| Index: trunk/phase3/includes/RawPage.php |
| — | — | @@ -145,7 +145,14 @@ |
| 146 | 146 | } |
| 147 | 147 | |
| 148 | 148 | function getRawText() { |
| 149 | | - global $wgUser, $wgOut, $wgRequest; |
| | 149 | + global $wgUser, $wgOut, $wgRequest, $wgJsMimeType; |
| | 150 | + |
| | 151 | + /* Disable retrieving content pages as raw js/css */ |
| | 152 | + $dangerousTypes = array( $wgJsMimeType, 'text/css' ); |
| | 153 | + if ( in_array( $this->mContentType, $dangerousTypes ) && |
| | 154 | + !($this->mTitle->isCssOrJsPage() || $this->mTitle->isCssJsSubpage() ) ) |
| | 155 | + return '/* EMPTY */'; |
| | 156 | + |
| 150 | 157 | if($this->mGen) { |
| 151 | 158 | $sk = $wgUser->getSkin(); |
| 152 | 159 | $sk->initPage($wgOut); |
| Index: trunk/phase3/RELEASE-NOTES |
| — | — | @@ -293,6 +293,8 @@ |
| 294 | 294 | * Don't show non-functional toolbar buttons on Opera 7 anymore |
| 295 | 295 | * (bug 9151) Fix relative subpage links with section fragments |
| 296 | 296 | * (bug 10560) Adding a space between category letter heading and "continues" |
| | 297 | +* Security fix: Disable retrieving pages as raw js/css that should not contain |
| | 298 | + such content. |
| 297 | 299 | |
| 298 | 300 | == API changes since 1.10 == |
| 299 | 301 | |