From 3faf4e117bd05c56eb9959ae943245dba7e48412 Mon Sep 17 00:00:00 2001 From: Brian Wolff Date: Mon, 13 Mar 2017 21:20:02 +0000 Subject: [PATCH 4/8] SECURITY: Escape wikitext content model/format in message Escape wikitext in model= and format= url parameter to edit page. This goes along with 1c788944 to help prevent XSS for wikis with $wgRawHtml = true; set. Bug: T156184 Change-Id: Ifcaa2ccf05a2a691d0b150e2f7e0e765db25fc7f --- RELEASE-NOTES-1.23 | 1 + includes/EditPage.php | 5 ++++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/RELEASE-NOTES-1.23 b/RELEASE-NOTES-1.23 index a5afc7b..65435fb 100644 --- a/RELEASE-NOTES-1.23 +++ b/RELEASE-NOTES-1.23 @@ -14,6 +14,7 @@ This is not a release yet! $wgAdvancedSearchHighlighting is true. * (T150044) SECURITY: "Mark all pages visited" on the watchlist now requires a CSRF token. +* (T156184) SECURITY: Escape content model/format url parameter in message. == MediaWiki 1.23.15 == diff --git a/includes/EditPage.php b/includes/EditPage.php index 1fd23e2..ee19afa 100644 --- a/includes/EditPage.php +++ b/includes/EditPage.php @@ -801,7 +801,10 @@ class EditPage { throw new ErrorPageError( 'editpage-notsupportedcontentformat-title', 'editpage-notsupportedcontentformat-text', - array( $this->contentFormat, ContentHandler::getLocalizedName( $this->contentModel ) ) + array( + wfEscapeWikiText( $this->contentFormat ), + wfEscapeWikiText( ContentHandler::getLocalizedName( $this->contentModel ) ) + ) ); } #TODO: check if the desired model is allowed in this namespace, and if a transition from the page's current model to the new model is allowed -- 2.9.3