| Index: branches/REL1_17/phase3/maintenance/tests/parser/parserTests.txt |
| — | — | @@ -8306,6 +8306,87 @@ |
| 8307 | 8307 | !! end |
| 8308 | 8308 | |
| 8309 | 8309 | |
| | 8310 | +!! test |
| | 8311 | +Strip marker in urlencode |
| | 8312 | +!! input |
| | 8313 | +{{urlencode:x<nowiki/>y}} |
| | 8314 | +{{urlencode:x<nowiki/>y|wiki}} |
| | 8315 | +{{urlencode:x<nowiki/>y|path}} |
| | 8316 | +!! result |
| | 8317 | +<p>xy |
| | 8318 | +xy |
| | 8319 | +xy |
| | 8320 | +</p> |
| | 8321 | +!! end |
| | 8322 | + |
| | 8323 | +!! test |
| | 8324 | +Strip marker in lc |
| | 8325 | +!! input |
| | 8326 | +{{lc:x<nowiki/>y}} |
| | 8327 | +!! result |
| | 8328 | +<p>xy |
| | 8329 | +</p> |
| | 8330 | +!! end |
| | 8331 | + |
| | 8332 | +!! test |
| | 8333 | +Strip marker in uc |
| | 8334 | +!! input |
| | 8335 | +{{uc:x<nowiki/>y}} |
| | 8336 | +!! result |
| | 8337 | +<p>XY |
| | 8338 | +</p> |
| | 8339 | +!! end |
| | 8340 | + |
| | 8341 | +!! test |
| | 8342 | +Strip marker in formatNum |
| | 8343 | +!! input |
| | 8344 | +{{formatnum:1<nowiki/>2}} |
| | 8345 | +{{formatnum:1<nowiki/>2|R}} |
| | 8346 | +!! result |
| | 8347 | +<p>12 |
| | 8348 | +12 |
| | 8349 | +</p> |
| | 8350 | +!! end |
| | 8351 | + |
| | 8352 | +!! test |
| | 8353 | +Strip marker in grammar |
| | 8354 | +!! options |
| | 8355 | +language=fi |
| | 8356 | +!! input |
| | 8357 | +{{grammar:elative|foo<nowiki/>bar}} |
| | 8358 | +!! result |
| | 8359 | +<p>foobarista |
| | 8360 | +</p> |
| | 8361 | +!! end |
| | 8362 | + |
| | 8363 | +!! test |
| | 8364 | +Strip marker in padleft |
| | 8365 | +!! input |
| | 8366 | +{{padleft:|2|x<nowiki/>y}} |
| | 8367 | +!! result |
| | 8368 | +<p>xy |
| | 8369 | +</p> |
| | 8370 | +!! end |
| | 8371 | + |
| | 8372 | +!! test |
| | 8373 | +Strip marker in padright |
| | 8374 | +!! input |
| | 8375 | +{{padright:|2|x<nowiki/>y}} |
| | 8376 | +!! result |
| | 8377 | +<p>xy |
| | 8378 | +</p> |
| | 8379 | +!! end |
| | 8380 | + |
| | 8381 | +!! test |
| | 8382 | +Strip marker in anchorencode |
| | 8383 | +!! input |
| | 8384 | +{{anchorencode:x<nowiki/>y}} |
| | 8385 | +!! result |
| | 8386 | +<p>xy |
| | 8387 | +</p> |
| | 8388 | +!! end |
| | 8389 | + |
| | 8390 | + |
| 8310 | 8391 | TODO: |
| 8311 | 8392 | more images |
| 8312 | 8393 | more tables |
| Property changes on: branches/REL1_17/phase3/maintenance/tests/parser/parserTests.txt |
| ___________________________________________________________________ |
| Modified: svn:mergeinfo |
| 8313 | 8394 | Merged /branches/REL1_18/phase3/tests/parser/parserTests.txt:r114338 |
| Index: branches/REL1_17/phase3/includes/parser/Parser.php |
| — | — | @@ -5216,6 +5216,16 @@ |
| 5217 | 5217 | } |
| 5218 | 5218 | |
| 5219 | 5219 | /** |
| | 5220 | + * Remove any strip markers found in the given text. |
| | 5221 | + * |
| | 5222 | + * @param $text Input string |
| | 5223 | + * @return string |
| | 5224 | + */ |
| | 5225 | + function killMarkers( $text ) { |
| | 5226 | + return preg_replace( "/{$this->mUniqPrefix}[^\x7f]+" . self::MARKER_SUFFIX . '/', '', $text ); |
| | 5227 | + } |
| | 5228 | + |
| | 5229 | + /** |
| 5220 | 5230 | * TODO: document |
| 5221 | 5231 | * @param $data Array |
| 5222 | 5232 | * @param $intPrefix String unique identifying prefix |
| Property changes on: branches/REL1_17/phase3/includes/parser/Parser.php |
| ___________________________________________________________________ |
| Modified: svn:mergeinfo |
| 5223 | 5233 | Merged /branches/REL1_18/phase3/includes/parser/Parser.php:r114338 |
| Index: branches/REL1_17/phase3/includes/parser/CoreParserFunctions.php |
| — | — | @@ -149,17 +149,21 @@ |
| 150 | 150 | |
| 151 | 151 | // Encode as though it's a wiki page, '_' for ' '. |
