Page MenuHomePhabricator

wfFindFile should check namespace of given title
Closed, ResolvedPublic


When give a Title object to wfFindFile the namespace is not check. It is possible to put in a Tilte with "Project:Wiki.png" and the function give the file "Wiki.png" back.

In my opinion it is better to check the namespace of the given title against NS_FILE. Thanks.

Version: unspecified
Severity: minor



Event Timeline

bzimport raised the priority of this task from to Medium.Nov 21 2014, 11:15 PM
bzimport set Reference to bz25670.
bzimport added a subscriber: Unknown Object (MLST).

wfFindFile() triggers findFile() in FileRepo.php and RepoGroup.php...

It is indeed true that atm, the File namespace is not enforced... I'm not sure what the best place is to enforce this atm.

Perhaps in newFile() of FileRepo.php ? We have to account for NS_MEDIA as well btw.