r50477 MediaWiki - Code Review archive

Repository:MediaWiki
Revision:r50476‎ | r50477 | r50478 >
Date:12:31, 11 May 2009
Author:tstarling
Status:deferred
Tags:
Comment:
* Fix register_globals inclusion vulnerability
* Fix register_globals configuration variable injection
* Defer Parser::setFunctionHook until ParserFirstCallInit
Modified paths:
  • /trunk/extensions/Widgets/Widgets.php (modified) (history)

Diff [purge]

Index: trunk/extensions/Widgets/Widgets.php
@@ -7,6 +7,11 @@
88 * @version $Id: Widgets.php 15 2008-06-25 21:22:40Z sergey.chernyshev $
99 */
1010
 11+if ( !defined( 'MEDIAWIKI' ) ) {
 12+ echo "This file is not a valid entry point.";
 13+ exit( 1 );
 14+}
 15+
1116 $wgExtensionCredits['parserhook'][] = array(
1217 'path' => __FILE__,
1318 'name' => 'Widgets',
@@ -16,21 +21,24 @@
1722 'url' => 'http://www.mediawiki.org/wiki/Extension:Widgets'
1823 );
1924
 25+/**
 26+ * Set this to the index of the Widget namespace
 27+ */
 28+$widgetNamespaceIndex = 274;
 29+
 30+
2031 // Initialize Smarty
2132
22 -require "$IP/extensions/Widgets/smarty/Smarty.class.php";
 33+require dirname(__FILE__)."/smarty/Smarty.class.php";
2334
2435 // Parser function registration
25 -$wgExtensionFunctions[] = 'widgetParserFunctions';
 36+$wgExtensionFunctions[] = 'widgetNamespacesInit';
2637 $wgHooks['LanguageGetMagic'][] = 'widgetLanguageGetMagic';
 38+$wgHooks['ParserFirstCallInit'][] = 'widgetParserFunctions';
2739
28 -// Init Widget namespaces
29 -widgetNamespacesInit();
30 -
31 -function widgetParserFunctions()
 40+function widgetParserFunctions( &$parser )
3241 {
33 - global $wgParser;
34 - $wgParser->setFunctionHook('widget', 'renderWidget');
 42+ $parser->setFunctionHook('widget', 'renderWidget');
3543 }
3644
3745 function widgetLanguageGetMagic( &$magicWords, $langCode = "en" )
@@ -166,10 +174,6 @@
167175 global $widgetNamespaceIndex, $wgExtraNamespaces, $wgNamespacesWithSubpages,
168176 $wgGroupPermissions, $wgNamespaceProtection;
169177
170 - if (!isset($widgetNamespaceIndex)) {
171 - $widgetNamespaceIndex = 274;
172 - }
173 -
174178 define('NS_WIDGET', $widgetNamespaceIndex);
175179 define('NS_WIDGET_TALK', $widgetNamespaceIndex+1);
176180

Follow-up revisions

RevisionCommit summaryAuthorDate
r51681Backported r50477, r50541, r50898, r50900, recent changes from trunk includin...tstarling05:42, 10 June 2009

Status & tagging log