[MediaWiki-commits] [Gerrit] mediawiki/core[REL1_27]: SECURITY: Escape wikitext content model/format in message

[jenkins-bot (Code Review)]

jenkins-bot has submitted this change and it was merged. ( 
https://gerrit.wikimedia.org/r/346852 )

Change subject: SECURITY: Escape wikitext content model/format in message
..


SECURITY: Escape wikitext content model/format in message

Escape wikitext in model= and format= url parameter to
edit page. This goes along with 1c788944 to help prevent
XSS for wikis with $wgRawHtml = true; set.

Bug: T156184
Change-Id: Ifcaa2ccf05a2a691d0b150e2f7e0e765db25fc7f
---
M RELEASE-NOTES-1.27
M includes/EditPage.php
2 files changed, 5 insertions(+), 1 deletion(-)

Approvals:
  Reedy: Looks good to me, approved
  jenkins-bot: Verified



diff --git a/RELEASE-NOTES-1.27 b/RELEASE-NOTES-1.27
index d6cfebf..6ca333a 100644
--- a/RELEASE-NOTES-1.27
+++ b/RELEASE-NOTES-1.27
@@ -31,6 +31,7 @@
   their values out of the logs.
 * (T150044) SECURITY: "Mark all pages visited" on the watchlist now requires a 
CSRF
   token.
+* (T156184) SECURITY: Escape content model/format url parameter in message.
 
 == MediaWiki 1.27.1 ==
 
diff --git a/includes/EditPage.php b/includes/EditPage.php
index ca2d6d1..8f6cd7e 100644
--- a/includes/EditPage.php
+++ b/includes/EditPage.php
@@ -980,7 +980,10 @@
throw new ErrorPageError(
'editpage-notsupportedcontentformat-title',
'editpage-notsupportedcontentformat-text',
-   [ $this->contentFormat, 
ContentHandler::getLocalizedName( $this->contentModel ) ]
+   [
+   wfEscapeWikiText( $this->contentFormat 
),
+   wfEscapeWikiText( 
ContentHandler::getLocalizedName( $this->contentModel ) )
+   ]
);
}
 

-- 
To view, visit https://gerrit.wikimedia.org/r/346852
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings

Gerrit-MessageType: merged
Gerrit-Change-Id: Ifcaa2ccf05a2a691d0b150e2f7e0e765db25fc7f
Gerrit-PatchSet: 2
Gerrit-Project: mediawiki/core
Gerrit-Branch: REL1_27
Gerrit-Owner: Chad 
Gerrit-Reviewer: Brian Wolff 
Gerrit-Reviewer: Chad 
Gerrit-Reviewer: Jackmcbarn 
Gerrit-Reviewer: Reedy 
Gerrit-Reviewer: Tpt 
Gerrit-Reviewer: jenkins-bot <>

___
MediaWiki-commits mailing list
MediaWiki-commits@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits

[MediaWiki-commits] [Gerrit] mediawiki/core[REL1_27]: SECURITY: Escape wikitext content model/format in message

[Chad (Code Review)]

Chad has uploaded a new change for review. ( 
https://gerrit.wikimedia.org/r/346852 )

Change subject: SECURITY: Escape wikitext content model/format in message
..

SECURITY: Escape wikitext content model/format in message

Escape wikitext in model= and format= url parameter to
edit page. This goes along with 1c788944 to help prevent
XSS for wikis with $wgRawHtml = true; set.

Bug: T156184
Change-Id: Ifcaa2ccf05a2a691d0b150e2f7e0e765db25fc7f
---
M RELEASE-NOTES-1.27
M includes/EditPage.php
2 files changed, 5 insertions(+), 1 deletion(-)


  git pull ssh://gerrit.wikimedia.org:29418/mediawiki/core 
refs/changes/52/346852/1

diff --git a/RELEASE-NOTES-1.27 b/RELEASE-NOTES-1.27
index d6cfebf..6ca333a 100644
--- a/RELEASE-NOTES-1.27
+++ b/RELEASE-NOTES-1.27
@@ -31,6 +31,7 @@
   their values out of the logs.
 * (T150044) SECURITY: "Mark all pages visited" on the watchlist now requires a 
CSRF
   token.
+* (T156184) SECURITY: Escape content model/format url parameter in message.
 
 == MediaWiki 1.27.1 ==
 
diff --git a/includes/EditPage.php b/includes/EditPage.php
index ca2d6d1..8f6cd7e 100644
--- a/includes/EditPage.php
+++ b/includes/EditPage.php
@@ -980,7 +980,10 @@
throw new ErrorPageError(
'editpage-notsupportedcontentformat-title',
'editpage-notsupportedcontentformat-text',
-   [ $this->contentFormat, 
ContentHandler::getLocalizedName( $this->contentModel ) ]
+   [
+   wfEscapeWikiText( $this->contentFormat 
),
+   wfEscapeWikiText( 
ContentHandler::getLocalizedName( $this->contentModel ) )
+   ]
);
}
 

-- 
To view, visit https://gerrit.wikimedia.org/r/346852
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings

Gerrit-MessageType: newchange
Gerrit-Change-Id: Ifcaa2ccf05a2a691d0b150e2f7e0e765db25fc7f
Gerrit-PatchSet: 1
Gerrit-Project: mediawiki/core
Gerrit-Branch: REL1_27
Gerrit-Owner: Chad 
Gerrit-Reviewer: Brian Wolff 
Gerrit-Reviewer: Chad 

___
MediaWiki-commits mailing list
MediaWiki-commits@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits