r38275 MediaWiki - Code Review archive

Repository:MediaWiki
Revision:r38274‎ | r38275 | r38276 >
Date:03:36, 31 July 2008
Author:nad
Status:old
Tags:
Comment:
I meant to say should *not* use htmlspecialchars, it makes invalid CSS syntax - bug reported on MW talk page
Modified paths:
  • /trunk/extensions/CSS/CSS.php (modified) (history)

Diff [purge]

Index: trunk/extensions/CSS/CSS.php
@@ -13,7 +13,7 @@
1414
1515 if (!defined('MEDIAWIKI')) die('Not an entry point.');
1616
17 -define('CSS_VERSION', '1.0.4, 2008-06-01');
 17+define('CSS_VERSION', '1.0.5, 2008-07-31');
1818
1919 $wgCSSMagic = "css";
2020 $wgExtensionFunctions[] = 'wfSetupCSS';
@@ -41,7 +41,7 @@
4242 if (ereg('\\{', $css)) {
4343
4444 # Inline CSS
45 - $css = htmlspecialchars(trim(Sanitizer::checkCss($css)));
 45+ $css = trim(Sanitizer::checkCss($css));
4646 $parser->mOutput->addHeadItem( <<<EOT
4747 <style type="text/css">
4848 /*<![CDATA[*/

Follow-up revisions

RevisionCommit summaryAuthorDate
r38307Fix what I'm quite sure is an XSS exploit in the CSS extension, from r38275. ...simetrical16:43, 31 July 2008
r38322Revert r38275, 38307 for now -- proper way to escape this stuff is being disc...brion23:34, 31 July 2008

Status & tagging log