| Index: trunk/phase3/images/.htaccess |
| — | — | @@ -1,6 +1,6 @@ |
| 2 | 2 | # Protect against bug 28235 |
| 3 | 3 | <IfModule rewrite_module> |
| 4 | 4 | RewriteEngine On |
| 5 | | - RewriteCond %{QUERY_STRING} \.[a-z0-9]{1,4}(#|\?|$) [nocase] |
| | 5 | + RewriteCond %{QUERY_STRING} \.[^\\/:*?\x22<>|%]+(#|\?|$) [nocase] |
| 6 | 6 | RewriteRule . - [forbidden] |
| 7 | 7 | </IfModule> |
| Index: trunk/phase3/includes/User.php |
| — | — | @@ -937,24 +937,25 @@ |
| 938 | 938 | return false; |
| 939 | 939 | } |
| 940 | 940 | |
| 941 | | - $this->mId = $sId; |
| 942 | | - if ( !$this->loadFromId() ) { |
| 943 | | - # Not a valid ID, loadFromId has switched the object to anon for us |
| | 941 | + $proposedUser = User::newFromId( $sId ); |
| | 942 | + if ( !$proposedUser->isLoggedIn() ) { |
| | 943 | + # Not a valid ID |
| | 944 | + $this->loadDefaults(); |
| 944 | 945 | return false; |
| 945 | 946 | } |
| 946 | 947 | |
| 947 | 948 | global $wgBlockDisablesLogin; |
| 948 | | - if( $wgBlockDisablesLogin && $this->isBlocked() ) { |
| | 949 | + if( $wgBlockDisablesLogin && $proposedUser->isBlocked() ) { |
| 949 | 950 | # User blocked and we've disabled blocked user logins |
| 950 | 951 | $this->loadDefaults(); |
| 951 | 952 | return false; |
| 952 | 953 | } |
| 953 | 954 | |
| 954 | 955 | if ( $wgRequest->getSessionData( 'wsToken' ) !== null ) { |
| 955 | | - $passwordCorrect = $this->mToken == $wgRequest->getSessionData( 'wsToken' ); |
| | 956 | + $passwordCorrect = $proposedUser->getToken() === $wgRequest->getSessionData( 'wsToken' ); |
| 956 | 957 | $from = 'session'; |
| 957 | 958 | } else if ( $wgRequest->getCookie( 'Token' ) !== null ) { |
| 958 | | - $passwordCorrect = $this->mToken == $wgRequest->getCookie( 'Token' ); |
| | 959 | + $passwordCorrect = $proposedUser->getToken() === $wgRequest->getCookie( 'Token' ); |
| 959 | 960 | $from = 'cookie'; |
| 960 | 961 | } else { |
| 961 | 962 | # No session or persistent login cookie |
| — | — | @@ -962,7 +963,8 @@ |
| 963 | 964 | return false; |
| 964 | 965 | } |
| 965 | 966 | |
| 966 | | - if ( ( $sName == $this->mName ) && $passwordCorrect ) { |
| | 967 | + if ( ( $sName === $proposedUser->getName() ) && $passwordCorrect ) { |
| | 968 | + $this->loadFromUserObject( $proposedUser ); |
| 967 | 969 | $wgRequest->setSessionData( 'wsToken', $this->mToken ); |
| 968 | 970 | wfDebug( "User: logged in from $from\n" ); |
| 969 | 971 | return true; |
| — | — | @@ -1064,6 +1066,18 @@ |
| 1065 | 1067 | } |
| 1066 | 1068 | |
| 1067 | 1069 | /** |
| | 1070 | + * Load the data for this user object from another user object. |
| | 1071 | + */ |
| | 1072 | + protected function loadFromUserObject( $user ) { |
| | 1073 | + $user->load(); |
| | 1074 | + $user->loadGroups(); |
| | 1075 | + $user->loadOptions(); |
| | 1076 | + foreach ( self::$mCacheVars as $var ) { |
| | 1077 | + $this->$var = $user->$var; |
| | 1078 | + } |
| | 1079 | + } |
| | 1080 | + |
| | 1081 | + /** |
| 1068 | 1082 | * Load the groups from the database if they aren't already loaded. |
| 1069 | 1083 | * @private |
| 1070 | 1084 | */ |
| Index: trunk/phase3/includes/WebRequest.php |
| — | — | @@ -786,7 +786,7 @@ |
| 787 | 787 | global $wgScriptExtension; |
| 788 | 788 | |
| 789 | 789 | if ( isset( $_SERVER['QUERY_STRING'] ) |
| 790 | | - && preg_match( '/\.[a-z0-9]{1,4}(#|\?|$)/i', $_SERVER['QUERY_STRING'] ) ) |
| | 790 | + && preg_match( '/\.[^\\/:*?"<>|%]+(#|\?|$)/i', $_SERVER['QUERY_STRING'] ) ) |
| 791 | 791 | { |
| 792 | 792 | // Bug 28235 |
| 793 | 793 | // Block only Internet Explorer, and requests with missing UA |
| Index: trunk/phase3/img_auth.php |
| — | — | @@ -40,7 +40,7 @@ |
| 41 | 41 | |
| 42 | 42 | // Check for bug 28235: QUERY_STRING overriding the correct extension |
| 43 | 43 | if ( isset( $_SERVER['QUERY_STRING'] ) |
| 44 | | - && preg_match( '/\.[a-z0-9]{1,4}(#|\?|$)/i', $_SERVER['QUERY_STRING'] ) ) |
| | 44 | + && preg_match( '/\.[^\\/:*?"<>|%]+(#|\?|$)/i', $_SERVER['QUERY_STRING'] ) ) |
| 45 | 45 | { |
| 46 | 46 | wfForbidden( 'img-auth-accessdenied', 'img-auth-bad-query-string' ); |
| 47 | 47 | } |
| Index: trunk/phase3/RELEASE-NOTES |
| — | — | @@ -1,7 +1,7 @@ |
| 2 | 2 | = MediaWiki release notes = |
| 3 | 3 | |
| 4 | 4 | Security reminder: MediaWiki does not require PHP's register_globals |
| 5 | | -setting since version 1.2.0. If you have it on, turn it *off* if you can. |
| | 5 | +setting since version 1.2.0. If you have it on, turn it '''off''' if you can. |
| 6 | 6 | |
| 7 | 7 | == MediaWiki 1.18 == |
| 8 | 8 | |