From 2e7985841b51936f313b8befe458567b3a3296a6 Mon Sep 17 00:00:00 2001 From: Brian Wolff Date: Mon, 13 Mar 2017 21:20:02 +0000 Subject: [PATCH] SECURITY: Escape wikitext content model/format in message Escape wikitext in model= and format= url parameter to edit page. This goes along with 1c788944 to help prevent XSS for wikis with $wgRawHtml = true; set. Bug: T156184 Change-Id: Ifcaa2ccf05a2a691d0b150e2f7e0e765db25fc7f --- RELEASE-NOTES-1.27 | 1 + includes/EditPage.php | 5 ++++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/RELEASE-NOTES-1.27 b/RELEASE-NOTES-1.27 index 34d3d77..d7ed114 100644 --- a/RELEASE-NOTES-1.27 +++ b/RELEASE-NOTES-1.27 @@ -22,6 +22,7 @@ was released. * (T158766) Avoid SQL error on MSSQL when using selectRowCount() * (T145635) Fix too long index error when installing with MSSQL. * (T156184) $wgRawHtml will no longer apply to internationalization messages. +* (T156184) Escape content model/format url parameter in message. == MediaWiki 1.27.1 == diff --git a/includes/EditPage.php b/includes/EditPage.php index ca2d6d1..8f6cd7e 100644 --- a/includes/EditPage.php +++ b/includes/EditPage.php @@ -980,7 +980,10 @@ class EditPage { throw new ErrorPageError( 'editpage-notsupportedcontentformat-title', 'editpage-notsupportedcontentformat-text', - [ $this->contentFormat, ContentHandler::getLocalizedName( $this->contentModel ) ] + [ + wfEscapeWikiText( $this->contentFormat ), + wfEscapeWikiText( ContentHandler::getLocalizedName( $this->contentModel ) ) + ] ); } -- 1.9.5 (Apple Git-50.3)