r44602 MediaWiki - Code Review archive

Repository:MediaWiki
Revision:r44601‎ | r44602 | r44603 >
Date:08:36, 15 December 2008
Author:tstarling
Status:ok
Tags:
Comment:
Disable index.php and wh_generate.php by default -- potential XSS vulnerabilities.
Modified paths:
  • /trunk/extensions/wikihiero/index.php (modified) (history)
  • /trunk/extensions/wikihiero/wh_generate.php (modified) (history)

Diff [purge]

Index: trunk/extensions/wikihiero/index.php
@@ -24,6 +24,9 @@
2525 //
2626 //////////////////////////////////////////////////////////////////////////
2727
 28+echo "This script is insecure and shouldn't be used on a public wiki.\n";
 29+exit( 1 );
 30+
2831 $IP = getenv( 'MW_INSTALL_PATH' );
2932 if ( $IP === false ) {
3033 $IP = dirname( __FILE__ ) .'/../..';
Index: trunk/extensions/wikihiero/wh_generate.php
@@ -24,6 +24,10 @@
2525 //
2626 //////////////////////////////////////////////////////////////////////////
2727
 28+echo "This script is insecure and shouldn't be used on a public wiki.\n";
 29+exit( 1 );
 30+
 31+
2832 include "wh_main.php";
2933
3034 if(array_key_exists("lang", $_GET)) {

Follow-up revisions

RevisionCommit summaryAuthorDate
r44604Backport r44602 to 1.12 and 1.13tstarling08:38, 15 December 2008

Status & tagging log