r55119 MediaWiki - Code Review archive

Repository:MediaWiki
Revision:r55118‎ | r55119 | r55120 >
Date:22:38, 15 August 2009
Author:dale
Status:ok (Comments)
Tags:
Comment:
* removed plain-text output because IE is retarded treats plain-text as html (in fact no mime type I have found lets you send text to IE and have it treat it like text :( ....
Modified paths:
  • /trunk/phase3/includes/api/ApiFormatJson.php (modified) (history)

Diff [purge]

Index: trunk/phase3/includes/api/ApiFormatJson.php
@@ -46,10 +46,6 @@
4747 if( $params['callback']){
4848 return 'text/javascript';
4949 }
50 - //check for text content request
51 - if( isset( $params['ctypetext']) && $params['ctypetext']) {
52 - return 'text/plain';
53 - }
5450 return 'application/json';
5551 }
5652
@@ -86,22 +82,20 @@
8783 if (!function_exists('json_encode') || $isHtml || strtolower(json_encode("\xf0\xa0\x80\x80")) != '\ud840\udc00') {
8884 $json = new Services_JSON();
8985 return $json->encode($value, $isHtml) ;
90 - } else {
 86+ } else {
9187 return json_encode($value);
9288 }
9389 }
9490
9591 public function getAllowedParams() {
9692 return array (
97 - 'callback' => null,
98 - 'ctypetext' => null
 93+ 'callback' => null,
9994 );
10095 }
10196
10297 public function getParamDescription() {
10398 return array (
104 - 'callback' => 'If specified, wraps the output into a given function call. For safety, all user-specific data will be restricted.',
105 - 'ctypetext'=> 'Used to set the content type of the json result to plain-text (useful for evaling iframe uploads)',
 99+ 'callback' => 'If specified, wraps the output into a given function call. For safety, all user-specific data will be restricted.',
106100 );
107101 }
108102

Comments

#Comment by Brion VIBBER (talk | contribs)   23:06, 18 August 2009

Fixes XSS security hole which was introduced. Thanks!

#Comment by Mdale (talk | contribs)   00:35, 19 August 2009

yea don't know if I should get much credit considering I introduced it (its only a xss hole for broken browsers (ie IE) ) but at any rate it turns out the jsonfm response worked pretty well:

var doc = iframe.contentDocument ? iframe.contentDocument : frames[iframe.id].document; json_str = $j(doc.body).find('pre').html(); return window["eval"]("(" +json_str + ")");

Status & tagging log