Thijs/wiki.techinc.nl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Some cleanup for r36609:

Browse source 
$url and $alt parameters in makeExternalImage() are now normalized to be escaped on output instead of before they reach the function. This ensures that any hooks processing them won't accidentally send plaintext which might become an injection vector, or just get confused on pre-escaped input they didn't expect.
This commit is contained in:
Brion Vibber 2008-07-02 01:19:00 +00:00
parent da83631150
commit f54ec4339e
3 changed files with 7 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
includes/Linker.php
View file

@ -478,7 +478,7 @@ class Linker {
} else {
$basename = substr( $basename, 1 );
}
return htmlspecialchars( $basename );
return $basename;
}
/** Obsolete alias */
@ -497,8 +497,10 @@ class Linker {
wfDebug("Hook LinkerMakeExternalImage changed the output of external image with url {$url} and alt text {$alt} to {$img}", true);
return $img;
}
$s = '<img src="'.$url.'" alt="'.$alt.'" />';
return $s;
return Xml::element( 'img',
array(
'src' => $url,
'alt' => $alt ) );
}
/**

2
includes/parser/Parser.php
View file

@ -1468,7 +1468,7 @@ class Parser
|| ( $imagesexception && strpos( $url, $imagesfrom ) === 0 ) ) {
if ( preg_match( self::EXT_IMAGE_REGEX, $url ) ) {
# Image found
$text = $sk->makeExternalImage( htmlspecialchars( $url ) );
$text = $sk->makeExternalImage( $url );
}
}
return $text;

2
includes/parser/Parser_OldPP.php
View file

@ -1495,7 +1495,7 @@ class Parser_OldPP
|| ( $imagesexception && strpos( $url, $imagesfrom ) === 0 ) ) {
if ( preg_match( self::EXT_IMAGE_REGEX, $url ) ) {
# Image found
$text = $sk->makeExternalImage( htmlspecialchars( $url ) );
$text = $sk->makeExternalImage( $url );
}
}
return $text;