r99067 MediaWiki - Code Review archive

Repository:MediaWiki
Revision:< r99066‎ | r99067 | r99068 >
Date:01:10, 6 October 2011
Author:brion
Status:ok (Comments)
Tags:
Comment:
* (bug 31374) Pass relevant additional parameters for action=raw on Special:Mypage redirects

Found that Special:MyPage was sometimes being used in importScript() calls to make references to the owner's other user subpages, such as loading a User:Blah/monobook.js from User:Blah/vector.js.
The importScript() correctly included action=raw and ctype=text/javascript parameters, but Special:MyPage was redirecting to the actual URL and dropped the ctype parameter.

IE 9 actually now validates content-type for scripts loaded into <script> -- if and only if you send X-Content-Type-Options: nosniff. Since we now do that (since bug 15461 / r87997) this created a break for IE9 users when upgrading from MW 1.17 (without the nosniff) to MW 1.18 (with it).

Can also work around by replacing the Special:MyPage reference with a direct one.

No other browsers I tested (Firefox 8, Chrome 14, Opera 11.5) rejected a <script> load for text/x-wiki but it's a legit thing to do (Firefox does check for CSS)
Modified paths:
  • /trunk/phase3/includes/SpecialPage.php (modified) (history)

Diff [purge]

Index: trunk/phase3/includes/SpecialPage.php
——@@ -1005,7 +1005,9 @@
10061006 function __construct() {
10071007 parent::__construct( 'Mypage' );
10081008 $this->mAllowedRedirectParams = array( 'action' , 'preload' , 'editintro',
1009 - 'section', 'oldid', 'diff', 'dir' );
 1009+ 'section', 'oldid', 'diff', 'dir',
 1010+ // Options for action=raw; missing ctype can break JS or CSS in some browsers
 1011+ 'ctype', 'maxage', 'smaxage' );
10101012 }
10111013
10121014 function getRedirect( $subpage ) {

Follow-up revisions

RevisionCommit summaryAuthorDate
r99068MFT r99067: fix bug 31400, followup to r87997....brion01:13, 6 October 2011
r99069MFT r99067aaron01:18, 6 October 2011
r106012Bug 31374: regression test made by Brion...hashar11:16, 13 December 2011

Past revisions this follows-up on

RevisionCommit summaryAuthorDate
r87997* (bug 15461) Make IE8 turn off content sniffing. Everbody else should ignore...brion15:52, 13 May 2011
r99062Fix for bug 31374: reintroduce recursive unstrip as in r27667, somehow omitte...tstarling00:07, 6 October 2011

Comments

#Comment by Brion VIBBER (talk | contribs)   01:15, 6 October 2011

Needs merge to 1.18wmf1 & deployment to fix [1].

#Comment by Tim Starling (talk | contribs)   01:21, 6 October 2011

Bug 31374 does not look related.

#Comment by Catrope (talk | contribs)   11:54, 6 October 2011

It's bug 31401

#Comment by Catrope (talk | contribs)   11:55, 6 October 2011

Ahm, I meant bug 31400 of course.

#Comment by G.Hagedorn (talk | contribs)   10:41, 6 October 2011

delete tag 1.18wmf1, is already applied

Status & tagging log