| Index: branches/REL1_13/phase3/includes/Title.php |
| — | — | @@ -320,9 +320,13 @@ |
| 321 | 321 | $m[1] = urldecode( ltrim( $m[1], ':' ) ); |
| 322 | 322 | } |
| 323 | 323 | $title = Title::newFromText( $m[1] ); |
| 324 | | - // Redirects to Special:Userlogout are not permitted |
| 325 | | - if( $title instanceof Title && !$title->isSpecial( 'Userlogout' ) ) |
| | 324 | + // Redirects to some special pages are not permitted |
| | 325 | + if( $title instanceof Title |
| | 326 | + && !$title->isSpecial( 'Userlogout' ) |
| | 327 | + && !$title->isSpecial( 'Filepath' ) ) |
| | 328 | + { |
| 326 | 329 | return $title; |
| | 330 | + } |
| 327 | 331 | } |
| 328 | 332 | } |
| 329 | 333 | return null; |
| Index: branches/REL1_13/phase3/includes/StreamFile.php |
| — | — | @@ -31,6 +31,12 @@ |
| 32 | 32 | header('Content-type: application/x-wiki'); |
| 33 | 33 | } |
| 34 | 34 | |
| | 35 | + // Don't stream it out as text/html if there was a PHP error |
| | 36 | + if ( headers_sent() ) { |
| | 37 | + echo "Headers already sent, terminating.\n"; |
| | 38 | + return; |
| | 39 | + } |
| | 40 | + |
| 35 | 41 | global $wgContLanguageCode; |
| 36 | 42 | header( "Content-Disposition: inline;filename*=utf-8'$wgContLanguageCode'" . urlencode( basename( $fname ) ) ); |
| 37 | 43 | |
| — | — | @@ -53,25 +59,51 @@ |
| 54 | 60 | } |
| 55 | 61 | |
| 56 | 62 | /** */ |
| 57 | | -function wfGetType( $filename ) { |
| | 63 | +function wfGetType( $filename, $safe = true ) { |
| 58 | 64 | global $wgTrivialMimeDetection; |
| 59 | 65 | |
| | 66 | + $ext = strrchr($filename, '.'); |
| | 67 | + $ext = $ext === false ? '' : strtolower( substr( $ext, 1 ) ); |
| | 68 | + |
| 60 | 69 | # trivial detection by file extension, |
| 61 | 70 | # used for thumbnails (thumb.php) |
| 62 | 71 | if ($wgTrivialMimeDetection) { |
| 63 | | - $ext= strtolower(strrchr($filename, '.')); |
| 64 | | - |
| 65 | 72 | switch ($ext) { |
| 66 | | - case '.gif': return 'image/gif'; |
| 67 | | - case '.png': return 'image/png'; |
| 68 | | - case '.jpg': return 'image/jpeg'; |
| 69 | | - case '.jpeg': return 'image/jpeg'; |
| | 73 | + case 'gif': return 'image/gif'; |
| | 74 | + case 'png': return 'image/png'; |
| | 75 | + case 'jpg': return 'image/jpeg'; |
| | 76 | + case 'jpeg': return 'image/jpeg'; |
| 70 | 77 | } |
| 71 | 78 | |
| 72 | 79 | return 'unknown/unknown'; |
| 73 | 80 | } |
| 74 | | - else { |
| 75 | | - $magic = MimeMagic::singleton(); |
| 76 | | - return $magic->guessMimeType($filename); //full fancy mime detection |
| | 81 | + |
| | 82 | + $magic = MimeMagic::singleton(); |
| | 83 | + // Use the extension only, rather than magic numbers, to avoid opening |
| | 84 | + // up vulnerabilities due to uploads of files with allowed extensions |
| | 85 | + // but disallowed types. |
| | 86 | + $type = $magic->guessTypesForExtension( $ext ); |
| | 87 | + |
| | 88 | + /** |
| | 89 | + * Double-check some security settings that were done on upload but might |
| | 90 | + * have changed since. |
