| Index: trunk/phase3/includes/Sanitizer.php |
| — | — | @@ -389,6 +389,12 @@ |
| 390 | 390 | 'li', |
| 391 | 391 | ); |
| 392 | 392 | |
| | 393 | + global $wgAllowImageTag; |
| | 394 | + if ( $wgAllowImageTag ) { |
| | 395 | + $htmlsingle[] = 'img'; |
| | 396 | + $htmlsingleonly[] = 'img'; |
| | 397 | + } |
| | 398 | + |
| 393 | 399 | $htmlsingleallowed = array_unique( array_merge( $htmlsingle, $tabletags ) ); |
| 394 | 400 | $htmlelementsStatic = array_unique( array_merge( $htmlsingle, $htmlpairsStatic, $htmlnest ) ); |
| 395 | 401 | |
| — | — | @@ -1403,8 +1409,9 @@ |
| 1404 | 1410 | |
| 1405 | 1411 | # 13.2 |
| 1406 | 1412 | # Not usually allowed, but may be used for extension-style hooks |
| 1407 | | - # such as <math> when it is rasterized |
| 1408 | | - 'img' => array_merge( $common, array( 'alt' ) ), |
| | 1413 | + # such as <math> when it is rasterized, or if $wgAllowImageTag is |
| | 1414 | + # true |
| | 1415 | + 'img' => array_merge( $common, array( 'alt', 'src' ) ), |
| 1409 | 1416 | |
| 1410 | 1417 | # 15.2.1 |
| 1411 | 1418 | 'tt' => $common, |
| Index: trunk/phase3/includes/DefaultSettings.php |
| — | — | @@ -1909,6 +1909,16 @@ |
| 1910 | 1910 | */ |
| 1911 | 1911 | $wgEnableImageWhitelist = true; |
| 1912 | 1912 | |
| | 1913 | +/** |
| | 1914 | + * A different approach to the above: simply allow the <img> tag to be used. |
| | 1915 | + * This allows you to specify alt text and other attributes, copy-paste HTML to |
| | 1916 | + * your wiki more easily, etc. However, allowing external images in any manner |
| | 1917 | + * will allow anyone with editing rights to snoop on your visitors' IP |
| | 1918 | + * addresses and so forth, if they wanted to, by inserting links to images on |
| | 1919 | + * sites they control. |
| | 1920 | + */ |
| | 1921 | +$wgAllowImageTag = false; |
| | 1922 | + |
| 1913 | 1923 | /** Allows to move images and other media files */ |
| 1914 | 1924 | $wgAllowImageMoving = true; |
| 1915 | 1925 | |
| Index: trunk/phase3/RELEASE-NOTES |
| — | — | @@ -23,6 +23,7 @@ |
| 24 | 24 | extensions has been removed. |
| 25 | 25 | * $wgLogAutocreatedAccounts controls whether autocreation of accounts is logged |
| 26 | 26 | to new users log. |
| | 27 | +* $wgAllowImageTag can be set to true to whitelist the <img> tag in wikitext. |
| 27 | 28 | |
| 28 | 29 | === New features in 1.17 === |
| 29 | 30 | * (bug 10183) Users can now add personal styles and scripts to all skins via |