| Index: trunk/phase3/includes/User.php |
| — | — | @@ -11,9 +11,7 @@ |
| 12 | 12 | define( 'MW_USER_VERSION', 5 ); |
| 13 | 13 | |
| 14 | 14 | # Some punctuation to prevent editing from broken text-mangling proxies. |
| 15 | | -# FIXME: this is embedded unescaped into HTML attributes in various |
| 16 | | -# places, so we can't safely include ' or " even though we really should. |
| 17 | | -define( 'EDIT_TOKEN_SUFFIX', '\\' ); |
| | 15 | +define( 'EDIT_TOKEN_SUFFIX', '+\\' ); |
| 18 | 16 | |
| 19 | 17 | /** |
| 20 | 18 | * Thrown by User::setPassword() on error |
| — | — | @@ -2273,16 +2271,20 @@ |
| 2274 | 2272 | * @public |
| 2275 | 2273 | */ |
| 2276 | 2274 | function editToken( $salt = '' ) { |
| 2277 | | - if( !isset( $_SESSION['wsEditToken'] ) ) { |
| 2278 | | - $token = $this->generateToken(); |
| 2279 | | - $_SESSION['wsEditToken'] = $token; |
| | 2275 | + if ( $this->isAnon() ) { |
| | 2276 | + return EDIT_TOKEN_SUFFIX; |
| 2280 | 2277 | } else { |
| 2281 | | - $token = $_SESSION['wsEditToken']; |
| | 2278 | + if( !isset( $_SESSION['wsEditToken'] ) ) { |
| | 2279 | + $token = $this->generateToken(); |
| | 2280 | + $_SESSION['wsEditToken'] = $token; |
| | 2281 | + } else { |
| | 2282 | + $token = $_SESSION['wsEditToken']; |
| | 2283 | + } |
| | 2284 | + if( is_array( $salt ) ) { |
| | 2285 | + $salt = implode( '|', $salt ); |
| | 2286 | + } |
| | 2287 | + return md5( $token . $salt ) . EDIT_TOKEN_SUFFIX; |
| 2282 | 2288 | } |
| 2283 | | - if( is_array( $salt ) ) { |
| 2284 | | - $salt = implode( '|', $salt ); |
| 2285 | | - } |
| 2286 | | - return md5( $token . $salt ) . EDIT_TOKEN_SUFFIX; |
| 2287 | 2289 | } |
| 2288 | 2290 | |
| 2289 | 2291 | /** |
| Index: trunk/phase3/includes/Article.php |
| — | — | @@ -878,8 +878,8 @@ |
| 879 | 879 | $rmvtxt = ""; |
| 880 | 880 | if ($wgUser->isAllowed( 'trackback' )) { |
| 881 | 881 | $delurl = $this->mTitle->getFullURL("action=deletetrackback&tbid=" |
| 882 | | - . $o->tb_id . "&token=" . $wgUser->editToken()); |
| 883 | | - $rmvtxt = wfMsg('trackbackremove', $delurl); |
| | 882 | + . $o->tb_id . "&token=" . urlencode( $wgUser->editToken() ) ); |
| | 883 | + $rmvtxt = wfMsg( 'trackbackremove', htmlspecialchars( $delurl ) ); |
| 884 | 884 | } |
| 885 | 885 | $tbtext .= wfMsg(strlen($o->tb_ex) ? 'trackbackexcerpt' : 'trackback', |
| 886 | 886 | $o->tb_title, |
| Index: trunk/phase3/includes/EditPage.php |
| — | — | @@ -576,13 +576,7 @@ |
| 577 | 577 | */ |
| 578 | 578 | function tokenOk( &$request ) { |
| 579 | 579 | global $wgUser; |
| 580 | | - if( $wgUser->isAnon() ) { |
| 581 | | - # Anonymous users may not have a session |
| 582 | | - # open. Check for suffix anyway. |
| 583 | | - $this->mTokenOk = ( EDIT_TOKEN_SUFFIX == $request->getVal( 'wpEditToken' ) ); |
| 584 | | - } else { |
| 585 | | - $this->mTokenOk = $wgUser->matchEditToken( $request->getVal( 'wpEditToken' ) ); |
| 586 | | - } |
| | 580 | + $this->mTokenOk = $wgUser->matchEditToken( $request->getVal( 'wpEditToken' ) ); |
| 587 | 581 | return $this->mTokenOk; |
| 588 | 582 | } |
