diff --git a/RELEASE-NOTES b/RELEASE-NOTES index 119c6d7ce4b..92b9e4228ca 100644 --- a/RELEASE-NOTES +++ b/RELEASE-NOTES @@ -31,6 +31,7 @@ it from source control: http://www.mediawiki.org/wiki/Download_from_SVN * (bug 7139) Increasing the visual width of the edit summary field on larger screen sizes, for the default monobook skin. * Fix PHP notice and estimates for dumpBackup.php and friends +* Improved register_globals paranoia checks == Languages updated == diff --git a/includes/WebStart.php b/includes/WebStart.php index 9e45714a198..0c71ce53da8 100644 --- a/includes/WebStart.php +++ b/includes/WebStart.php @@ -10,7 +10,30 @@ if ( ini_get( 'register_globals' ) ) { if ( isset( $_REQUEST['GLOBALS'] ) ) { die( '$GLOBALS overwrite vulnerability'); } + $verboten = array( + 'GLOBALS', + '_SERVER', + 'HTTP_SERVER_VARS', + '_GET', + 'HTTP_GET_VARS', + '_POST', + 'HTTP_POST_VARS', + '_COOKIE', + 'HTTP_COOKIE_VARS', + '_FILES', + 'HTTP_POST_FILES', + '_ENV', + 'HTTP_ENV_VARS', + '_REQUEST', + '_SESSION', + 'HTTP_SESSION_VARS' + ); foreach ( $_REQUEST as $name => $value ) { + if( in_array( $name, $verboten ) ) { + header( "HTTP/1.x 500 Internal Server Error" ); + echo "register_globals security paranoia: trying to overwrite superglobals, aborting."; + die( -1 ); + } unset( $GLOBALS[$name] ); } }