Page MenuHomePhabricator

HTML sanitizing of extmetadata makes hidden content visible
Closed, ResolvedPublic

Description

Some templates store metadata in display:none-ed text; MediaViewer's whitelistHtml function makes this metadata visible. E.g. permission text shown for PD images starts with "Public domainPublic domainfalsefalse".


Version: unspecified
Severity: normal
URL: https://www.mediawiki.org/wiki/File:Annotated_screenshot_of_bug_in_Media_Viewer%27s_license_display.png

Details

Reference
bz63126

Event Timeline

bzimport raised the priority of this task from to Needs Triage.
bzimport set Reference to bz63126.
bzimport added a subscriber: Unknown Object (MLST).
Tgr created this task.Mar 26 2014, 6:22 PM

Change 121282 had a related patch set uploaded by Gergő Tisza:
Utilities to transform HTML to plain or filtered tests

https://gerrit.wikimedia.org/r/121282

Change 121282 merged by jenkins-bot:
Utilities to transform HTML to plain or filtered text

https://gerrit.wikimedia.org/r/121282

Gilles moved this task from Untriaged to Done on the Multimedia board.Dec 4 2014, 10:11 AM
Gilles triaged this task as Unbreak Now! priority.
Gilles lowered the priority of this task from Unbreak Now! to Needs Triage.Dec 4 2014, 11:22 AM