let's call it <php>, to process its contents. Everybody knows how PHP works so I don't need to give a <php></php> example.

That was step 1. Everything works. Even <php name="world">echo 'hello '.$argv['name'];</php> gives "hello world".

My problem:

I created a nice snip-let of code. And saved in a Template, lets say: Template:Example.

Now I call {{Example|{{My name}}|Your wife}} where Template:Example contains (at least) <php name="{{{1|}}}" does="{{{2|nobody}}}">..</php>

My problem: $argv['name'] and $argv['does'] are still in the form of '{{{1|}}}'.

disclaimer: I run a only (to edit) registered wiki [MediaWiki as content management system], so I don't worry (to much) about security risks of including PHP code in my website because I trust all users: Myself :D. Passwords and other critical information are still in Non-wiki php-documents, and will remain there.

Version: 1.6.x
Severity: trivial