| Index: trunk/phase3/includes/Sanitizer.php |
| — | — | @@ -614,13 +614,15 @@ |
| 615 | 615 | * @todo Check for unique id attribute :P |
| 616 | 616 | */ |
| 617 | 617 | static function validateAttributes( $attribs, $whitelist ) { |
| | 618 | + global $wgAllowRdfaAttributes; |
| | 619 | + |
| 618 | 620 | $whitelist = array_flip( $whitelist ); |
| 619 | 621 | $hrefExp = '/^(' . wfUrlProtocols() . ')[^\s]+$/'; |
| 620 | 622 | |
| 621 | 623 | $out = array(); |
| 622 | 624 | foreach( $attribs as $attribute => $value ) { |
| 623 | | - #allow XML namespace declaration. Useful especially with RDFa |
| 624 | | - if ( preg_match( MW_XMLNS_ATTRIBUTE_PATTRN, $attribute ) ) { |
| | 625 | + #allow XML namespace declaration if RDFa is enabled |
| | 626 | + if ( $wgAllowRdfaAttributes && preg_match( MW_XMLNS_ATTRIBUTE_PATTRN, $attribute ) ) { |
| 625 | 627 | if ( !preg_match( MW_EVIL_URI_PATTERN, $value ) ) { |
| 626 | 628 | $out[$attribute] = $value; |
| 627 | 629 | } |