| 589 | 583 | |
| — | — | @@ -1244,10 +1238,7 @@ |
| 1245 | 1239 | * include the constant suffix to prevent editing from |
| 1246 | 1240 | * broken text-mangling proxies. |
| 1247 | 1241 | */ |
| 1248 | | - if ( $wgUser->isLoggedIn() ) |
| 1249 | | - $token = htmlspecialchars( $wgUser->editToken() ); |
| 1250 | | - else |
| 1251 | | - $token = EDIT_TOKEN_SUFFIX; |
| | 1242 | + $token = htmlspecialchars( $wgUser->editToken() ); |
| 1252 | 1243 | $wgOut->addHTML( "\n<input type='hidden' value=\"$token\" name=\"wpEditToken\" />\n" ); |
| 1253 | 1244 | |
| 1254 | 1245 | |
| Index: trunk/phase3/includes/SpecialBlockip.php |
| — | — | @@ -144,7 +144,7 @@ |
| 145 | 145 | $blockReasonList .= $optgroup; |
| 146 | 146 | } |
| 147 | 147 | |
| 148 | | - $token = htmlspecialchars( $wgUser->editToken() ); |
| | 148 | + $token = $wgUser->editToken(); |
| 149 | 149 | |
| 150 | 150 | global $wgStylePath, $wgStyleVersion; |
| 151 | 151 | $wgOut->addHTML( " |
| Index: trunk/phase3/includes/SpecialEmailuser.php |
| — | — | @@ -115,7 +115,7 @@ |
| 116 | 116 | $titleObj = SpecialPage::getTitleFor( "Emailuser" ); |
| 117 | 117 | $action = $titleObj->escapeLocalURL( "target=" . |
| 118 | 118 | urlencode( $this->target->getName() ) . "&action=submit" ); |
| 119 | | - $token = $wgUser->editToken(); |
| | 119 | + $token = htmlspecialchars( $wgUser->editToken() ); |
| 120 | 120 | |
| 121 | 121 | $wgOut->addHTML( " |
| 122 | 122 | <form id=\"emailuser\" method=\"post\" action=\"{$action}\"> |
| Index: trunk/phase3/includes/SpecialPreferences.php |
| — | — | @@ -994,7 +994,7 @@ |
| 995 | 995 | } |
| 996 | 996 | $wgOut->addHTML( '</fieldset>' ); |
| 997 | 997 | |
| 998 | | - $token = $wgUser->editToken(); |
| | 998 | + $token = htmlspecialchars( $wgUser->editToken() ); |
| 999 | 999 | $skin = $wgUser->getSkin(); |
| 1000 | 1000 | $wgOut->addHTML( " |
| 1001 | 1001 | <div id='prefsubmit'> |
| — | — | @@ -1005,7 +1005,7 @@ |
| 1006 | 1006 | |
| 1007 | 1007 | </div> |
| 1008 | 1008 | |
| 1009 | | - <input type='hidden' name='wpEditToken' value='{$token}' /> |
| | 1009 | + <input type='hidden' name='wpEditToken' value=\"{$token}\" /> |
| 1010 | 1010 | </div></form>\n" ); |
| 1011 | 1011 | |
| 1012 | 1012 | $wgOut->addHtml( Xml::tags( 'div', array( 'class' => "prefcache" ), |
| Index: trunk/extensions/ContactPage/SpecialContact.php |
| — | — | @@ -144,6 +144,7 @@ |
| 145 | 145 | $titleObj = SpecialPage::getTitleFor( "Contact" ); |
| 146 | 146 | $action = $titleObj->escapeLocalURL( "action=submit" ); |
| 147 | 147 | $token = $wgUser->isAnon() ? EDIT_TOKEN_SUFFIX : $wgUser->editToken(); //this kind of sucks, really... |
| | 148 | + $token = htmlspecialchars( $token ); |
| 148 | 149 | |
| 149 | 150 | $wgOut->addHTML( " |
| 150 | 151 | <form id=\"emailuser\" method=\"post\" action=\"{$action}\"> |
| Index: trunk/extensions/Farmer/MediaWikiFarmer_SpecialPage.php |
| — | — | @@ -162,9 +162,9 @@ |
| 163 | 163 | |
| 164 | 164 | $wgOut->addHTML(' |
| 165 | 165 | <form id="farmercreate2" method="post"> |
| 166 | | - <input type="hidden" name="name" value="'.htmlentities($name).'" /> |