| | 91 | + */ |
| | 92 | + if ( $safe ) { |
| | 93 | + global $wgFileBlacklist, $wgCheckFileExtensions, $wgStrictFileExtensions, |
| | 94 | + $wgFileExtensions, $wgVerifyMimeType, $wgMimeTypeBlacklist, $wgRequest; |
| | 95 | + $form = new UploadForm( $wgRequest ); |
| | 96 | + list( $partName, $extList ) = $form->splitExtensions( $filename ); |
| | 97 | + if ( $form->checkFileExtensionList( $extList, $wgFileBlacklist ) ) { |
| | 98 | + return 'unknown/unknown'; |
| | 99 | + } |
| | 100 | + if ( $wgCheckFileExtensions && $wgStrictFileExtensions |
| | 101 | + && !$form->checkFileExtensionList( $extList, $wgFileExtensions ) ) |
| | 102 | + { |
| | 103 | + return 'unknown/unknown'; |
| | 104 | + } |
| | 105 | + if ( $wgVerifyMimeType && in_array( strtolower( $type ), $wgMimeTypeBlacklist ) ) { |
| | 106 | + return 'unknown/unknown'; |
| | 107 | + } |
| 77 | 108 | } |
| | 109 | + return $type; |
| 78 | 110 | } |
| Index: branches/REL1_13/phase3/includes/DefaultSettings.php |
| — | — | @@ -31,7 +31,7 @@ |
| 32 | 32 | $wgConf = new SiteConfiguration; |
| 33 | 33 | |
| 34 | 34 | /** MediaWiki version number */ |
| 35 | | -$wgVersion = '1.13.2'; |
| | 35 | +$wgVersion = '1.13.3'; |
| 36 | 36 | |
| 37 | 37 | /** Name of the site. It must be changed in LocalSettings.php */ |
| 38 | 38 | $wgSitename = 'MediaWiki'; |
| Index: branches/REL1_13/phase3/includes/specials/SpecialUndelete.php |
| — | — | @@ -571,7 +571,7 @@ |
| 572 | 572 | */ |
| 573 | 573 | class UndeleteForm { |
| 574 | 574 | var $mAction, $mTarget, $mTimestamp, $mRestore, $mTargetObj; |
| 575 | | - var $mTargetTimestamp, $mAllowed, $mComment; |
| | 575 | + var $mTargetTimestamp, $mAllowed, $mComment, $mToken; |
| 576 | 576 | |
| 577 | 577 | function UndeleteForm( $request, $par = "" ) { |
| 578 | 578 | global $wgUser; |
| — | — | @@ -589,6 +589,7 @@ |
| 590 | 590 | $this->mDiff = $request->getCheck( 'diff' ); |
| 591 | 591 | $this->mComment = $request->getText( 'wpComment' ); |
| 592 | 592 | $this->mUnsuppress = $request->getVal( 'wpUnsuppress' ) && $wgUser->isAllowed( 'suppressrevision' ); |
| | 593 | + $this->mToken = $request->getVal( 'token' ); |
| 593 | 594 | |
| 594 | 595 | if( $par != "" ) { |
| 595 | 596 | $this->mTarget = $par; |
| — | — | @@ -655,6 +656,9 @@ |
| 656 | 657 | if( !$file->userCan( File::DELETED_FILE ) ) { |
| 657 | 658 | $wgOut->permissionRequired( 'suppressrevision' ); |
| 658 | 659 | return false; |
| | 660 | + } elseif ( !$wgUser->matchEditToken( $this->mToken, $this->mFile ) ) { |
| | 661 | + $this->showFileConfirmationForm( $this->mFile ); |
| | 662 | + return false; |
| 659 | 663 | } else { |
| 660 | 664 | return $this->showFile( $this->mFile ); |
| 661 | 665 | } |
| — | — | @@ -880,6 +884,29 @@ |
| 881 | 885 | } |
| 882 | 886 | |
| 883 | 887 | /** |
| | 888 | + * Show a form confirming whether a tokenless user really wants to see a file |
| | 889 | + */ |
| | 890 | + private function showFileConfirmationForm( $key ) { |
| | 891 | + global $wgOut, $wgUser, $wgLang; |
