| Index: trunk/phase3/includes/WebRequest.php |
| — | — | @@ -785,10 +785,8 @@ |
| 786 | 786 | public function isPathInfoBad() { |
| 787 | 787 | global $wgScriptExtension; |
| 788 | 788 | |
| 789 | | - if ( isset( $_SERVER['QUERY_STRING'] ) ) |
| 790 | | - { |
| 791 | | - // Bug 28235 |
| 792 | | - return strval( self::findIE6Extension( $_SERVER['QUERY_STRING'] ) ) !== ''; |
| | 789 | + if ( $this->isQueryStringBad() ) { |
| | 790 | + return true; |
| 793 | 791 | } |
| 794 | 792 | |
| 795 | 793 | if ( !isset( $_SERVER['PATH_INFO'] ) ) { |
| — | — | @@ -876,6 +874,24 @@ |
| 877 | 875 | } |
| 878 | 876 | |
| 879 | 877 | /** |
| | 878 | + * Check for a bad query string, which IE 6 will use as a potentially |
| | 879 | + * insecure cache file extension. See bug 28235. Returns true if the |
| | 880 | + * request should be disallowed. |
| | 881 | + */ |
| | 882 | + public function isQueryStringBad() { |
| | 883 | + if ( !isset( $_SERVER['QUERY_STRING'] ) ) { |
| | 884 | + return false; |
| | 885 | + } |
| | 886 | + |
| | 887 | + $extension = self::findIE6Extension( $_SERVER['QUERY_STRING'] ); |
| | 888 | + if ( $extension === '' ) { |
| | 889 | + return false; |
| | 890 | + } |
| | 891 | + |
| | 892 | + return (bool)preg_match( '/^[a-zA-Z0-9_-]+$/', $extension ); |
| | 893 | + } |
| | 894 | + |
| | 895 | + /** |
| 880 | 896 | * Parse the Accept-Language header sent by the client into an array |
| 881 | 897 | * @return array( languageCode => q-value ) sorted by q-value in descending order |
| 882 | 898 | * May contain the "language" '*', which applies to languages other than those explicitly listed. |
| Index: trunk/phase3/img_auth.php |
| — | — | @@ -43,8 +43,7 @@ |
| 44 | 44 | } |
| 45 | 45 | |
| 46 | 46 | // Check for bug 28235: QUERY_STRING overriding the correct extension |
| 47 | | -if ( isset( $_SERVER['QUERY_STRING'] ) |
| 48 | | - && preg_match( '/\.[^\\/:*?"<>|%]+(#|\?|$)/i', $_SERVER['QUERY_STRING'] ) ) |
| | 47 | +if ( $wgRequest->isQueryStringBad() ) |
| 49 | 48 | { |
| 50 | 49 | wfForbidden( 'img-auth-accessdenied', 'img-auth-bad-query-string' ); |
| 51 | 50 | } |