From 288512618ee57477ed5f01a97e11de229cbe32bb Mon Sep 17 00:00:00 2001 From: Brian Wolff Date: Mon, 13 Mar 2017 21:20:02 +0000 Subject: [PATCH] SECURITY: Escape wikitext content model/format in message Escape wikitext in model= and format= url parameter to edit page. This goes along with 1c788944 to help prevent XSS for wikis with $wgRawHtml = true; set. Bug: T156184 Change-Id: Ifcaa2ccf05a2a691d0b150e2f7e0e765db25fc7f --- RELEASE-NOTES-1.29 | 1 + includes/EditPage.php | 7 +++++-- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/RELEASE-NOTES-1.29 b/RELEASE-NOTES-1.29 index eece3de0b4..2552b40e28 100644 --- a/RELEASE-NOTES-1.29 +++ b/RELEASE-NOTES-1.29 @@ -94,6 +94,7 @@ production. their values out of the logs. * (T150044) SECURITY: "Mark all pages visited" on the watchlist now requires a CSRF token. +* (T156184) SECURITY: Escape content model/format url parameter in message. === Action API changes in 1.29 === * Submitting sensitive authentication request parameters to action=login, diff --git a/includes/EditPage.php b/includes/EditPage.php index e4d217c979..2153b8c02b 100644 --- a/includes/EditPage.php +++ b/includes/EditPage.php @@ -1027,7 +1027,7 @@ class EditPage { throw new ErrorPageError( 'editpage-invalidcontentmodel-title', 'editpage-invalidcontentmodel-text', - [ $this->contentModel ] + [ wfEscapeWikiText( $this->contentModel ) ] ); } @@ -1035,7 +1035,10 @@ class EditPage { throw new ErrorPageError( 'editpage-notsupportedcontentformat-title', 'editpage-notsupportedcontentformat-text', - [ $this->contentFormat, ContentHandler::getLocalizedName( $this->contentModel ) ] + [ + wfEscapeWikiText( $this->contentFormat ), + wfEscapeWikiText( ContentHandler::getLocalizedName( $this->contentModel ) ) + ] ); } -- 2.20.1