Author: hightowe

Description:
MediaWiki's handling of Interwiki links seems to not respect the protocol specified in the interwiki.iw_url field, and therefore improperly renders interwiki links using the protocol of the server the rendering is being run on, instead of what is specified in the interwiki.iw_url field in the database.

An example:

mysql> select * from interwiki where iw_prefix like 'wikipedia'\G

• 1. row *******

iw_prefix: wikipedia

iw_url: http://en.wikipedia.org/wiki/$1

iw_local: 0
iw_trans: 0
1 row in set (0.00 sec)

and with that in place, and running from a fictitious URL https://wiki.foo.com/wiki/Bar, the wiki markup [[[Wikipedia:Wiki]] will improperly render a link to https://en.wikipedia.org/wiki/Wiki instead of to http://en.wikipedia.org/wiki/Wiki as it should (note HTTPS vs. HTTP).

Version: 1.12.x
Severity: major