andersk wrote:

This is also a problem when the database name contains a + sign (my database
host only lets me create databases named username+suffix), and possibly other
characters.

Can you post your patch?

andersk wrote:

Or I could post my own:
http://web.mit.edu/~andersk/Public/mediawiki-cookieprefix.patch

andersk wrote:

I experimentally determined an exaustive list of bad characters:

=,; +."'\[

The first four are disallowed, the next two are silently converted into _, the
next three are silently escaped with a backslash, and the last is used for
cookie arrays. I've updated my patch to replace all these characters with _:

<http://web.mit.edu/~andersk/Public/mediawiki-cookieprefix.patch>

andersk wrote:

Huh. It seems that all of my patch got applied in 1.5.7 except the one important
line, which now needs to be:

$wgCookiePrefix = strtr($wgCookiePrefix, "=,; +.\"\'\\[", "__________");

mquinton wrote:

this probleme is still present with MediaWiki 1.1.7. You can edit
includes/Setup.php, line 119, just add :

$wgCookiePrefix = str_replace('.', '_', $wgCookiePrefix);

Created attachment 3453
Remove bad characters from the cookie name

It might fix Bug 3535 too.

attachment armored_cookie_name.patch ignored as obsolete

Uh, that str_replace in the patch doesn't sound like it'll do the job.

andersk wrote:

What exactly is wrong with my patch (see comment #3 and comment #4)? I’ve had
this carefully designed, well tested, working patch sitting around for over a
year, deployed on several production wikis—and for some unfathomable reason,
everyone is trying to (incorrectly!) rewrite the one critical line of it that
wasn't already integrated in 1.5.7…

$wgCookiePrefix = strtr($wgCookiePrefix, "=,; +.\"\'\\[", "__________");

andersk wrote:

The remaining one line of my patch.

attachment mediawiki-fix-cookieprefix.patch ignored as obsolete

ayg wrote:

Note that it should probably be

"=,; +.\"'\\["

i.e., minus the extra \ before the '. That will be printed literally,
otherwise, making it 11 characters -> 10 characters. It could even be

"=,; +.\"'\["

With that modification the patch should work as intended (rather than almost as
intended, with [ not getting converted: "the extra characters in the longer of
the two are ignored"). Sorry for the delay, we can take a while on these things
if we get to them at all . . .

andersk wrote:

The remaining one line of my patch, revised

Thanks, that’s more helpful. Here’s a revised patch.

Attached:

Applied in r21580