r49072 MediaWiki - Code Review archive

Repository:MediaWiki
Revision:r49071‎ | r49072 | r49073 >
Date:14:02, 31 March 2009
Author:jojo
Status:reverted (Comments)
Tags:
Comment:
fixes
Modified paths:
  • /trunk/extensions/Collection/collection/popup.js (modified) (history)

Diff [purge]

Index: trunk/extensions/Collection/collection/popup.js
@@ -6,7 +6,7 @@
77 document.write('<script type="text/javascript" src="' + wgCollectionNavPopupJSURL + '"></script>');
88 importStylesheetURI(wgCollectionNavPopupCSSURL);
99
10 -var createBookMode = true;
 10+var createBookMode = false;
1111 var collectionArticleList = [];
1212 var collectionPopup;
1313
@@ -43,6 +43,7 @@
4444 if (ns != 0) {
4545 stripped_title = pg.current.article.stripNamespace();
4646 }
 47+ stripped_title = stripped_title.replace(/'/, "\\'");
4748 var popupContent = '<a onclick="';
4849 if (isInCollection(title)) {
4950 popupContent += 'popupCollectionCall(\'RemoveArticle\', [' + ns + ', \'' + stripped_title + '\', 0]); return false;';

Follow-up revisions

RevisionCommit summaryAuthorDate
r59946Removed the popup feature. It's bloated (with a huge amount of unnecessary an...tstarling06:28, 11 December 2009

Comments

#Comment by Brion VIBBER (talk | contribs)   20:34, 4 May 2009

Seems to be an attempt to add some escaping for the JS generated in r49069, but this isn't sufficient.

#Comment by Tim Starling (talk | contribs)   06:11, 11 December 2009

This is an exploitable XSS vulnerability, live on Wikipedia for 8 months. I don't know why we put up with it.

Status & tagging log