Changeset 1915


Ignore:
Timestamp:
04/16/2011 11:58:59 AM (13 months ago)
Author:
Xiping.Wang
Message:

[trunk]Upgrade to mediawiki 1.16.4

Location:
trunk
Files:
9 edited

Legend:

Unmodified
Added
Removed

  • trunk

    • Property svn:externals

      •  

        old new  
        1 w/bin http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_16_2/phase3/bin 
        2 w/cache http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_16_2/phase3/cache 
        3 w/config http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_16_2/phase3/config 
        4 w/docs http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_16_2/phase3/docs 
        5 w/languages http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_16_2/phase3/languages 
        6 w/maintenance http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_16_2/phase3/maintenance 
        7 w/math http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_16_2/phase3/math 
        8 w/serialized http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_16_2/phase3/serialized 
        9 w/extensions/Interwiki http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_16_2/extensions/Interwiki 
         1w/bin http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_16_4/phase3/bin 
         2w/cache http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_16_4/phase3/cache 
         3w/config http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_16_4/phase3/config 
         4w/docs http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_16_4/phase3/docs 
         5w/languages http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_16_4/phase3/languages 
         6w/maintenance http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_16_4/phase3/maintenance 
         7w/math http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_16_4/phase3/math 
         8w/serialized http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_16_4/phase3/serialized 
         9w/extensions/Interwiki http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_16_4/extensions/Interwiki 

  • trunk/w/RELEASE-NOTES

    r1881 r1915  
    11= MediaWiki release notes = 
    22 
    3 == MediaWiki 1.16.2 == 
    4  
    5 2011-02-01 
     3== MediaWiki 1.16.4 == 
     4 
     52011-04-14 
    66 
    77This is a security and maintenance release of the MediaWiki 1.16 branch. 
    … …  
    4444you have the DBA extension for PHP installed, this will improve performance  
    4545further. 
     46 
     47== Changes since 1.16.3 == 
     48 
     49* (bug 28507) The change we made in 1.16.3 to fix bug 28235 (XSS for IE 6  
     50  clients) was not actually sufficient to fix that bug. This release contains  
     51  a second attempt, hopefully we have fixed it this time. 
     52 
     53== Changes since 1.16.2 == 
     54 
     55* (bug 28449) Fixed permissions checks in Special:Import which allowed users  
     56  without the 'import' permission to import pages from the configured import  
     57  sources. 
     58* (bug 28235) Fixed XSS affecting IE 6 and earlier clients only, due to those  
     59  browsers looking for a file extension in the query string of the URL, and  
     60  ignoring the Content-Type header if one is found. 
     61* (bug 28450) Fixed a CSS validation issue involving escaped comments, which 
     62  led to XSS for Internet Explorer clients and privacy loss for other clients. 
    4663 
    4764== Changes since 1.16.1 == 

  • trunk/w/api.php

    r1484 r1915  
    5353if ( $wgRequest->isPathInfoBad() ) { 
    5454        wfHttpError( 403, 'Forbidden', 
    55                 'Invalid file extension found in PATH_INFO. ' . 
    56                 'The API must be accessed through the primary script entry point.' ); 
     55                'Invalid file extension found in PATH_INFO or QUERY_STRING.' ); 
    5756        return; 
    5857} 

  • trunk/w/img_auth.php

    r1484 r1915  
    3636{ 
    3737        wfForbidden('img-auth-accessdenied','img-auth-public'); 
     38} 
     39 
     40// Check for bug 28235: QUERY_STRING overriding the correct extension 
     41if ( isset( $_SERVER['QUERY_STRING'] ) 
     42        && preg_match( '/\.[a-z0-9]{1,4}(#|\?|$)/i', $_SERVER['QUERY_STRING'] ) ) 
     43{ 
     44        wfForbidden( 'img-auth-accessdenied', 'img-auth-bad-query-string' ); 
    3845} 
    3946 

