| Index: trunk/phase3/images/.htaccess |
| — | — | @@ -1,6 +1,6 @@ |
| 2 | 2 | # Protect against bug 28235 |
| 3 | 3 | <IfModule rewrite_module> |
| 4 | 4 | RewriteEngine On |
| 5 | | - RewriteCond %{QUERY_STRING} \.[a-z]{1,4}$ [nocase] |
| | 5 | + RewriteCond %{QUERY_STRING} \.[a-z0-9]{1,4}(#|\?|$) [nocase] |
| 6 | 6 | RewriteRule . - [forbidden] |
| 7 | 7 | </IfModule> |
| Index: trunk/phase3/includes/WebRequest.php |
| — | — | @@ -785,7 +785,7 @@ |
| 786 | 786 | global $wgScriptExtension; |
| 787 | 787 | |
| 788 | 788 | if ( isset( $_SERVER['QUERY_STRING'] ) |
| 789 | | - && preg_match( '/\.[a-z]{1,4}$/i', $_SERVER['QUERY_STRING'] ) ) |
| | 789 | + && preg_match( '/\.[a-z0-9]{1,4}(#|\?|$)/i', $_SERVER['QUERY_STRING'] ) ) |
| 790 | 790 | { |
| 791 | 791 | // Bug 28235 |
| 792 | 792 | // Block only Internet Explorer, and requests with missing UA |
| Index: trunk/phase3/img_auth.php |
| — | — | @@ -40,7 +40,7 @@ |
| 41 | 41 | |
| 42 | 42 | // Check for bug 28235: QUERY_STRING overriding the correct extension |
| 43 | 43 | if ( isset( $_SERVER['QUERY_STRING'] ) |
| 44 | | - && preg_match( '/\.[a-z]{1,4}$/i', $_SERVER['QUERY_STRING'] ) ) |
| | 44 | + && preg_match( '/\.[a-z0-9]{1,4}(#|\?|$)/i', $_SERVER['QUERY_STRING'] ) ) |
| 45 | 45 | { |
| 46 | 46 | wfForbidden( 'img-auth-accessdenied', 'img-auth-bad-query-string' ); |
| 47 | 47 | } |