| Index: branches/REL1_15/phase3/includes/Sanitizer.php |
| — | — | @@ -607,10 +607,6 @@ |
| 608 | 608 | # http://msdn.microsoft.com/workshop/author/dhtml/overview/recalc.asp |
| 609 | 609 | if( $attribute == 'style' ) { |
| 610 | 610 | $value = Sanitizer::checkCss( $value ); |
| 611 | | - if( $value === false ) { |
| 612 | | - # haxx0r |
| 613 | | - continue; |
| 614 | | - } |
| 615 | 611 | } |
| 616 | 612 | |
| 617 | 613 | if ( $attribute === 'id' ) { |
| — | — | @@ -664,10 +660,8 @@ |
| 665 | 661 | $value = StringUtils::delimiterReplace( '/*', '*/', ' ', $value ); |
| 666 | 662 | |
| 667 | 663 | // Decode escape sequences and line continuation |
| 668 | | - // See the grammar in the CSS 2 spec, appendix D, Mozilla implements it accurately. |
| 669 | | - // IE 8 doesn't implement it at all, but there's no way to introduce url() into |
| 670 | | - // IE that doesn't hit Mozilla also. |
| 671 | | - static $decodeRegex; |
| | 664 | + // See the grammar in the CSS 2 spec, appendix D. |
| | 665 | + static $decodeRegex, $reencodeTable; |
| 672 | 666 | if ( !$decodeRegex ) { |
| 673 | 667 | $space = '[\\x20\\t\\r\\n\\f]'; |
| 674 | 668 | $nl = '(?:\\n|\\r\\n|\\r|\\f)'; |
| — | — | @@ -676,30 +670,41 @@ |
| 677 | 671 | (?: |
| 678 | 672 | ($nl) | # 1. Line continuation |
| 679 | 673 | ([0-9A-Fa-f]{1,6})$space? | # 2. character number |
| 680 | | - (.) # 3. backslash cancelling special meaning |
| | 674 | + (.) | # 3. backslash cancelling special meaning |
| | 675 | + () | # 4. backslash at end of string |
| 681 | 676 | )/xu"; |
| 682 | 677 | } |
| 683 | | - $decoded = preg_replace_callback( $decodeRegex, |
| | 678 | + $value = preg_replace_callback( $decodeRegex, |
| 684 | 679 | array( __CLASS__, 'cssDecodeCallback' ), $value ); |
| 685 | | - if ( preg_match( '!expression|https?://|url\s*\(!i', $decoded ) ) { |
| 686 | | - // Not allowed |
| 687 | | - return false; |
| 688 | | - } else { |
| 689 | | - // Allowed, return CSS with comments stripped |
| 690 | | - return $value; |
| | 680 | + |
| | 681 | + // Reject problematic keywords and control characters |
| | 682 | + if ( preg_match( '/[\000-\010\016-\037\177]/', $value ) ) { |
| | 683 | + return '/* invalid control char */'; |
| | 684 | + } elseif ( preg_match( '! expression | filter\s*: | accelerator\s*: | url\s*\( !ix', $value ) ) { |
| | 685 | + return '/* insecure input */'; |
| 691 | 686 | } |
| | 687 | + return $value; |
| 692 | 688 | } |
| 693 | 689 | |
| 694 | 690 | static function cssDecodeCallback( $matches ) { |
| 695 | 691 | if ( $matches[1] !== '' ) { |
| | 692 | + // Line continuation |
| 696 | 693 | return ''; |
| 697 | 694 | } elseif ( $matches[2] !== '' ) { |
| 698 | | - return codepointToUtf8( hexdec( $matches[2] ) ); |
| | 695 | + $char = codepointToUtf8( hexdec( $matches[2] ) ); |
| 699 | 696 | } elseif ( $matches[3] !== '' ) { |
| 700 | | - return $matches[3]; |
| | 697 | + $char = $matches[3]; |
| 701 | 698 | } else { |
| 702 | | - throw new MWException( __METHOD__.': invalid match' ); |
| | 699 | + $char = '\\'; |
| 703 | 700 | } |
| | 701 | + if ( $char == "\n" || $char == '"' || $char == "'" || $char == '\\' ) { |
| | 702 | + // These characters need to be escaped in strings |
| | 703 | + // Clean up the escape sequence to avoid parsing errors by clients |
| | 704 | + return '\\' . dechex( ord( $char ) ) . ' '; |
| | 705 | + } else { |
| | 706 | + // Decode unnecessary escape |
| | 707 | + return $char; |
| | 708 | + } |
| 704 | 709 | } |
| 705 | 710 | |
| 706 | 711 | /** |
| Property changes on: branches/REL1_15/phase3/includes/Sanitizer.php |
| ___________________________________________________________________ |
| Added: svn:mergeinfo |
| 707 | 712 | Merged /trunk/phase3/includes/Sanitizer.php:r48836,48886,48892,48989,48992,49002,49051,49068,49086,49191-49192,49212,49682,49685,49730,49775,49954,49956,49999,50041,50054,50070,50132,50134,50169,50215,50218,50328,50470,50580,51587,54828,66990 |
| 708 | 713 | Merged /trunk/phase3/includes/specials/Sanitizer.php:r48993 |
| Index: branches/REL1_15/phase3/includes/DefaultSettings.php |
| — | — | @@ -33,7 +33,7 @@ |
| 34 | 34 | } |
| 35 | 35 | |
| 36 | 36 | /** MediaWiki version number */ |
| 37 | | -$wgVersion = '1.15.3'; |
| | 37 | +$wgVersion = '1.15.4'; |
| 38 | 38 | |
| 39 | 39 | /** Name of the site. It must be changed in LocalSettings.php */ |
| 40 | 40 | $wgSitename = 'MediaWiki'; |
| Property changes on: branches/REL1_15/phase3/includes/specials |
| ___________________________________________________________________ |
| Modified: svn:mergeinfo |
| 41 | 41 | Merged /trunk/phase3/includes/specials:r65760 |
| Property changes on: branches/REL1_15/phase3/includes/templates |
| ___________________________________________________________________ |
| Added: svn:mergeinfo |
| 42 | 42 | Merged /trunk/phase3/includes/templates:r48836,48886,48892,48989,48992,49002,49051,49068,49086,49191-49192,49212,49682,49685,49730,49775,49954,49956,49999,50041,50054,50070,50132,50134,50169,50215,50218,50328,50470,50580,51587,54828,65760 |
| 43 | 43 | Merged /trunk/phase3/includes/specials/templates:r48993 |
| Index: branches/REL1_15/phase3/RELEASE-NOTES |
| — | — | @@ -5,6 +5,8 @@ |
| 6 | 6 | |
| 7 | 7 | == MediaWiki 1.15.4 == |
| 8 | 8 | |
| | 9 | +2010-05-28 |
| | 10 | + |
| 9 | 11 | This is a security and maintenance release. |
| 10 | 12 | |
| 11 | 13 | MediaWiki is now using a "continuous integration" development model with |
| — | — | @@ -21,6 +23,10 @@ |
| 22 | 24 | == Changes since 1.15.3 == |
| 23 | 25 | |
| 24 | 26 | * (bug 23534) Fixed SQL query error in API list=allusers. |
| | 27 | +* (bug 23371) Fixed CSRF vulnerability in "e-mail me my password", "create |
| | 28 | + account" and "create by e-mail" features of [[Special:Userlogin]] |
| | 29 | +* (bug 23687) Fixed XSS vulnerability affecting IE clients only, due to a CSS |
| | 30 | + validation issue. |
| 25 | 31 | |
| 26 | 32 | === Changes since 1.15.2 === |
| 27 | 33 | |