r32524 MediaWiki - Code Review archive

Repository:MediaWiki
Revision:r32523‎ | r32524 | r32525 >
Date:21:34, 27 March 2008
Author:raymond
Status:old
Tags:
Comment:
Sanitize evil php.ini values. Thanks to Simetrical
Modified paths:
  • /trunk/phase3/includes/SpecialUpload.php (modified) (history)

Diff [purge]

Index: trunk/phase3/includes/SpecialUpload.php
@@ -983,7 +983,7 @@
984984 # Get the maximum file size from php.ini as $wgMaxUploadSize works for uploads from URL via CURL only
985985 # See http://www.php.net/manual/en/ini.core.php#ini.upload-max-filesize for possible values of upload_max_filesize
986986 $val = trim( ini_get( 'upload_max_filesize' ) );
987 - $last = ( substr( $val, -1 ) );
 987+ $last = strtoupper( ( substr( $val, -1 ) ) );
988988 switch( $last ) {
989989 case 'G':
990990 $val2 = substr( $val, 0, -1 ) * 1024 * 1024 * 1024;
@@ -998,7 +998,7 @@
999999 $val2 = $val;
10001000 }
10011001 $val2 = $wgAllowCopyUploads ? min( $wgMaxUploadSize, $val2 ) : $val2;
1002 - $maxUploadSize = wfMsgExt( 'upload-maxfilesize', 'parseinline', $wgLang->formatSize( $val2 ) );
 1002+ $maxUploadSize = wfMsgExt( 'upload-maxfilesize', array( 'parseinline', 'escape' ), $wgLang->formatSize( $val2 ) );
10031003
10041004 $sourcefilename = wfMsgExt( 'sourcefilename', 'escapenoentities' );
10051005 $destfilename = wfMsgExt( 'destfilename', 'escapenoentities' );

Status & tagging log