Thijs/wiki.techinc.nl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
wiki.techinc.nl/includes
History
Máté Szabó 145d205b4c specials: Fix PHP Warning on Special:PasswordReset for crafted input 
Why:

- Special:PasswordReset uses raw POST values to add username and email
  info to success messages post-submit.
- These values may be parsed by PHP as arrays if a client supplied
  crafted input with multi-value fields.
- Instead of doing our own param validation in onSuccess(), we can reuse
  parsed values in onSubmit() and do the rendering there.

What:

- Move success message processing to onSubmit().

Bug: T392086
Change-Id: I9b0e115c417d0f3080e711441c79608d782932ce
(cherry picked from commit 37d63156c841f9a19080c9438cdf66cf58a7da7a)
2025-04-16 21:01:12 +00:00
..
actions Apply proper restrictions on file revert action 2025-03-24 12:55:44 +00:00
api Localisation updates from https://translatewiki.net. 2025-04-15 07:32:55 +02:00
auth ButtonAuthenticationRequest: Add AllowDynamicProperties directive 2024-12-12 21:45:31 +00:00
block block: Fix DBS::acquireTarget() race using GET_LOCK() 2025-04-07 11:43:34 +00:00
cache
Category
changetags ChangeTags: Optimize label and description parsing 2025-04-03 18:24:46 +01:00
collation Use namespaced classes 2024-10-21 20:41:20 +02:00
CommentFormatter
CommentStore
composer In .htaccess deny files, use "Satisfy All" 2025-04-04 13:17:15 +00:00
config
content
context
dao
db
debug
deferred Fix GREATEST usage in site_stats 2025-03-20 15:48:17 +00:00
diff Diffs: avoid getContentHandler on null error 2025-04-10 21:37:29 +00:00
edit parser: Gracefully handle invalid ParsoidRenderID keys 2025-02-04 14:54:31 +00:00
editpage PermissionManager: Differentiate between cascading protection of file content and file pages 2025-03-24 13:31:34 +00:00
exception HttpError: Cast Message to string 2025-03-11 21:58:06 +00:00
export Use namespaced classes 2024-10-21 20:41:20 +02:00
ExternalLinks ExternalLinks: fix mailto: links reversal 2025-02-28 16:33:54 +00:00
externalstore Use namespaced classes 2024-10-21 20:41:20 +02:00
Feed FeedItem: Update @since on xmlEncodeNullable for backports 2025-02-21 03:53:56 +00:00
filebackend filebackend: Check for old alias in FileBackendMultiWrite 2024-10-22 01:32:54 +02:00
filerepo Fix img_auth message logic 2024-11-14 01:05:30 +00:00
gallery Use namespaced classes 2024-10-21 20:41:20 +02:00
historyblob
Hook
HookContainer WhatLinksHere: Allow extensible filters 2024-10-21 14:27:53 +05:30
Html SECURITY: Ensure emitted HTML is safe against Unicode NFC normalization 2025-04-10 15:56:06 +01:00
htmlform SECURITY: escape section labels in HTMLMultiSelectField 2025-04-10 15:56:06 +01:00
http
import Use namespaced classes 2024-10-21 20:41:20 +02:00
installer Localisation updates from https://translatewiki.net. 2025-04-15 07:32:55 +02:00
interwiki
jobqueue RefreshLinksJob: Don't retry job if "Revision x is not current" is returned 2024-11-19 16:08:11 +00:00
json
language LanguageConverter: Only set mTablesLoaded once they're really loaded 2025-04-08 08:34:42 +00:00
languages Add Central Kanuri (knc), deprecate Kanuri (kr) 2024-10-20 19:18:46 +00:00
libs filebackend: Avoid passing null to FileBackend::normalizeContainerPath 2025-04-10 21:54:42 +00:00
linkeddata
linker
logging SECURITY: Fix log entry search revealing suppressed data to users with 'deletedhistory' rights 2025-04-10 15:56:06 +01:00
mail
media FormatMetadata: Prevent running preg_match() on null 2025-01-28 12:05:59 +00:00
Message SECURITY: Ensure emitted HTML is safe against Unicode NFC normalization 2025-04-10 15:56:06 +01:00
Navigation