| | 892 | + $file = new ArchivedFile( $this->mTargetObj, '', $this->mFile ); |
| | 893 | + $wgOut->addWikiMsg( 'undelete-show-file-confirm', |
| | 894 | + $this->mTargetObj->getText(), |
| | 895 | + $wgLang->timeanddate( $file->getTimestamp() ) ); |
| | 896 | + $wgOut->addHTML( |
| | 897 | + Xml::openElement( 'form', array( |
| | 898 | + 'method' => 'POST', |
| | 899 | + 'action' => SpecialPage::getTitleFor( 'Undelete' )->getLocalUrl( |
| | 900 | + 'target=' . urlencode( $this->mTarget ) . |
| | 901 | + '&file=' . urlencode( $key ) . |
| | 902 | + '&token=' . urlencode( $wgUser->editToken( $key ) ) ) |
| | 903 | + ) |
| | 904 | + ) . |
| | 905 | + Xml::submitButton( wfMsg( 'undelete-show-file-submit' ) ) . |
| | 906 | + '</form>' |
| | 907 | + ); |
| | 908 | + } |
| | 909 | + |
| | 910 | + /** |
| 884 | 911 | * Show a deleted file version requested by the visitor. |
| 885 | 912 | */ |
| 886 | 913 | private function showFile( $key ) { |
| — | — | @@ -1191,13 +1218,15 @@ |
| 1192 | 1219 | * @return string |
| 1193 | 1220 | */ |
| 1194 | 1221 | function getFileLink( $file, $titleObj, $ts, $key, $sk ) { |
| 1195 | | - global $wgLang; |
| | 1222 | + global $wgLang, $wgUser; |
| 1196 | 1223 | |
| 1197 | 1224 | if( !$file->userCan(File::DELETED_FILE) ) { |
| 1198 | 1225 | return '<span class="history-deleted">' . $wgLang->timeanddate( $ts, true ) . '</span>'; |
| 1199 | 1226 | } else { |
| 1200 | 1227 | $link = $sk->makeKnownLinkObj( $titleObj, $wgLang->timeanddate( $ts, true ), |
| 1201 | | - "target=".$this->mTargetObj->getPrefixedUrl()."&file=$key" ); |
| | 1228 | + "target=".$this->mTargetObj->getPrefixedUrl(). |
| | 1229 | + "&file=$key" . |
| | 1230 | + "&token=" . urlencode( $wgUser->editToken( $key ) ) ); |
| 1202 | 1231 | if( $file->isDeleted(File::DELETED_FILE) ) |
| 1203 | 1232 | $link = '<span class="history-deleted">' . $link . '</span>'; |
| 1204 | 1233 | return $link; |
| Index: branches/REL1_13/phase3/includes/specials/SpecialImport.php |
| — | — | @@ -43,26 +43,30 @@ |
| 44 | 44 | if( $wgRequest->wasPosted() && $wgRequest->getVal( 'action' ) == 'submit') { |
| 45 | 45 | $isUpload = false; |
| 46 | 46 | $namespace = $wgRequest->getIntOrNull( 'namespace' ); |
| | 47 | + $sourceName = $wgRequest->getVal( "source" ); |
| 47 | 48 | |
| 48 | | - switch( $wgRequest->getVal( "source" ) ) { |
| 49 | | - case "upload": |
| | 49 | + if ( !$wgUser->matchEditToken( $wgRequest->getVal( 'editToken' ) ) ) { |
| | 50 | + $source = new WikiErrorMsg( 'import-token-mismatch' ); |
| | 51 | + } elseif ( $sourceName == 'upload' ) { |
| 50 | 52 | $isUpload = true; |
| 51 | 53 | if( $wgUser->isAllowed( 'importupload' ) ) { |
| 52 | 54 | $source = ImportStreamSource::newFromUpload( "xmlimport" ); |
| 53 | 55 | } else { |
| 54 | 56 | return $wgOut->permissionRequired( 'importupload' ); |
| 55 | 57 | } |
| 56 | | - break; |
| 57 | | - case "interwiki": |
| | 58 | + } elseif ( $sourceName == "interwiki" ) { |
