From 9c398168f95fe2a2c846b5bce72d5433009489d9 Mon Sep 17 00:00:00 2001 From: Brian Wolff Date: Mon, 13 Mar 2017 21:20:02 +0000 Subject: [PATCH] SECURITY: Escape wikitext content model/format in message Escape wikitext in model= and format= url parameter to edit page. This goes along with 1c788944 to help prevent XSS for wikis with $wgRawHtml = true; set. Bug: T156184 Change-Id: Ifcaa2ccf05a2a691d0b150e2f7e0e765db25fc7f --- RELEASE-NOTES-1.28 | 1 + includes/EditPage.php | 7 +++++-- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/RELEASE-NOTES-1.28 b/RELEASE-NOTES-1.28 index 327a624..4c69940 100644 --- a/RELEASE-NOTES-1.28 +++ b/RELEASE-NOTES-1.28 @@ -14,6 +14,7 @@ This is not a release yet! * (T158766) Avoid SQL error on MSSQL when using selectRowCount() * (T145635) Fix too long index error when installing with MSSQL * (T156184) $wgRawHtml will no longer apply to internationalization messages. +* (T156184) Escape content model/format url parameter in message. == MediaWiki 1.28 == diff --git a/includes/EditPage.php b/includes/EditPage.php index a9d1c48..a563b27 100644 --- a/includes/EditPage.php +++ b/includes/EditPage.php @@ -1015,7 +1015,7 @@ class EditPage { throw new ErrorPageError( 'editpage-invalidcontentmodel-title', 'editpage-invalidcontentmodel-text', - [ $this->contentModel ] + [ wfEscapeWikiText( $this->contentModel ) ] ); } @@ -1023,7 +1023,10 @@ class EditPage { throw new ErrorPageError( 'editpage-notsupportedcontentformat-title', 'editpage-notsupportedcontentformat-text', - [ $this->contentFormat, ContentHandler::getLocalizedName( $this->contentModel ) ] + [ + wfEscapeWikiText( $this->contentFormat ), + wfEscapeWikiText( ContentHandler::getLocalizedName( $this->contentModel ) ) + ] ); } -- 1.9.5 (Apple Git-50.3)