Merge "upload: Simplify file extension extraction in UploadBase"

[lhc/web/wiklou.git] / includes / upload / UploadBase.php

diff --git a/includes/upload/UploadBase.php b/includes/upload/UploadBase.php
index c7dbf83..d00ad97 100644 (file)
--- a/includes/upload/UploadBase.php
+++ b/includes/upload/UploadBase.php
@@ -296,7 +296,7 @@ abstract class UploadBase {
         */
        public function getRealPath( $srcPath ) {
                $repo = RepoGroup::singleton()->getLocalRepo();
-               if ( $repo->isVirtualUrl( $srcPath ) ) {
+               if ( FileRepo::isVirtualUrl( $srcPath ) ) {
                        /** @todo Just make uploads work with storage paths UploadFromStash
                         *  loads files via virtual URLs.
                         */
@@ -947,8 +947,8 @@ abstract class UploadBase {
                 */
                list( $partname, $ext ) = $this->splitExtensions( $this->mFilteredName );
 
-               if ( count( $ext ) ) {
-                       $this->mFinalExtension = trim( $ext[count( $ext ) - 1] );
+               if ( $ext !== [] ) {
+                       $this->mFinalExtension = trim( end( $ext ) );
                } else {
                        $this->mFinalExtension = '';
 
@@ -1169,7 +1169,7 @@ abstract class UploadBase {
         * scripts, so the blacklist needs to check them all.
         *
         * @param string $filename
-        * @return array
+        * @return array [ string, string[] ]
         */
        public static function splitExtensions( $filename ) {
                $bits = explode( '.', $filename );
@@ -1194,8 +1194,8 @@ abstract class UploadBase {
         * Perform case-insensitive match against a list of file extensions.
         * Returns an array of matching extensions.
         *
-        * @param array $ext
-        * @param array $list
+        * @param string[] $ext
+        * @param string[] $list
         * @return bool
         */
        public static function checkFileExtensionList( $ext, $list ) {
@@ -1740,9 +1740,10 @@ abstract class UploadBase {
                        }
 
                        # image filters can pull in url, which could be svg that executes scripts
+                       # Only allow url( "#foo" ). Do not allow url( http://example.com )
                        if ( $strippedElement == 'image'
                                && $stripped == 'filter'
-                               && preg_match( '!url\s*\(!sim', $value )
+                               && preg_match( '!url\s*\(\s*["\']?[^#]!sim', $value )
                        ) {
                                wfDebug( __METHOD__ . ": Found image filter with url: "
                                        . "\"<$strippedElement $stripped='$value'...\" in uploaded file.\n" );