| 58 | 59 | $interwiki = $wgRequest->getVal( 'interwiki' ); |
| 59 | | - $history = $wgRequest->getCheck( 'interwikiHistory' ); |
| 60 | | - $frompage = $wgRequest->getText( "frompage" ); |
| 61 | | - $source = ImportStreamSource::newFromInterwiki( |
| 62 | | - $interwiki, |
| 63 | | - $frompage, |
| 64 | | - $history ); |
| 65 | | - break; |
| 66 | | - default: |
| | 60 | + if ( !in_array( $interwiki, $wgImportSources ) ) { |
| | 61 | + $source = new WikiErrorMsg( "import-invalid-interwiki" ); |
| | 62 | + } else { |
| | 63 | + $history = $wgRequest->getCheck( 'interwikiHistory' ); |
| | 64 | + $frompage = $wgRequest->getText( "frompage" ); |
| | 65 | + $source = ImportStreamSource::newFromInterwiki( |
| | 66 | + $interwiki, |
| | 67 | + $frompage, |
| | 68 | + $history ); |
| | 69 | + } |
| | 70 | + } else { |
| 67 | 71 | $source = new WikiErrorMsg( "importunknownsource" ); |
| 68 | 72 | } |
| 69 | 73 | |
| — | — | @@ -106,6 +110,7 @@ |
| 107 | 111 | Xml::hidden( 'action', 'submit' ) . |
| 108 | 112 | Xml::hidden( 'source', 'upload' ) . |
| 109 | 113 | Xml::input( 'xmlimport', 50, '', array( 'type' => 'file' ) ) . ' ' . |
| | 114 | + Xml::hidden( 'editToken', $wgUser->editToken() ) . |
| 110 | 115 | Xml::submitButton( wfMsg( 'uploadbtn' ) ) . |
| 111 | 116 | Xml::closeElement( 'form' ) . |
| 112 | 117 | Xml::closeElement( 'fieldset' ) |
| — | — | @@ -124,6 +129,7 @@ |
| 125 | 130 | wfMsgExt( 'import-interwiki-text', array( 'parse' ) ) . |
| 126 | 131 | Xml::hidden( 'action', 'submit' ) . |
| 127 | 132 | Xml::hidden( 'source', 'interwiki' ) . |
| | 133 | + Xml::hidden( 'editToken', $wgUser->editToken() ) . |
| 128 | 134 | Xml::openElement( 'table', array( 'id' => 'mw-import-table' ) ) . |
| 129 | 135 | "<tr> |
| 130 | 136 | <td>" . |
| Index: branches/REL1_13/phase3/includes/specials/SpecialUpload.php |
| — | — | @@ -1348,6 +1348,11 @@ |
| 1349 | 1349 | if( $this->detectScript ( $tmpfile, $mime, $extension ) ) { |
| 1350 | 1350 | return new WikiErrorMsg( 'uploadscripted' ); |
| 1351 | 1351 | } |
| | 1352 | + if( $extension == 'svg' || $mime == 'image/svg+xml' ) { |
| | 1353 | + if( $this->detectScriptInSvg( $tmpfile ) ) { |
| | 1354 | + return new WikiErrorMsg( 'uploadscripted' ); |
| | 1355 | + } |
| | 1356 | + } |
| 1352 | 1357 | |
| 1353 | 1358 | /** |
| 1354 | 1359 | * Scan the uploaded file for viruses |
| — | — | @@ -1459,6 +1464,7 @@ |
| 1460 | 1465 | */ |
| 1461 | 1466 | |
| 1462 | 1467 | $tags = array( |
| | 1468 | + '<a href', |
| 1463 | 1469 | '<body', |
| 1464 | 1470 | '<head', |
| 1465 | 1471 | '<html', #also in safari |
| — | — | @@ -1497,7 +1503,42 @@ |
| 1498 | 1504 | return false; |
| 1499 | 1505 | } |
| 1500 | 1506 | |
| | 1507 | + function detectScriptInSvg( $filename ) { |
| | 1508 | + $check = new XmlTypeCheck( $filename, array( $this, 'checkSvgScriptCallback' ) ); |
| | 1509 | + return $check->filterMatch; |
| | 1510 | + } |
| | 1511 | + |
| 1501 | 1512 | /** |
| | 1513 | + * @todo Replace this with a whitelist filter! |
| | 1514 | + */ |