| 167 | | -<input type="hidden" name="wikititle" value="'.htmlentities($title).'" /> |
| 168 | | -<input type="hidden" name="description" value="'.htmlentities($description).'" /> |
| | 166 | + <input type="hidden" name="name" value="'.htmlspecialchars($name).'" /> |
| | 167 | +<input type="hidden" name="wikititle" value="'.htmlspecialchars($title).'" /> |
| | 168 | +<input type="hidden" name="description" value="'.htmlspecialchars($description).'" /> |
| 169 | 169 | <input type="submit" name="confirm" value="Confirm" /> |
| 170 | 170 | </form>' |
| 171 | 171 | |
| — | — | @@ -195,7 +195,7 @@ |
| 196 | 196 | $formSitename = wfMsgHTML('farmercreatesitename'); |
| 197 | 197 | $formNextStep = wfMsgHTML('farmercreatenextstep'); |
| 198 | 198 | |
| 199 | | - $token = $wgUser->editToken(); |
| | 199 | + $token = htmlspecialchars( $wgUser->editToken() ); |
| 200 | 200 | |
| 201 | 201 | $wgOut->addHTML( " |
| 202 | 202 | <form id='farmercreate1' method='post' action=\"$action\"> |
| — | — | @@ -206,22 +206,22 @@ |
| 207 | 207 | </tr> |
| 208 | 208 | <tr> |
| 209 | 209 | <td align='right'>Wiki Name</td> |
| 210 | | - <td align='left'><input tabindex='1' type='text' size='20' name='name' value=\"" . htmlentities($name) . "\" /></td> |
| | 210 | + <td align='left'><input tabindex='1' type='text' size='20' name='name' value=\"" . htmlspecialchars($name) . "\" /></td> |
| 211 | 211 | </tr> |
| 212 | 212 | <tr> |
| 213 | 213 | <td align='right'>Wiki Title</td> |
| 214 | | - <td align='left'><input tabindex='1' type='text' size='20' name='wikititle' value=\"" . htmlentities($title) . "\"/></td> |
| | 214 | + <td align='left'><input tabindex='1' type='text' size='20' name='wikititle' value=\"" . htmlspecialchars($title) . "\"/></td> |
| 215 | 215 | </tr> |
| 216 | 216 | <tr> |
| 217 | 217 | <td align='right'>Description</td> |
| 218 | | - <td align='left'><textarea tabindex='1' cols=\"40\" rows=\"5\" name='description'>" . htmlentities($description) . "</textarea></td> |
| | 218 | + <td align='left'><textarea tabindex='1' cols=\"40\" rows=\"5\" name='description'>" . htmlspecialchars($description) . "</textarea></td> |
| 219 | 219 | </tr> |
| 220 | 220 | <tr> |
| 221 | 221 | <td> </td> |
| 222 | 222 | <td align='right'><input type='submit' name='submit' value=\"Submit\" /></td> |
| 223 | 223 | </tr> |
| 224 | 224 | </table> |
| 225 | | - <input type='hidden' name='token' value='$token' /> |
| | 225 | + <input type='hidden' name='token' value=\"$token\" /> |
| 226 | 226 | </form>"); |
| 227 | 227 | |
| 228 | 228 | } |
| — | — | @@ -358,7 +358,7 @@ |
| 359 | 359 | $wgOut->addWikiText('Set the description of your wiki below'); |
| 360 | 360 | |
| 361 | 361 | $wgOut->addHTML('<form method="post" name="wikiDescription" action="'.$action.'">'. |
| 362 | | - '<textarea name="wikiDescription" rows="5" cols="30">'.htmlentities($wiki->description).'</textarea>'. |
| | 362 | + '<textarea name="wikiDescription" rows="5" cols="30">'.htmlspecialchars($wiki->description).'</textarea>'. |
