r95387 MediaWiki - Code Review archive

Repository:MediaWiki
Revision:< r95386‎ | r95387 | r95388 >
Date:09:38, 24 August 2011
Author:catrope
Status:ok
Tags:
Comment:
Followup r95316, r95317 per CR: escape the URL before using it in HTML. It doesn't look like this was a viable XSS vector because FullRequestURL comes with strange characters urlencoded (at least on Apache) but it sure looked scary
Modified paths:
  • /trunk/extensions/MobileFrontend/MobileFrontend.php (modified) (history)

Diff [purge]

Index: trunk/extensions/MobileFrontend/MobileFrontend.php
——@@ -156,7 +156,7 @@
157157 self::$enableImagesURL = $wgRequest->escapeAppendQuery( 'enableImages=1' );
158158 self::$disableMobileSiteURL = $wgRequest->escapeAppendQuery( 'mobileaction=disable_mobile_site' );
159159 self::$viewNormalSiteURL = $wgRequest->escapeAppendQuery( 'mobileaction=view_normal_site' );
160 - self::$currentURL = $wgRequest->getFullRequestURL();
 160+ self::$currentURL = htmlspecialchars( $wgRequest->getFullRequestURL() );
161161
162162 $skin = $wgUser->getSkin();
163163 $copyright = $skin->getCopyright();

Follow-up revisions

RevisionCommit summaryAuthorDate
r953881.17wmf1: MFT r95387catrope09:39, 24 August 2011

Past revisions this follows-up on

RevisionCommit summaryAuthorDate
r95316fix for bug 29016 - disabling mobile view throws us to start pagepreilly18:07, 23 August 2011
r95317mft r95316preilly18:08, 23 August 2011

Status & tagging log