| | 1515 | + function checkSvgScriptCallback( $element, $attribs ) { |
| | 1516 | + $stripped = $this->stripXmlNamespace( $element ); |
| | 1517 | + |
| | 1518 | + if( $stripped == 'script' ) { |
| | 1519 | + wfDebug( __METHOD__ . ": Found script element '$element' in uploaded file.\n" ); |
| | 1520 | + return true; |
| | 1521 | + } |
| | 1522 | + |
| | 1523 | + foreach( $attribs as $attrib => $value ) { |
| | 1524 | + $stripped = $this->stripXmlNamespace( $attrib ); |
| | 1525 | + if( substr( $stripped, 0, 2 ) == 'on' ) { |
| | 1526 | + wfDebug( __METHOD__ . ": Found script attribute '$attrib'='value' in uploaded file.\n" ); |
| | 1527 | + return true; |
| | 1528 | + } |
| | 1529 | + if( $stripped == 'href' && strpos( strtolower( $value ), 'javascript:' ) !== false ) { |
| | 1530 | + wfDebug( __METHOD__ . ": Found script href attribute '$attrib'='$value' in uploaded file.\n" ); |
| | 1531 | + return true; |
| | 1532 | + } |
| | 1533 | + } |
| | 1534 | + } |
| | 1535 | + |
| | 1536 | + private function stripXmlNamespace( $name ) { |
| | 1537 | + // 'http://www.w3.org/2000/svg:script' -> 'script' |
| | 1538 | + $parts = explode( ':', strtolower( $name ) ); |
| | 1539 | + return array_pop( $parts ); |
| | 1540 | + } |
| | 1541 | + |
| | 1542 | + /** |
| 1502 | 1543 | * Generic wrapper function for a virus scanner program. |
| 1503 | 1544 | * This relies on the $wgAntivirus and $wgAntivirusSetup variables. |
| 1504 | 1545 | * $wgAntivirusRequired may be used to deny upload if the scan fails. |
| Index: branches/REL1_13/phase3/includes/XmlTypeCheck.php |
| — | — | @@ -6,6 +6,12 @@ |
| 7 | 7 | * well-formed XML. Note that this doesn't check schema validity. |
| 8 | 8 | */ |
| 9 | 9 | public $wellFormed = false; |
| | 10 | + |
| | 11 | + /** |
| | 12 | + * Will be set to true if the optional element filter returned |
| | 13 | + * a match at some point. |
| | 14 | + */ |
| | 15 | + public $filterMatch = false; |
| 10 | 16 | |
| 11 | 17 | /** |
| 12 | 18 | * Name of the document's root element, including any namespace |
| — | — | @@ -13,33 +19,26 @@ |
| 14 | 20 | */ |
| 15 | 21 | public $rootElement = ''; |
| 16 | 22 | |
| 17 | | - private $softNamespaces; |
| 18 | | - private $namespaces = array(); |
| 19 | | - |
| 20 | 23 | /** |
| 21 | 24 | * @param $file string filename |
| 22 | | - * @param $softNamespaces bool |
| 23 | | - * If set to true, use of undeclared XML namespaces will be ignored. |
| 24 | | - * This matches the behavior of rsvg, but more compliant consumers |
| 25 | | - * such as Firefox will reject such files. |
| 26 | | - * Leave off for the default, stricter checks. |
| | 25 | + * @param $filterCallback callable (optional) |
| | 26 | + * Function to call to do additional custom validity checks from the |
| | 27 | + * SAX element handler event. This gives you access to the element |
| | 28 | + * namespace, name, and attributes, but not to text contents. |
| | 29 | + * Filter should return 'true' to toggle on $this->filterMatch |
