When the local wiki is accessed in HTTP, clicking an external link starting with // will (if this is the first visit) do an unencrypted HTTP call to the target server before being redirected to the HTTPS version, potentially allowing a man in the middle attack. This commit changes the URI scheme to https: for every link with HSTS enabled in the codebase, namely www.mediawiki.org, *.wikimedia.org, *.wikipedia.org, translatewiki.net and bugs.php.net. Change-Id: I002b502952f32fb49823e18b281252977ecca8cf |
||
|---|---|---|
| .. | ||
| classes | ||
| data | ||
| i18n | ||
| messages | ||
| .htaccess | ||
| ConverterRule.php | ||
| FakeConverter.php | ||
| Language.php | ||
| LanguageConverter.php | ||