r24202 MediaWiki - Code Review archive

Repository:MediaWiki
Revision:r24201‎ | r24202 | r24203 >
Date:15:50, 17 July 2007
Author:brion
Status:old
Tags:
Comment:
Revert r24105, r24106, r24107 'security fix' forbidden text/css and text/javascript for pages not matching some particular formats.
This doesn't actually do the job; browsers aren't this picky about their JavaScript, and many aren't picky about CSS either. Further, this actually breaks internal JS such as the gen=js mode.
Modified paths:
  • /trunk/phase3/RELEASE-NOTES (modified) (history)
  • /trunk/phase3/includes/RawPage.php (modified) (history)

Diff [purge]

Index: trunk/phase3/includes/RawPage.php
@@ -145,14 +145,7 @@
146146 }
147147
148148 function getRawText() {
149 - global $wgUser, $wgOut, $wgRequest, $wgJsMimeType;
150 -
151 - /* Disable retrieving content pages as raw js/css */
152 - $dangerousTypes = array( $wgJsMimeType, 'text/css' );
153 - if ( in_array( $this->mContentType, $dangerousTypes ) &&
154 - !($this->mTitle->isCssOrJsPage() || $this->mTitle->isCssJsSubpage() ) )
155 - return '/* Page type not compatible with requested MIME type. */';
156 -
 149+ global $wgUser, $wgOut, $wgRequest;
157150 if($this->mGen) {
158151 $sk = $wgUser->getSkin();
159152 $sk->initPage($wgOut);
Index: trunk/phase3/RELEASE-NOTES
@@ -305,8 +305,6 @@
306306 * Don't show non-functional toolbar buttons on Opera 7 anymore
307307 * (bug 9151) Fix relative subpage links with section fragments
308308 * (bug 10560) Adding a space between category letter heading and "continues"
309 -* Don't allow retrieving non-JavaScript/CSS pages with "text/css" or "text/javascript"
310 - MIME types
311309 * (bug 1629) Stop section edit links from being shoved down by other floats
312310 * (bug 4650) Keep impossibly large/small counts off Special:Statistics
313311 * (bug 10608) PHP notice when installing with PostgreSQL

Follow-up revisions

RevisionCommit summaryAuthorDate
r24215Merged revisions 24095-24212 via svnmerge from...david21:19, 17 July 2007

Past revisions this follows-up on

RevisionCommit summaryAuthorDate
r24105Security fix: Previously it was possible to include unprotected and even cont...amidaniel04:57, 15 July 2007
r24106Actually, let's make that message a tid bit more clear: "Page type not compat...amidaniel05:04, 15 July 2007
r24107MIME is an acronym...robchurch05:08, 15 July 2007

Status & tagging log