| 27 | 30 | */ |
| 28 | | - function __construct( $file, $softNamespaces=false ) { |
| 29 | | - $this->softNamespaces = $softNamespaces; |
| | 31 | + function __construct( $file, $filterCallback=null ) { |
| | 32 | + $this->filterCallback = $filterCallback; |
| 30 | 33 | $this->run( $file ); |
| 31 | 34 | } |
| 32 | 35 | |
| 33 | 36 | private function run( $fname ) { |
| 34 | | - if( $this->softNamespaces ) { |
| 35 | | - $parser = xml_parser_create( 'UTF-8' ); |
| 36 | | - } else { |
| 37 | | - $parser = xml_parser_create_ns( 'UTF-8' ); |
| 38 | | - } |
| | 37 | + $parser = xml_parser_create_ns( 'UTF-8' ); |
| 39 | 38 | |
| 40 | 39 | // case folding violates XML standard, turn it off |
| 41 | 40 | xml_parser_set_option( $parser, XML_OPTION_CASE_FOLDING, false ); |
| 42 | 41 | |
| 43 | | - xml_set_element_handler( $parser, array( $this, 'elementOpen' ), false ); |
| | 42 | + xml_set_element_handler( $parser, array( $this, 'rootElementOpen' ), false ); |
| 44 | 43 | |
| 45 | 44 | $file = fopen( $fname, "rb" ); |
| 46 | 45 | do { |
| — | — | @@ -59,35 +58,22 @@ |
| 60 | 59 | xml_parser_free( $parser ); |
| 61 | 60 | } |
| 62 | 61 | |
| | 62 | + private function rootElementOpen( $parser, $name, $attribs ) { |
| | 63 | + $this->rootElement = $name; |
| | 64 | + |
| | 65 | + if( is_callable( $this->filterCallback ) ) { |
| | 66 | + xml_set_element_handler( $parser, array( $this, 'elementOpen' ), false ); |
| | 67 | + $this->elementOpen( $parser, $name, $attribs ); |
| | 68 | + } else { |
| | 69 | + // We only need the first open element |
| | 70 | + xml_set_element_handler( $parser, false, false ); |
| | 71 | + } |
| | 72 | + } |
| | 73 | + |
| 63 | 74 | private function elementOpen( $parser, $name, $attribs ) { |
| 64 | | - if( $this->softNamespaces ) { |
| 65 | | - // Check namespaces manually, so expat doesn't throw |
| 66 | | - // errors on use of undeclared namespaces. |
| 67 | | - foreach( $attribs as $attrib => $val ) { |
| 68 | | - if( $attrib == 'xmlns' ) { |
| 69 | | - $this->namespaces[''] = $val; |
| 70 | | - } elseif( substr( $attrib, 0, strlen( 'xmlns:' ) ) == 'xmlns:' ) { |
| 71 | | - $this->namespaces[substr( $attrib, strlen( 'xmlns:' ) )] = $val; |
| 72 | | - } |
| 73 | | - } |
| 74 | | - |
| 75 | | - if( strpos( $name, ':' ) === false ) { |
| 76 | | - $ns = ''; |
| 77 | | - $subname = $name; |
| 78 | | - } else { |
| 79 | | - list( $ns, $subname ) = explode( ':', $name, 2 ); |
| 80 | | - } |
| 81 | | - |
| 82 | | - if( isset( $this->namespaces[$ns] ) ) { |
| 83 | | - $name = $this->namespaces[$ns] . ':' . $subname; |
| 84 | | - } else { |
| 85 | | - // Technically this is invalid for XML with Namespaces. |
| 86 | | - // But..... we'll just let it slide in soft mode. |
| 87 | | - } |
| | 75 | + if( call_user_func( $this->filterCallback, $name, $attribs ) ) { |
| | 76 | + // Filter hit! |
| | 77 | + $this->filterMatch = true; |
| 88 | 78 | } |
| 89 | | - |
| 90 | | - // We only need the first open element |
