From 995b9ca4e5a0e8f3719e5e9cacdedfe7ea45f630 Mon Sep 17 00:00:00 2001 From: Roan Kattouw Date: Wed, 13 Sep 2017 12:26:05 -0700 Subject: [PATCH] ResourceLoaderImageModule: Use CSSMin::buildUrlValue() where needed We can't just assume that the URLs that we generate are safe to use in url() without quotes. There's already a function that automatically uses quotes where necessary, so use that. Change-Id: I6663e49b82592eb45b8854fcff56ac966b39f8ce --- includes/resourceloader/ResourceLoaderImageModule.php | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/includes/resourceloader/ResourceLoaderImageModule.php b/includes/resourceloader/ResourceLoaderImageModule.php index cbcf5a0d62..8b5495958c 100644 --- a/includes/resourceloader/ResourceLoaderImageModule.php +++ b/includes/resourceloader/ResourceLoaderImageModule.php @@ -381,11 +381,13 @@ class ResourceLoaderImageModule extends ResourceLoaderModule { * @return string[] CSS declarations to use given URIs as background-image */ protected function getCssDeclarations( $primary, $fallback ) { + $primaryUrl = CSSMin::buildUrlValue( $primary ); + $fallbackUrl = CSSMin::buildUrlValue( $fallback ); return [ - "background-image: url($fallback);", - "background-image: linear-gradient(transparent, transparent), url($primary);", + "background-image: $fallbackUrl;", + "background-image: linear-gradient(transparent, transparent), $primaryUrl;", // Do not serve SVG to Opera 12, bad rendering with border-radius or background-size (T87504) - "background-image: -o-linear-gradient(transparent, transparent), url($fallback);", + "background-image: -o-linear-gradient(transparent, transparent), $fallbackUrl;", ]; } -- 2.20.1