Page MenuHomePhabricator

Automatic subst-ing of templates in user signature is easily circumvented
Open, LowestPublic

Description

Since r12486, templates within user signature are always substed (by automatic modification (see Parser::cleanSig) upon saving of user preferences), which is probably meant to decrease the server load.

However, since {{subst:X}} substitutes only the first level of template transclusion, this feature is very easily circumvented: you only need to create a page containing the desired template call and use this page as your signature.

The most straightforward idea how to solve this could be to introduce the desired {{substall:X}} functionality (see T4777: Provide a recursive subst: function in the PST – {{substall:foo}}) and use that instead of plain subst. Or, you could maybe ensure the full recursive substing during parsing of ~~~[~] (somewhere around Parser::getUserSig), but I guess it would be not much compatible with the current parser design.

Details

Reference
bz12495

Event Timeline

bzimport raised the priority of this task from to Low.Nov 21 2014, 10:00 PM
bzimport set Reference to bz12495.
bzimport added a subscriber: Unknown Object (MLST).
Mormegil created this task.Jan 3 2008, 8:05 PM
Meno25 removed a subscriber: Meno25.Jan 17 2017, 4:16 PM
Aklapper lowered the priority of this task from Low to Lowest.Sun, Oct 6, 10:00 PM
Aklapper removed a project: Parser.
Aklapper updated the task description. (Show Details)
Aklapper removed a subscriber: wikibugs-l-list.
Restricted Application added a subscriber: Liuxinyu970226. · View Herald TranscriptSun, Oct 6, 10:00 PM