| Index: branches/REL1_3/phase3/includes/DefaultSettings.php |
| — | — | @@ -9,7 +9,7 @@ |
| 10 | 10 | # like $wgScriptPath, you must also localize everything that |
| 11 | 11 | # depends on it. |
| 12 | 12 | |
| 13 | | -$wgVersion = '1.3.12'; |
| | 13 | +$wgVersion = '1.3.13'; |
| 14 | 14 | |
| 15 | 15 | $wgSitename = 'MediaWiki'; # Please customize! |
| 16 | 16 | $wgMetaNamespace = FALSE; # will be same as you set $wgSitename |
| Index: branches/REL1_3/phase3/includes/Parser.php |
| — | — | @@ -43,6 +43,8 @@ |
| 44 | 44 | # may want to use in wikisyntax |
| 45 | 45 | define( "STRIP_COMMENTS", "HTMLCommentStrip" ); |
| 46 | 46 | |
| | 47 | +define( 'URL_PROTOCOLS', 'http|https|ftp|irc|gopher|news|mailto' ); |
| | 48 | + |
| 47 | 49 | # prefix for escaping, used in two functions at least |
| 48 | 50 | define( "UNIQ_PREFIX", "NaodW29"); |
| 49 | 51 | |
| — | — | @@ -627,6 +629,20 @@ |
| 628 | 630 | { |
| 629 | 631 | $t=''; |
| 630 | 632 | } |
| | 633 | + |
| | 634 | + # Templates and links may be expanded in later parsing, |
| | 635 | + # creating invalid or dangerous output. Suppress this. |
| | 636 | + $t = strtr( $t, array( |
| | 637 | + '{' => '{', |
| | 638 | + '[' => '[', |
| | 639 | + "''" => '''', |
| | 640 | + 'ISBN' => 'ISBN', |
| | 641 | + 'RFC' => 'RFC', |
| | 642 | + 'PMID' => 'PMID', |
| | 643 | + ) ); |
| | 644 | + $t = preg_replace( |
| | 645 | + '/(' . URL_PROTOCOLS . '):/', |
| | 646 | + '\\1:', $t ); |
| 631 | 647 | |
| 632 | 648 | return trim ( $t ) ; |
| 633 | 649 | } |
| Index: branches/REL1_3/phase3/RELEASE-NOTES |
| — | — | @@ -3,6 +3,27 @@ |
| 4 | 4 | Security reminder: MediaWiki does not require PHP's register_globals |
| 5 | 5 | setting since version 1.2.0. If you have it on, turn it *off* if you can. |
| 6 | 6 | |
| | 7 | +== Version 1.3.13, 2005-06-03 == |
| | 8 | + |
| | 9 | +MediaWiki 1.3.13 is a security maintenance release. |
| | 10 | + |
| | 11 | +Incorrect handling of page template inclusions made it possible to |
| | 12 | +inject JavaScript code into HTML attributes, which could lead to |
| | 13 | +cross-site scripting attacks on a publicly editable wiki. |
| | 14 | + |
| | 15 | +Vulnerable releases and fix: |
| | 16 | +* 1.5 prerelease: fixed in 1.5alpha2 |
| | 17 | +* 1.4 stable series: fixed in 1.4.5 |
| | 18 | +* 1.3 legacy series: fixed in 1.3.13 |
| | 19 | +* 1.2 series no longer supported; upgrade to 1.4.5 strongly recommended |
| | 20 | + |
| | 21 | +The 1.3.x series is no longer maintained except for security fixes; |
| | 22 | +new users and those seeking general bug fixes should install 1.4.5. |
| | 23 | +Existing 1.3.x installations not willing or able to upgrade to the |
| | 24 | +current stable relase should update the installation to 1.3.13; only |
| | 25 | +includes/Parser.php has changed from 1.3.12. |
| | 26 | + |
| | 27 | + |
| 7 | 28 | == Version 1.3.12, 2005-02-20 == |
| 8 | 29 | |
| 9 | 30 | MediaWiki 1.3.12 is a security maintenance release. |