  • trunk/w/includes/DefaultSettings.php

    r1881 r1915  
    3434 
    3535/** MediaWiki version number */ 
    36 $wgVersion = '1.16.2'; 
     36$wgVersion = '1.16.4'; 
    3737 
    3838/** Name of the site. It must be changed in LocalSettings.php */ 

  • trunk/w/includes/RawPage.php

    r1484 r1915  
    126126                        # Just return a 403 Forbidden and get it over with. 
    127127                        wfHttpError( 403, 'Forbidden', 
    128                                 'Invalid file extension found in PATH_INFO. ' .  
     128                                'Invalid file extension found in PATH_INFO or QUERY_STRING. ' .  
    129129                                'Raw pages must be accessed through the primary script entry point.' ); 
    130130                        return; 

  • trunk/w/includes/Sanitizer.php

    r1881 r1915  
    728728        /** 
    729729         * Pick apart some CSS and check it for forbidden or unsafe structures. 
    730          * Returns a sanitized string, or false if it was just too evil. 
     730         * Returns a sanitized string. This sanitized string will have 
     731         * character references and escape sequences decoded, and comments 
     732         * stripped. If the input is just too evil, only a comment complaining 
     733         * about evilness will be returned. 
    731734         * 
    732735         * Currently URL references, 'expression', 'tps' are forbidden. 
    733736         * 
     737         * NOTE: Despite the fact that character references are decoded, the 
     738         * returned string may contain character references given certain 
     739         * clever input strings. These character references must 
     740         * be escaped before the return value is embedded in HTML. 
     741         *  
    734742         * @param $value String 
    735          * @return Mixed 
     743         * @return String 
    736744         */ 
    737745        static function checkCss( $value ) { 
     746                // Decode character references like { 
    738747                $value = Sanitizer::decodeCharReferences( $value ); 
    739  
    740                 // Remove any comments; IE gets token splitting wrong 
    741                 $value = StringUtils::delimiterReplace( '/*', '*/', ' ', $value ); 
    742  
    743                 // Remove anything after a comment-start token, to guard against 
    744                 // incorrect client implementations. 
    745                 $commentPos = strpos( $value, '/*' ); 
    746                 if ( $commentPos !== false ) { 
    747                         $value = substr( $value, 0, $commentPos ); 
    748                 } 
    749748 
    750749                // Decode escape sequences and line continuation 
    751750                // See the grammar in the CSS 2 spec, appendix D. 
    752                 static $decodeRegex, $reencodeTable; 
     751                // This has to be done AFTER decoding character references. 
     752                // This means it isn't possible for this function to return 
     753                // unsanitized escape sequences. It is possible to manufacture 
     754                // input that contains character references that decode to 
     755                // escape sequences that decode to character references, but 
     756                // it's OK for the return value to contain character references 
     757                // because the caller is supposed to escape those anyway. 
     758                static $decodeRegex; 
    753759                if ( !$decodeRegex ) { 
    754760                        $space = '[\\x20\\t\\r\\n\\f]'; 
    … …  
    765771                $value = preg_replace_callback( $decodeRegex, 
    766772                        array( __CLASS__, 'cssDecodeCallback' ), $value ); 
     773                 
     774                // Remove any comments; IE gets token splitting wrong 
     775                // This must be done AFTER decoding character references and 
     776                // escape sequences, because those steps can introduce comments 
     777                // This step cannot introduce character references or escape 
     778                // sequences, because it replaces comments with spaces rather 
     779                // than removing them completely. 
     780                $value = StringUtils::delimiterReplace( '/*', '*/', ' ', $value ); 
     781 
     782                // Remove anything after a comment-start token, to guard against 
     783                // incorrect client implementations. 
     784                $commentPos = strpos( $value, '/*' ); 
     785                if ( $commentPos !== false ) { 
     786                        $value = substr( $value, 0, $commentPos ); 
     787                } 
    767788 
    768789                // Reject problematic keywords and control characters 