| 363 | 363 | '<input type="submit" name="submit" value="submit" />'. |
| 364 | 364 | '</form>' |
| 365 | 365 | ); |
| — | — | @@ -477,7 +477,7 @@ |
| 478 | 478 | $toAdd .= 'checked="checked" '; |
| 479 | 479 | } |
| 480 | 480 | |
| 481 | | - $toAdd .=' /><strong>'.htmlentities($extension->name) . '</strong> - ' . htmlentities($extension->description) . "<br />\n"; |
| | 481 | + $toAdd .=' /><strong>'.htmlspecialchars($extension->name) . '</strong> - ' . htmlspecialchars($extension->description) . "<br />\n"; |
| 482 | 482 | |
| 483 | 483 | $wgOut->addHTML($toAdd); |
| 484 | 484 | } |
| — | — | @@ -530,7 +530,7 @@ |
| 531 | 531 | $wgOut->addWikiText('No extensions are registered'); |
| 532 | 532 | } else { |
| 533 | 533 | foreach ($wgFarmer->getExtensions() as $extension) { |
| 534 | | - $wgOut->addWikiText('; ' . htmlentities($extension->name) . ' : ' . htmlentities($extension->description)); |
| | 534 | + $wgOut->addWikiText('; ' . htmlspecialchars($extension->name) . ' : ' . htmlspecialchars($extension->description)); |
| 535 | 535 | } |
| 536 | 536 | } |
| 537 | 537 | |
| — | — | @@ -601,4 +601,4 @@ |
| 602 | 602 | |
| 603 | 603 | } |
| 604 | 604 | |
| 605 | | -} |
| \ No newline at end of file |
| | 605 | +} |
| Index: trunk/extensions/Todo/SpecialTodo.php |
| — | — | @@ -34,7 +34,7 @@ |
| 35 | 35 | 'todo' => 'Todo list', |
| 36 | 36 | 'todo-new-queue' => 'new', |
| 37 | 37 | 'todo-mail-subject' => "Completed item on $1's todo list", |
| 38 | | - 'todo-mail-body' => <<<END |
| | 38 | + 'todo-mail-body' => <<<ENDS |
| 39 | 39 | You requested e-mail confirmation about the completion of an item you submitted to $1's online todo list. |
| 40 | 40 | |
| 41 | 41 | Item: $2 |
| — | — | @@ -42,7 +42,7 @@ |
| 43 | 43 | |
| 44 | 44 | This item has been marked as completed, with this comment: |
| 45 | 45 | $4 |
| 46 | | -END |
| | 46 | +ENDS |
| 47 | 47 | ) ); |
| 48 | 48 | SpecialPage::addPage( new SpecialPage( 'Todo' ) ); |
| 49 | 49 | } |
| — | — | @@ -475,4 +475,4 @@ |
| 476 | 476 | } |
| 477 | 477 | |
| 478 | 478 | |
| 479 | | -?> |
| \ No newline at end of file |
| | 479 | +?> |
| Index: trunk/extensions/Makesysop/SpecialMakesysop_body.php |
| — | — | @@ -91,7 +91,6 @@ |
| 92 | 92 | $reason = htmlspecialchars( wfMsg( "userrights-reason" ) ); |
| 93 | 93 | $makebureaucrat = wfMsg( "setbureaucratflag" ); |
| 94 | 94 | $mss = wfMsg( "set_user_rights" ); |
| 95 | | - $token = htmlspecialchars( $wgUser->editToken() ); |
| 96 | 95 | |
| 97 | 96 | $wgOut->addHTML( |
| 98 | 97 | Xml::openElement( 'form', array( 'method' => 'post', 'action' => $action, 'id' => 'makesysop' ) ) . |
| — | — | @@ -112,7 +111,7 @@ |
| 113 | 112 | <td align='left'>" . Xml::submitButton( $mss, array( 'name' => 'wpMakesysopSubmit' ) ) . "</td> |
| 114 | 113 | </tr> |
| 115 | 114 | </table>" . |
| 116 | | - Xml::hidden( 'wpEditToken', $token ) . |
| | 115 | + Xml::hidden( 'wpEditToken', $wgUser->editToken() ) . |
| 117 | 116 | Xml::closeElement( 'fieldset' ) . |
| 118 | 117 | Xml::closeElement( 'form' ) . "\n" |
| 119 | 118 | ); |