| 91 | | - $this->rootElement = $name; |
| 92 | | - xml_set_element_handler( $parser, false, false ); |
| 93 | 79 | } |
| 94 | 80 | } |
| Index: branches/REL1_13/phase3/includes/Exception.php |
| — | — | @@ -274,7 +274,16 @@ |
| 275 | 275 | } |
| 276 | 276 | } |
| 277 | 277 | } else { |
| 278 | | - echo $e->__toString(); |
| | 278 | + $message = "Unexpected non-MediaWiki exception encountered, of type \"" . get_class( $e ) . "\"\n" . |
| | 279 | + $e->__toString() . "\n"; |
| | 280 | + if ( $GLOBALS['wgShowExceptionDetails'] ) { |
| | 281 | + $message .= "\n" . $e->getTraceAsString() ."\n"; |
| | 282 | + } |
| | 283 | + if ( !empty( $GLOBALS['wgCommandLineMode'] ) ) { |
| | 284 | + wfPrintError( $message ); |
| | 285 | + } else { |
| | 286 | + echo nl2br( htmlspecialchars( $message ) ). "\n"; |
| | 287 | + } |
| 279 | 288 | } |
| 280 | 289 | } |
| 281 | 290 | |
| Index: branches/REL1_13/phase3/img_auth.php |
| — | — | @@ -17,6 +17,12 @@ |
| 18 | 18 | wfProfileIn( 'img_auth.php' ); |
| 19 | 19 | require_once( dirname( __FILE__ ) . '/includes/StreamFile.php' ); |
| 20 | 20 | |
| | 21 | +$perms = User::getGroupPermissions( array( '*' ) ); |
| | 22 | +if ( in_array( 'read', $perms, true ) ) { |
| | 23 | + wfDebugLog( 'img_auth', 'Public wiki' ); |
| | 24 | + wfPublicError(); |
| | 25 | +} |
| | 26 | + |
| 21 | 27 | // Extract path and image information |
| 22 | 28 | if( !isset( $_SERVER['PATH_INFO'] ) ) { |
| 23 | 29 | wfDebugLog( 'img_auth', 'Missing PATH_INFO' ); |
| — | — | @@ -88,3 +94,25 @@ |
| 89 | 95 | wfLogProfilingData(); |
| 90 | 96 | exit(); |
| 91 | 97 | } |
| | 98 | + |
| | 99 | +/** |
| | 100 | + * Show a 403 error for use when the wiki is public |
| | 101 | + */ |
| | 102 | +function wfPublicError() { |
| | 103 | + header( 'HTTP/1.0 403 Forbidden' ); |
| | 104 | + header( 'Content-Type: text/html; charset=utf-8' ); |
| | 105 | + echo <<<ENDS |
| | 106 | +<html> |
| | 107 | +<body> |
| | 108 | +<h1>Access Denied</h1> |
| | 109 | +<p>The function of img_auth.php is to output files from a private wiki. This wiki |
| | 110 | +is configured as a public wiki. For optimal security, img_auth.php is disabled in |
| | 111 | +this case. |
| | 112 | +</p> |
| | 113 | +</body> |
| | 114 | +</html> |
| | 115 | +ENDS; |
| | 116 | + wfLogProfilingData(); |
| | 117 | + exit; |
| | 118 | +} |
| | 119 | + |
| Index: branches/REL1_13/phase3/profileinfo.php |
| — | — | @@ -60,7 +60,7 @@ |
| 61 | 61 | |
| 62 | 62 | define( 'MW_NO_SETUP', 1 ); |
| 63 | 63 | require_once( './includes/WebStart.php' ); |
| 64 | | -require_once("./AdminSettings.php"); |
| | 64 | +@include_once("./AdminSettings.php"); |
| 65 | 65 | require_once( './includes/GlobalFunctions.php' ); |
| 66 | 66 | |
| 67 | 67 | if (!$wgEnableProfileInfo) { |
| Index: branches/REL1_13/phase3/languages/messages/MessagesEn.php |
| — | — | @@ -2288,6 +2288,8 @@ |
| 2289 | 2289 | 'undelete-error-long' => 'Errors were encountered while undeleting the file: |
| 2290 | 2290 | |
| 2291 | 2291 | $1', |
