r107074 MediaWiki - Code Review archive

Repository:MediaWiki
Revision:r107073‎ | r107074 | r107075 >
Date:16:14, 22 December 2011
Author:hashar
Status:reverted (Comments)
Tags:
Comment:
make sure the line ID is an integer before injecting it

Might prevents a CSS attack of some sort. I am not an expert on this
topic. That follow up Tim CR on r95690.
Modified paths:
  • /trunk/extensions/CodeReview/modules/ext.codereview.linecomment.js (modified) (history)

Diff [purge]

Index: trunk/extensions/CodeReview/modules/ext.codereview.linecomment.js
@@ -17,7 +17,10 @@
1818 * @param lineCode jQuery object
1919 */
2020 lcShowForm: function( lineCode ) {
21 - var htmlId = 'comment-for-' + lineCode.attr('id');
 21+ // Make sure the line id is an integer:
 22+ var lineNumber = parseInt( lineCode.attr('id') ) + 0;
 23+ // Forge the line comment HTML id:
 24+ var htmlId = 'comment-for-' + lineNumber;
2225
2326 lineCode.unbind( 'click' );
2427 lineCode.click( function () {

Follow-up revisions

RevisionCommit summaryAuthorDate
r108350Reverting inline commenting from CodeReview...johnduhart06:55, 8 January 2012

Past revisions this follows-up on

RevisionCommit summaryAuthorDate
r95680(bug 30617) inline comments forms cannot be closed...hashar17:31, 29 August 2011

Comments

#Comment by Hashar (talk | contribs)   16:23, 22 December 2011

It follow up r95680 (eighty, not ninety).

Status & tagging log