Merge "Wait for Slave Lag to catch up in wrapOldPasswords.php"

diff --git a/includes/Message.php b/includes/Message.php
index 27aab8a..7d86d07 100644 (file)
--- a/includes/Message.php
+++ b/includes/Message.php
@@ -822,6 +822,7 @@ class Message implements MessageSpecifier, Serializable {
                        // message key is user-controlled.
                        // '⧼' is used instead of '<' to side-step any
                        // double-escaping issues.
+                       // (Keep synchronised with mw.Message#toString in JS.)
                        return '⧼' . htmlspecialchars( $this->key ) . '⧽';
                }
 

diff --git a/includes/auth/LocalPasswordPrimaryAuthenticationProvider.php b/includes/auth/LocalPasswordPrimaryAuthenticationProvider.php
index 88df68d..b68c368 100644 (file)
--- a/includes/auth/LocalPasswordPrimaryAuthenticationProvider.php
+++ b/includes/auth/LocalPasswordPrimaryAuthenticationProvider.php
@@ -104,7 +104,7 @@ class LocalPasswordPrimaryAuthenticationProvider
                // The old hash format was just an md5 hex hash, with no type information
                if ( preg_match( '/^[0-9a-f]{32}$/', $row->user_password ) ) {
                        if ( $this->config->get( 'PasswordSalt' ) ) {
-                               $row->user_password = ":A:{$row->user_id}:{$row->user_password}";
+                               $row->user_password = ":B:{$row->user_id}:{$row->user_password}";
                        } else {
                                $row->user_password = ":A:{$row->user_password}";
                        }

diff --git a/includes/password/MWOldPassword.php b/includes/password/MWOldPassword.php
index 84675c1..360485e 100644 (file)
--- a/includes/password/MWOldPassword.php
+++ b/includes/password/MWOldPassword.php
@@ -36,14 +36,8 @@ class MWOldPassword extends ParameterizedPassword {
        }
 
        public function crypt( $plaintext ) {
-               global $wgPasswordSalt;
-
-               if ( $wgPasswordSalt && count( $this->args ) === 1 ) {
-                       $this->hash = md5( $this->args[0] . '-' . md5( $plaintext ) );
-               } else {
-                       $this->args = [];
-                       $this->hash = md5( $plaintext );
-               }
+               $this->args = [];
+               $this->hash = md5( $plaintext );
 
                if ( !is_string( $this->hash ) || strlen( $this->hash ) < 32 ) {
                        throw new PasswordError( 'Error when hashing password.' );

diff --git a/resources/src/mediawiki/mediawiki.js b/resources/src/mediawiki/mediawiki.js
index 9c8fe70..d525813 100644 (file)
--- a/resources/src/mediawiki/mediawiki.js
+++ b/resources/src/mediawiki/mediawiki.js
@@ -325,12 +325,15 @@
                        var text;
 
                        if ( !this.exists() ) {
-                               // Use <key> as text if key does not exist
-                               if ( this.format === 'escaped' || this.format === 'parse' ) {
-                                       // format 'escaped' and 'parse' need to have the brackets and key html escaped
-                                       return mw.html.escape( '<' + this.key + '>' );
-                               }
-                               return '<' + this.key + '>';
+                               // Use ⧼key⧽ as text if key does not exist
+                               // Err on the side of safety, ensure that the output
+                               // is always html safe in the event the message key is
+                               // missing, since in that case its highly likely the
+                               // message key is user-controlled.
+                               // '⧼' is used instead of '<' to side-step any
+                               // double-escaping issues.
+                               // (Keep synchronised with Message::toString() in PHP.)
+                               return '⧼' + mw.html.escape( this.key ) + '⧽';
                        }
 
                        if ( this.format === 'plain' || this.format === 'text' || this.format === 'parse' ) {

diff --git a/tests/qunit/suites/resources/mediawiki/mediawiki.test.js b/tests/qunit/suites/resources/mediawiki/mediawiki.test.js
index 1518a80..6ee4901 100644 (file)
--- a/tests/qunit/suites/resources/mediawiki/mediawiki.test.js
+++ b/tests/qunit/suites/resources/mediawiki/mediawiki.test.js
@@ -239,9 +239,7 @@
                goodbye = mw.message( 'goodbye' );
                assert.strictEqual( goodbye.exists(), false, 'Message.exists returns false for nonexistent messages' );
 
-               assertMultipleFormats( [ 'goodbye' ], [ 'plain', 'text' ], '<goodbye>', 'Message.toString returns <key> if key does not exist' );
-               // bug 30684
-               assertMultipleFormats( [ 'goodbye' ], [ 'parse', 'escaped' ], '&lt;goodbye&gt;', 'Message.toString returns properly escaped &lt;key&gt; if key does not exist' );
+               assertMultipleFormats( [ 'good<>bye' ], [ 'plain', 'text', 'parse', 'escaped' ], '⧼good&lt;&gt;bye⧽', 'Message.toString returns ⧽key⧽ if key does not exist' );
 
                assert.ok( mw.messages.set( 'plural-test-msg', 'There {{PLURAL:$1|is|are}} $1 {{PLURAL:$1|result|results}}' ), 'mw.messages.set: Register' );
                assertMultipleFormats( [ 'plural-test-msg', 6 ], [ 'text', 'parse', 'escaped' ], 'There are 6 results', 'plural get resolved' );
@@ -320,7 +318,7 @@
        QUnit.test( 'mw.msg', 14, function ( assert ) {
                assert.ok( mw.messages.set( 'hello', 'Hello <b>awesome</b> world' ), 'mw.messages.set: Register' );
                assert.equal( mw.msg( 'hello' ), 'Hello <b>awesome</b> world', 'Gets message with default options (existing message)' );
-               assert.equal( mw.msg( 'goodbye' ), '<goodbye>', 'Gets message with default options (nonexistent message)' );
+               assert.equal( mw.msg( 'goodbye' ), '⧼goodbye⧽', 'Gets message with default options (nonexistent message)' );
 
                assert.ok( mw.messages.set( 'plural-item', 'Found $1 {{PLURAL:$1|item|items}}' ), 'mw.messages.set: Register' );
                assert.equal( mw.msg( 'plural-item', 5 ), 'Found 5 items', 'Apply plural for count 5' );