r81050 MediaWiki - Code Review archive

Repository:MediaWiki
Revision:r81049‎ | r81050 | r81051 >
Date:20:29, 26 January 2011
Author:foxtrott
Status:deferred
Tags:
Comment:
fixed bug and security issue
* script execution crashed when another framework beside jQuery used $
* parser function allowed injection of arbitrary script code
Modified paths:
  • /trunk/extensions/HeaderTabs/HeaderTabs_body.jq.php (modified) (history)
  • /trunk/extensions/HeaderTabs/HeaderTabs_body.yui.php (modified) (history)

Diff [purge]

Index: trunk/extensions/HeaderTabs/HeaderTabs_body.yui.php
@@ -129,14 +129,15 @@
130130 function renderSwitchTabLink( &$parser, $tabName, $linkText, $anotherTarget = '' ) {
131131 $tabTitle = Title::newFromText( $tabName );
132132 $tabKey = $tabTitle->getDBkey();
 133+ $sanitizedLinkText = $parser->recursiveTagParse( $linkText );
133134
134135 if ( $anotherTarget != '' ) {
135136 $targetTitle = Title::newFromText( $anotherTarget );
136137 $targetURL = $targetTitle->getFullURL();
137138
138 - $output = '<a href="' . $targetURL . '#tab=' . $tabKey . '">' . $linkText . '</a>';
 139+ $output = '<a href="' . $targetURL . '#tab=' . $tabKey . '">' . $sanitizedLinkText . '</a>';
139140 } else {
140 - $output = '<a href="#tab=' . $tabKey . '" onclick="return HeaderTabs.switchTab(\'' . $tabKey . '\')">' . $linkText . '</a>';
 141+ $output = '<a href="#tab=' . $tabKey . '" onclick="return HeaderTabs.switchTab(\'' . $tabKey . '\')">' . $sanitizedLinkText . '</a>';
141142 }
142143
143144 return $parser->insertStripItem( $output, $parser->mStripState );
Index: trunk/extensions/HeaderTabs/HeaderTabs_body.jq.php
@@ -93,20 +93,23 @@
9494 $wgOut->addModules( 'jquery.ui.tabs' );
9595 $js_text =<<<END
9696 <script type="text/javascript">
97 -$(function() {
 97+jQuery(function($) {
 98+
9899 $("#headertabs").tabs();
99100 var curHash = window.location.hash;
100101 if ( curHash.indexOf( "#tab=" ) == 0 ) {
101102 var tabName = curHash.replace( "#tab=", "" );
102103 $("#headertabs").tabs('select', tabName);
103104 }
 105+
 106+ $(".tabLink").click( function() {
 107+ var href = $(this).attr('href');
 108+ var tabName = href.replace( "#tab=", "" );
 109+ $("#headertabs").tabs('select', tabName);
 110+ return false; //$htUseHistory;
 111+ } );
 112+
104113 });
105 -$(".tabLink").click( function() {
106 - var href = $(this).attr('href');
107 - var tabName = href.replace( "#tab=", "" );
108 - $("#headertabs").tabs('select', tabName);
109 - return false; //$htUseHistory;
110 -} );
111114 </script>
112115
113116 END;
@@ -118,15 +121,16 @@
119122 function renderSwitchTabLink( &$parser, $tabName, $linkText, $anotherTarget = '' ) {
120123 $tabTitle = Title::newFromText( $tabName );
121124 $tabKey = $tabTitle->getDBkey();
 125+ $sanitizedLinkText = $parser->recursiveTagParse( $linkText );
122126
123127 if ( $anotherTarget != '' ) {
124128 $targetTitle = Title::newFromText( $anotherTarget );
125129 $targetURL = $targetTitle->getFullURL();
126130
127 - $output = '<a href="' . $targetURL . '#tab=' . $tabKey . '">' . $linkText . '</a>';
 131+ $output = '<a href="' . $targetURL . '#tab=' . $tabKey . '">' . $sanitizedLinkText . '</a>';
128132 } else {
129133 $output =<<<END
130 -<a href="#tab=$tabKey" class="tabLink">$linkText</a>
 134+<a href="#tab=$tabKey" class="tabLink">$sanitizedLinkText</a>
131135 END;
132136 }
133137

Status & tagging log