Merge "Make calling wfMangleFlashPolicy configurable"

diff --combined includes/DefaultSettings.php
index 65ad403,d4efc60..f93737c
--- 1/includes/DefaultSettings.php
--- 2/includes/DefaultSettings.php
+++ b/includes/DefaultSettings.php
@@@ -1383,7 -1383,7 +1383,7 @@@ $wgDjvuOutputExtension = 'jpg'
  /**
   * Site admin email address.
   *
 - * Defaults to "wikiadmin@{$wgServerName}".
 + * Defaults to "wikiadmin@$wgServerName".
   */
  $wgEmergencyContact = false;
  
@@@ -1392,7 -1392,7 +1392,7 @@@
   *
   * The address we should use as sender when a user is requesting his password.
   *
 - * Defaults to "apache@{$wgServerName}".
 + * Defaults to "apache@$wgServerName".
   */
  $wgPasswordSender = false;
  
@@@ -3194,6 -3194,14 +3194,14 @@@ $wgShowRollbackEditCount = 10
   */
  $wgEnableCanonicalServerLink = false;
  
+ /**
+  * When OutputHandler is used, mangle any output that contains
+  * <cross-domain-policy>. Without this, an attacker can send their own
+  * cross-domain policy unless it is prevented by the crossdomain.xml file at
+  * the domain root.
+  */
+ $wgMangleFlashPolicy = true;
+ 
  /** @} */ # End of output format settings }
  
  /*************************************************************************//**