From d72c79792dac7cec4a0e427081924b35b459ef33 Mon Sep 17 00:00:00 2001 From: csteipp Date: Mon, 10 Aug 2015 10:30:50 -0700 Subject: [PATCH] thumb.php: Escape $rel404 in error message Bug: T97391 Change-Id: I363686732fe9e5636c85c267c0728fc872c3e39d --- thumb.php | 24 ++++++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-) diff --git a/thumb.php b/thumb.php index abace64..b88da74 100644 --- a/thumb.php +++ b/thumb.php @@ -225,10 +225,10 @@ function wfStreamThumb( array $params ) { } // If its not a redirect that has a target as a local file, give 404. - wfThumbError( 404, "The source file '$fileName' does not exist." ); + wfThumbErrorText( 404, "The source file '$fileName' does not exist." ); return; } elseif ( $img->getPath() === false ) { - wfThumbError( 500, "The source file '$fileName' is not locally accessible." ); + wfThumbErrorText( 500, "The source file '$fileName' is not locally accessible." ); return; } @@ -286,7 +286,7 @@ function wfStreamThumb( array $params ) { } return; } else { - wfThumbError( 404, "The given path of the specified thumbnail is incorrect; + wfThumbErrorText( 404, "The given path of the specified thumbnail is incorrect; expected '" . $img->getThumbRel( $thumbName ) . "' but got '" . rawurldecode( $params['rel404'] ) . "'." ); return; @@ -496,14 +496,26 @@ function wfExtractThumbParams( $file, $params ) { return null; } + +/** + * Output a thumbnail generation error message + * + * @param int $status + * @param string $msg Plain text (will be html escaped) + * @return void + */ +function wfThumbErrorText( $status, $msgText ) { + return wfThumbError( $status, htmlspecialchars( $msgText ) ); +} + /** * Output a thumbnail generation error message * * @param $status integer - * @param string $msg HTML + * @param string $msgHtml HTML * @return void */ -function wfThumbError( $status, $msg ) { +function wfThumbError( $status, $msgHtml ) { global $wgShowHostnames; header( 'Cache-Control: no-cache' ); @@ -529,7 +541,7 @@ function wfThumbError( $status, $msg ) {

Error generating thumbnail

-$msg +$msgHtml

$debug -- 1.8.4.5