r13424 MediaWiki - Code Review archive

Repository:MediaWiki
Revision:r13423‎ | r13424 | r13425 >
Date:04:09, 2 April 2006
Author:brion
Status:old
Tags:
Comment:
Live fix: escape <, >, and " chars that sneak into tables, etc due to parser ordering bugs
Modified paths:
  • /trunk/phase3/includes/Sanitizer.php (modified) (history)

Diff [purge]

Index: trunk/phase3/includes/Sanitizer.php
@@ -577,6 +577,9 @@
578578 # Templates and links may be expanded in later parsing,
579579 # creating invalid or dangerous output. Suppress this.
580580 $value = strtr( $value, array(
 581+ '<' => '&lt;', // This should never happen,
 582+ '>' => '&gt;', // we've received invalid input
 583+ '"' => '&quot;', // which should have been escaped.
581584 '{' => '&#123;',
582585 '[' => '&#91;',
583586 "''" => '&#39;&#39;',

Status & tagging log