| | 2292 | +'undelete-show-file-confirm' => 'Are you sure you want to view a deleted revision of the file "<nowiki>$1</nowiki>" from $2?', |
| | 2293 | +'undelete-show-file-submit' => 'Yes', |
| 2292 | 2294 | |
| 2293 | 2295 | # Namespace form on various pages |
| 2294 | 2296 | 'namespace' => 'Namespace:', |
| — | — | @@ -2583,6 +2585,8 @@ |
| 2584 | 2586 | 'import-nonewrevisions' => 'All revisions were previously imported.', |
| 2585 | 2587 | 'xml-error-string' => '$1 at line $2, col $3 (byte $4): $5', |
| 2586 | 2588 | 'import-upload' => 'Upload XML data', |
| | 2589 | +'import-token-mismatch' => 'Loss of session data. Please try again.', |
| | 2590 | +'import-invalid-interwiki' => 'Cannot import from the specified wiki.', |
| 2587 | 2591 | |
| 2588 | 2592 | # Import log |
| 2589 | 2593 | 'importlogpage' => 'Import log', |
| Index: branches/REL1_13/phase3/RELEASE-NOTES |
| — | — | @@ -3,9 +3,9 @@ |
| 4 | 4 | Security reminder: MediaWiki does not require PHP's register_globals |
| 5 | 5 | setting since version 1.2.0. If you have it on, turn it *off* if you can. |
| 6 | 6 | |
| 7 | | -== MediaWiki 1.13.2 == |
| | 7 | +== MediaWiki 1.13.3 == |
| 8 | 8 | |
| 9 | | -October 2, 2008 |
| | 9 | +November 18, 2008 |
| 10 | 10 | |
| 11 | 11 | This is a security and bugfix release of the Summer 2008 snapshot release of |
| 12 | 12 | MediaWiki. |
| — | — | @@ -21,6 +21,18 @@ |
| 22 | 22 | Those wishing to use the latest code instead of a branch release can obtain |
| 23 | 23 | it from source control: http://www.mediawiki.org/wiki/Download_from_SVN |
| 24 | 24 | |
| | 25 | +== Changes since 1.13.2 == |
| | 26 | + |
| | 27 | +* Safer handling of non-MediaWiki exceptions -- now obeys our settings for formatting and path exposure. (Rem1) |
| | 28 | +* Less verbose errors from profileinfo.php when not configured (Rem8) |
| | 29 | +* Blacklist redirects via Special:Filepath, hard to use. (Rem7) |
| | 30 | +* Improved input validation on Special:Import form (Rem10, Rem11) |
| | 31 | +* Add a .htaccess to deleted images directory for additional protection against exposure of deleted files with known SHA-1 hashes on default installations. (Rem13) |
| | 32 | +* Improved scripting safety heuristics for IE 5/6 content-type detection. (Rem14) |
| | 33 | +* Improved scripting safety heuristics on SVG uploads. (Rem2, Rem3, Rem5, Rem6) |
| | 34 | +* Improved the security of file streaming (Special:Undelete, img_auth.php and thumb.php): use the extension to determine the type, check it against the blacklist. (Rem12.2) |
| | 35 | +* Restrict img_auth.php to private wikis only. Require a session token before streaming out Special:Undelete. If uploads are hosted on a different domain, then these changes reduce the chance that an upload containing a script might steal cookies from the wiki. (Rem12.1) |
| | 36 | + |
| 25 | 37 | == Changes since 1.13.1 == |
| 26 | 38 | |
| 27 | 39 | * Security: Work around misconfiguration by requiring strict comparisons for |