r75016 MediaWiki - Code Review archive

Repository:MediaWiki
Revision:r75015‎ | r75016 | r75017 >
Date:17:34, 19 October 2010
Author:catrope
Status:deferred
Tags:
Comment:
CentralNotice: Merge r75015 from 1.16wmf4 (CentralNotice XSS fix)
Modified paths:
  • /trunk/extensions/CentralNotice/SpecialBannerController.php (modified) (history)

Diff [purge]

Index: trunk/extensions/CentralNotice/SpecialBannerController.php
@@ -55,7 +55,8 @@
5656 'fn': {
5757 'loadBanner': function( bannerName ) {
5858 // Get the requested banner
59 - var bannerPage = 'Special:BannerLoader?banner='+bannerName+'&userlang='+wgUserLanguage+'&db='+wgDBname+'&sitename='+wgSiteName+'&country='+Geo.country;
 59+ var bannerPageQuery = $.param( { 'banner': bannerName, 'userlang': wgUserLanguage, 'db': wgDBname, 'sitename': wgSiteName, 'country': Geo.country } );
 60+ var bannerPage = 'Special:BannerLoader?' + bannerPageQuery;
6061 EOT;
6162 $js .= "\n\t\t\t\tvar bannerScript = '<script type=\"text/javascript\" src=\"".Xml::escapeJsString( $wgCentralPagePath )."' + bannerPage + '\"></script>';\n";
6263 $js .= <<<EOT
@@ -68,7 +69,8 @@
6970 } else {
7071 var geoLocation = Geo.country; // pull the geo info
7172 }
72 - var bannerListPage = 'Special:BannerListLoader?language='+wgContentLanguage+'&project='+wgNoticeProject+'&country='+geoLocation;
 73+ var bannerListQuery = $.param( { 'language': wgContentLanguage, 'project': wgNoticeProject, 'country': geoLocation } );
 74+ var bannerListPage = 'Special:BannerListLoader?' + bannerListQuery;
7375 bannerListURL = wgArticlePath.replace( '$1', bannerListPage );
7476 var request = $.ajax( {
7577 url: bannerListURL,

Past revisions this follows-up on

RevisionCommit summaryAuthorDate
r750151.16wmf4: Committing live fix for CentralNotice XSScatrope17:32, 19 October 2010

Status & tagging log