Index: includes/SpecialUndelete.php
===================================================================
--- includes/SpecialUndelete.php	(revision 16758)
+++ includes/SpecialUndelete.php	(working copy)
@@ -403,7 +403,7 @@
 		global $wgUser;
 		$this->mAction = $request->getText( 'action' );
 		$this->mTarget = $request->getText( 'target' );
-		$this->mTimestamp = $request->getText( 'timestamp' );
+		$this->mTimestamp = $request->getTimestamp( 'timestamp' );
 		$this->mFile = $request->getVal( 'file' );
 		
 		$posted = $request->wasPosted() &&
Index: includes/WebRequest.php
===================================================================
--- includes/WebRequest.php	(revision 16758)
+++ includes/WebRequest.php	(working copy)
@@ -273,6 +273,28 @@
 		return $retVal;
 	}
 
+        /**
+         * Fetch a timestamp string (e.g. "20060929233456").
+         * Returns an empty string if none is set, or is invalid.
+         *
+         * @param string $name
+         * @return string
+         */
+        public function getTimestamp( $name ) {
+                $val = $this->getVal( $name );
+                // Length has to make sense.
+                // (Note: will have Y10K problem long after we're all dead).
+                if (strlen($val) != strlen("20060929233456")) return "";
+                // Has to be a numeric string.
+                // (Note: Input can still contain "-" / "+", a decimal point, "e12")
+                if (!is_numeric($val)) return "";
+                // Has to be a valid date (e.g. no February the 31st, no 28 PM, no 93rd minute, etc).
+                // Note: PHP currently has Y2038 problem (e.g. dates in 2039 will return as invalid).
+                if ($val !== date("YmdHis", strtotime($val))) return "";
+                // Looks valid.
+                return $val;
+        }
+
 	/**
 	 * Returns true if the present request was reached by a POST operation,
 	 * false otherwise (GET, HEAD, or command-line).
Index: includes/Revision.php
===================================================================
--- includes/Revision.php	(revision 16758)
+++ includes/Revision.php	(working copy)
@@ -701,7 +701,7 @@
 		}
 		
 		// If we kept data for lazy extraction, use it now...
-		$row = $this->mTextRow;
+		$row = isset($this->mTextRow) ? $this->mTextRow : null;
 		$this->mTextRow = null;
 		
 		if( !$row ) {