  • trunk/w/includes/WebRequest.php

    r1881 r1915  
    689689         * the extension is not mangled. So this should be a reasonably portable 
    690690         * way to perform this security check. 
     691         * 
     692         * Also checks for anything that looks like a file extension at the end of 
     693         * QUERY_STRING, since IE 6 and earlier will use this to get the file type 
     694         * if there was no dot before the question mark (bug 28235). 
    691695         */ 
    692696        public function isPathInfoBad() { 
    693697                global $wgScriptExtension; 
     698 
     699                if ( isset( $_SERVER['QUERY_STRING'] )  
     700                        && preg_match( '/\.[a-z0-9]{1,4}(#|\?|$)/i', $_SERVER['QUERY_STRING'] ) ) 
     701                { 
     702                        // Bug 28235 
     703                        // Block only Internet Explorer, and requests with missing UA  
     704                        // headers that could be IE users behind a privacy proxy. 
     705                        if ( !isset( $_SERVER['HTTP_USER_AGENT'] )  
     706                                || preg_match( '/; *MSIE/', $_SERVER['HTTP_USER_AGENT'] ) ) 
     707                        { 
     708                                return true; 
     709                        } 
     710                } 
    694711 
    695712                if ( !isset( $_SERVER['PATH_INFO'] ) ) { 

  • trunk/w/includes/specials/SpecialImport.php

    r1484 r1915  
    4646         */ 
    4747        function execute( $par ) { 
    48                 global $wgRequest; 
     48                global $wgRequest, $wgUser, $wgOut; 
    4949                 
    5050                $this->setHeaders(); 
    … …  
    5757                } 
    5858                 
     59                if( !$wgUser->isAllowed( 'import' ) && !$wgUser->isAllowed( 'importupload' ) ) 
     60                        return $wgOut->permissionRequired( 'import' ); 
     61 
     62                # TODO: allow Title::getUserPermissionsErrors() to take an array 
     63                # FIXME: Title::checkSpecialsAndNSPermissions() has a very wierd expectation of what 
     64                # getUserPermissionsErrors() might actually be used for, hence the 'ns-specialprotected' 
     65                $errors = wfMergeErrorArrays( 
     66                        $this->getTitle()->getUserPermissionsErrors( 
     67                                'import', $wgUser, true, 
     68                                array( 'ns-specialprotected', 'badaccess-group0', 'badaccess-groups' ) 
     69                        ), 
     70                        $this->getTitle()->getUserPermissionsErrors( 
     71                                'importupload', $wgUser, true, 
     72                                array( 'ns-specialprotected', 'badaccess-group0', 'badaccess-groups' ) 
     73                        ) 
     74                ); 
     75 
     76                if( $errors ){ 
     77                        $wgOut->showPermissionsErrorPage( $errors ); 
     78                        return; 
     79                } 
     80 
    5981                if ( $wgRequest->wasPosted() && $wgRequest->getVal( 'action' ) == 'submit' ) { 
    6082                        $this->doImport(); 
    … …  
    85107                        } 
    86108                } elseif ( $sourceName == "interwiki" ) { 
     109                        if( !$wgUser->isAllowed( 'import' ) ){ 
     110                                return $wgOut->permissionRequired( 'import' ); 
     111                        } 
    87112                        $this->interwiki = $wgRequest->getVal( 'interwiki' ); 
    88113                        if ( !in_array( $this->interwiki, $wgImportSources ) ) { 
    … …  
    134159        private function showForm() { 
    135160                global $wgUser, $wgOut, $wgRequest, $wgImportSources, $wgExportMaxLinkDepth; 
    136                 if( !$wgUser->isAllowed( 'import' ) && !$wgUser->isAllowed( 'importupload' ) ) 
    137                         return $wgOut->permissionRequired( 'import' ); 
    138161 
    139162                $action = $this->getTitle()->getLocalUrl( array( 'action' => 'submit' ) ); 
Note: See TracChangeset for help on using the changeset viewer.