| 152 | 152 | case 'url_wiki': |
| 153 | | - return wfUrlencode( str_replace( ' ', '_', $s ) ); |
| | 153 | + $func = 'wfUrlencode'; |
| | 154 | + $s = str_replace( ' ', '_', $s ); |
| | 155 | + break; |
| 154 | 156 | |
| 155 | 157 | // Encode for an HTTP Path, '%20' for ' '. |
| 156 | 158 | case 'url_path': |
| 157 | | - return rawurlencode( $s ); |
| | 159 | + $func = 'rawurlencode'; |
| | 160 | + break; |
| 158 | 161 | |
| 159 | 162 | // Encode for HTTP query, '+' for ' '. |
| 160 | 163 | case 'url_query': |
| 161 | 164 | default: |
| 162 | | - return urlencode( $s ); |
| | 165 | + $func = 'urlencode'; |
| 163 | 166 | } |
| | 167 | + return $parser->markerSkipCallback( $s, $func ); |
| 164 | 168 | } |
| 165 | 169 | |
| 166 | 170 | static function lcfirst( $parser, $s = '' ) { |
| — | — | @@ -174,20 +178,12 @@ |
| 175 | 179 | |
| 176 | 180 | static function lc( $parser, $s = '' ) { |
| 177 | 181 | global $wgContLang; |
| 178 | | - if ( is_callable( array( $parser, 'markerSkipCallback' ) ) ) { |
| 179 | | - return $parser->markerSkipCallback( $s, array( $wgContLang, 'lc' ) ); |
| 180 | | - } else { |
| 181 | | - return $wgContLang->lc( $s ); |
| 182 | | - } |
| | 182 | + return $parser->markerSkipCallback( $s, array( $wgContLang, 'lc' ) ); |
| 183 | 183 | } |
| 184 | 184 | |
| 185 | 185 | static function uc( $parser, $s = '' ) { |
| 186 | 186 | global $wgContLang; |
| 187 | | - if ( is_callable( array( $parser, 'markerSkipCallback' ) ) ) { |
| 188 | | - return $parser->markerSkipCallback( $s, array( $wgContLang, 'uc' ) ); |
| 189 | | - } else { |
| 190 | | - return $wgContLang->uc( $s ); |
| 191 | | - } |
| | 187 | + return $parser->markerSkipCallback( $s, array( $wgContLang, 'uc' ) ); |
| 192 | 188 | } |
| 193 | 189 | |
| 194 | 190 | static function localurl( $parser, $s = '', $arg = null ) { return self::urlFunction( 'getLocalURL', $s, $arg ); } |
| — | — | @@ -219,15 +215,17 @@ |
| 220 | 216 | } |
| 221 | 217 | } |
| 222 | 218 | |
| 223 | | - static function formatNum( $parser, $num = '', $raw = null) { |
| 224 | | - if ( self::israw( $raw ) ) { |
| 225 | | - return $parser->getFunctionLang()->parseFormattedNumber( $num ); |
| | 219 | + static function formatnum( $parser, $num = '', $raw = null) { |
| | 220 | + if ( self::isRaw( $raw ) ) { |
| | 221 | + $func = array( $parser->getFunctionLang(), 'parseFormattedNumber' ); |
| 226 | 222 | } else { |
| 227 | | - return $parser->getFunctionLang()->formatNum( $num ); |
| | 223 | + $func = array( $parser->getFunctionLang(), 'formatNum' ); |
| 228 | 224 | } |
| | 225 | + return $parser->markerSkipCallback( $num, $func ); |
| 229 | 226 | } |
| 230 | 227 | |
| 231 | 228 | static function grammar( $parser, $case = '', $word = '' ) { |
| | 229 | + $word = $parser->killMarkers( $word ); |
| 232 | 230 | return $parser->getFunctionLang()->convertGrammar( $word, $case ); |
| 233 | 231 | } |
| 234 | 232 | |
| — | — | @@ -555,7 +553,8 @@ |
| 556 | 554 | /** |
| 557 | 555 | * Unicode-safe str_pad with the restriction that $length is forced to be <= 500 |
| 558 | 556 | */ |
| 559 | | - static function pad( $string, $length, $padding = '0', $direction = STR_PAD_RIGHT ) { |
| | 557 | + static function pad( $parser, $string, $length, $padding = '0', $direction = STR_PAD_RIGHT ) { |
| | 558 | + $padding = $parser->killMarkers( $padding ); |
| 560 | 559 | $lengthOfPadding = mb_strlen( $padding ); |
| 561 | 560 | if ( $lengthOfPadding == 0 ) return $string; |
| 562 | 561 | |
| — | — | @@ -579,14 +578,15 @@ |
| 580 | 579 | } |
| 581 | 580 | |
| 582 | 581 | static function padleft( $parser, $string = '', $length = 0, $padding = '0' ) { |
| 583 | | - return self::pad( $string, $length, $padding, STR_PAD_LEFT ); |