objectcache
Output Skin: [BREAKING CHANGE] Remove support for rendering outside body element 2024-10-30 15:18:51 +00:00
OutputTransform SECURITY: Ensure emitted HTML is safe against Unicode NFC normalization 2025-04-10 15:56:06 +01:00
page Use namespaced classes 2024-10-21 20:41:20 +02:00
pager ContributionsPager: Fix getTemplateParams() parameter 2024-10-25 13:52:47 +00:00
ParamValidator/TypeDef
parser SECURITY: Ensure emitted HTML is safe against Unicode NFC normalization 2025-04-10 15:56:06 +01:00
password
Permissions RestrictionStore: Remove short-circuit mode when fetching cascading sources 2025-04-09 13:25:44 +00:00
poolcounter objectcache: Move RedisConnRef.php to /libs/objectcache/ 2024-11-07 08:40:54 +00:00
preferences Add explanation text for "Allow emails from brand-new users" 2025-02-21 22:34:44 +00:00
profiler
recentchanges objectcache: Move RedisConnRef.php to /libs/objectcache/ 2024-11-07 08:40:54 +00:00
registration
RenameUser
Request Request: Improve log message when headers already sent 2025-03-10 15:12:31 +00:00
ResourceLoader resourceloader: Fix hash computation for virtual files with versionFilePath 2025-01-29 21:26:20 +00:00
Rest Localisation updates from https://translatewiki.net. 2025-04-15 07:32:55 +02:00
Revision
revisiondelete RevDelList: Ensure setVisibility always includes itemStatuses in value if applicable 2025-03-08 01:53:49 +00:00
revisionlist
search Use namespaced classes 2024-10-21 20:41:20 +02:00
session session: Do not set session.use_trans_sid 2025-01-06 22:12:05 +00:00
Settings
shell FileRepo: Add support for the new Shellbox large file feature 2024-10-29 02:50:07 +00:00
site
SiteStats
skins Merge "Hard deprecate soft deprecated skin methods" into REL1_43 2024-11-13 00:27:38 +00:00
sparql
specialpage specialpage: Improve handling of invalid lang codes on login/signup 2025-01-29 16:04:57 +00:00
specials specials: Fix PHP Warning on Special:PasswordReset for crafted input 2025-04-16 21:01:12 +00:00
Status Make Message and MessageValue compatible 2024-10-19 15:00:07 +02:00
Storage
StubObject
templates img_auth: Output lang and dir in HTTP and HTML on error message 2024-10-29 15:18:52 +00:00
tidy SECURITY: Ensure emitted HTML is safe against Unicode NFC normalization 2025-04-10 15:56:06 +01:00
title
upload UploadBase: makeWarningsSerializable() should accept MessageParam objects 2025-04-12 22:40:51 +00:00
user Avoid trying to load the session user in MW_NO_SESSION endpoints 2025-03-11 00:28:38 +00:00
utils Remove CryptHKDF and MWCryptHKDF 2024-11-10 22:49:37 -05:00
watchlist
widget
WikiMap
xml
.htaccess In .htaccess deny files, use "Satisfy All" 2025-04-04 13:17:15 +00:00
AutoLoader.php AutoLoader: Use require_once rather than require 2024-10-24 01:36:18 +00:00
BootstrapHelperFunctions.php
config-schema.php DnsBlacklistUrls: Remove sorbs.net 2025-01-06 22:57:01 +00:00
DefaultSettings.php
Defines.php Prep 1.43.1 2025-04-10 17:18:51 +00:00
DevelopmentSettings.php
EntryPointEnvironment.php
GlobalFunctions.php Deprecate wfArrayDiff2() 2024-11-04 19:34:41 +00:00
MainConfigNames.php Remove CryptHKDF and MWCryptHKDF 2024-11-10 22:49:37 -05:00
MainConfigSchema.php DnsBlacklistUrls: Remove sorbs.net 2025-01-06 22:57:01 +00:00
MediaWiki.php
MediaWikiEntryPoint.php
MediaWikiServices.php Remove CryptHKDF and MWCryptHKDF 2024-11-10 22:49:37 -05:00
PHPVersionCheck.php Bump PHPVersionCheck & composer expected PHP versions to 8.1.0 2024-10-25 19:56:22 -04:00
ServiceWiring.php Remove CryptHKDF and MWCryptHKDF 2024-11-10 22:49:37 -05:00
Setup.php Use namespaced classes 2024-10-21 20:41:20 +02:00
SetupDynamicConfig.php
WebStart.php