r51680 MediaWiki - Code Review archive

Repository:MediaWiki
Revision:r51679‎ | r51680 | r51681 >
Date:05:29, 10 June 2009
Author:tstarling
Status:deferred
Tags:
Comment:
Use require not include when sourcing commandLine.inc, to avoid possible web execution when the web server is configured strangely. Detected during automated security scanning. For backport to 1.15.
Modified paths:
  • /trunk/phase3/maintenance/dumpInterwiki.php (modified) (history)
  • /trunk/phase3/maintenance/findhooks.php (modified) (history)
  • /trunk/phase3/maintenance/fuzz-tester.php (modified) (history)
  • /trunk/phase3/maintenance/rebuildInterwiki.php (modified) (history)

Diff [purge]

Index: trunk/phase3/maintenance/fuzz-tester.php
@@ -169,7 +169,7 @@
170170 /////////////////////////// COMMAND LINE HELP ////////////////////////////////////
171171
172172 // This is a command line script, load MediaWiki env (gives command line options);
173 -include('commandLine.inc');
 173+require('commandLine.inc');
174174
175175 // if the user asked for an explanation of command line options.
176176 if ( isset( $options["help"] ) ) {
Index: trunk/phase3/maintenance/rebuildInterwiki.php
@@ -12,8 +12,8 @@
1313 $oldCwd = getcwd();
1414
1515 $optionsWithArgs = array( "d" );
16 -include_once( "commandLine.inc" );
17 -include_once( "rebuildInterwiki.inc" );
 16+require( "commandLine.inc" );
 17+require( "rebuildInterwiki.inc" );
1818 chdir( $oldCwd );
1919
2020 # Output
Index: trunk/phase3/maintenance/findhooks.php
@@ -21,8 +21,7 @@
2222 */
2323
2424 /** This is a command line script*/
25 -include('commandLine.inc');
26 -
 25+require('commandLine.inc');
2726 # GLOBALS
2827
2928 $doc = $IP . '/docs/hooks.txt';
@@ -156,4 +155,4 @@
157156 printArray('unclear hook calls', $bad );
158157
159158 if ( count( $todo ) == 0 && count( $deprecated ) == 0 && count( $bad ) == 0 )
160 - echo "Looks good!\n";
\ No newline at end of file
 159+ echo "Looks good!\n";
Index: trunk/phase3/maintenance/dumpInterwiki.php
@@ -12,8 +12,8 @@
1313 $oldCwd = getcwd();
1414
1515 $optionsWithArgs = array( "o" );
16 -include_once( "commandLine.inc" );
17 -include_once( "dumpInterwiki.inc" );
 16+require( "commandLine.inc" );
 17+require( "dumpInterwiki.inc" );
1818 chdir( $oldCwd );
1919
2020 # Output

Follow-up revisions

RevisionCommit summaryAuthorDate
r51684Backported r51680 (use require not include) and added release notes.tstarling05:53, 10 June 2009
r51779Merging changes from r51680-r51775 from trunk.demon02:38, 12 June 2009

Status & tagging log