| | 582 | + return self::pad( $parser, $string, $length, $padding, STR_PAD_LEFT ); |
| 584 | 583 | } |
| 585 | 584 | |
| 586 | 585 | static function padright( $parser, $string = '', $length = 0, $padding = '0' ) { |
| 587 | | - return self::pad( $string, $length, $padding ); |
| | 586 | + return self::pad( $parser, $string, $length, $padding ); |
| 588 | 587 | } |
| 589 | 588 | |
| 590 | 589 | static function anchorencode( $parser, $text ) { |
| | 590 | + $text = $parser->killMarkers( $text ); |
| 591 | 591 | return substr( $parser->guessSectionNameFromWikiText( $text ), 1); |
| 592 | 592 | } |
| 593 | 593 | |
| Index: branches/REL1_17/phase3/RELEASE-NOTES |
| — | — | @@ -8,27 +8,6 @@ |
| 9 | 9 | |
| 10 | 10 | This a maintenance and security release of the MediaWiki 1.17 branch. |
| 11 | 11 | |
| 12 | | -=== Security changes === |
| 13 | | -* (bug 33117) prop=revisions allows deleted text to be exposed through cache pollution. |
| 14 | | - |
| 15 | | -=== Changes since 1.17.1 === |
| 16 | | -* (bug 32709) Private Wiki users were always taken to Special:Badtitle on login. |
| 17 | | - |
| 18 | | -== MediaWiki 1.17.1 == |
| 19 | | - |
| 20 | | -2011-11-24 |
| 21 | | - |
| 22 | | -This a maintenance and security release of the MediaWiki 1.17 branch. |
| 23 | | - |
| 24 | | -=== Security changes === |
| 25 | | -* (bug 32276) Skins were generating output using the internal page title which |
| 26 | | - would allow anonymous users to determine wheter a page exists, potentially |
| 27 | | - leaking private data. In fact, the curid and oldid request parameters would |
| 28 | | - allow page titles to be enumerated even when they are not guessable. |
| 29 | | -* (bug 32616) action=ajax requests were dispatched to the relevant internal |
| 30 | | - functions without any read permission checks being done. This could lead to |
| 31 | | - data leakage on private wikis. |
| 32 | | - |
| 33 | 12 | === Summary of selected changes in 1.17 === |
| 34 | 13 | |
| 35 | 14 | Selected changes since MediaWiki 1.16 that may be of interest: |
| — | — | @@ -56,6 +35,15 @@ |
| 57 | 36 | * The lowest supported version of PHP is now 5.2.3. If necessary, please |
| 58 | 37 | upgrade PHP prior to upgrading MediaWiki. |
| 59 | 38 | |
| | 39 | +=== Changes since 1.17.2 === |
| | 40 | + |
| | 41 | +* (bug 22555) Remove or skip strip markers from tag hooks like <nowiki> in |
| | 42 | + core parser functions which operate on strings, such as padleft. |
| | 43 | + |
| | 44 | +=== Changes since 1.17.1 === |
| | 45 | +* (bug 33117) prop=revisions allows deleted text to be exposed through cache pollution. |
| | 46 | +* (bug 32709) Private Wiki users were always taken to Special:Badtitle on login. |
| | 47 | + |
| 60 | 48 | === Changes since 1.17.0 === |
| 61 | 49 | |
| 62 | 50 | * (bug 29535) Added missing Creative Commons CC0 icon. |
| — | — | @@ -89,6 +77,13 @@ |
| 90 | 78 | * Hardcoded NLS_NUMERIC_CHARACTERS for Oracle DB to prevent type conversion errors. |
| 91 | 79 | * Fixed recentchanges FK violation on page delete and cache purge error in updater |
| 92 | 80 | for Oracle DB. |
| | 81 | +* (bug 32276) Skins were generating output using the internal page title which |
| | 82 | + would allow anonymous users to determine wheter a page exists, potentially |
| | 83 | + leaking private data. In fact, the curid and oldid request parameters would |
| | 84 | + allow page titles to be enumerated even when they are not guessable. |
| | 85 | +* (bug 32616) action=ajax requests were dispatched to the relevant internal |
| | 86 | + functions without any read permission checks being done. This could lead to |
| | 87 | + data leakage on private wikis. |
| 93 | 88 | |
| 94 | 89 | === Changes since 1.17.0rc1 === |
| 95 | 90 | |