From 0bcc14380db09bffb138c28db27d7977d647c5d5 Mon Sep 17 00:00:00 2001
From: Aryeh Gregor <simetrical@users.mediawiki.org>
Date: Mon, 19 Apr 2010 18:44:11 +0000
Subject: [PATCH] Create $wgAllowImageTag to whitelist <img>

I could have reused $wgAllowExternalImages, but that's . . . rather
ugly.  It makes some external links mysteriously behave differently, and
of course doesn't allow setting attributes.
---
 RELEASE-NOTES                |  1 +
 includes/DefaultSettings.php | 10 ++++++++++
 includes/Sanitizer.php       | 11 +++++++++--
 3 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/RELEASE-NOTES b/RELEASE-NOTES
index 915b17cc18..04c06ba943 100644
--- a/RELEASE-NOTES
+++ b/RELEASE-NOTES
@@ -23,6 +23,7 @@ it from source control: http://www.mediawiki.org/wiki/Download_from_SVN
   extensions has been removed.
 * $wgLogAutocreatedAccounts controls whether autocreation of accounts is logged
   to new users log.
+* $wgAllowImageTag can be set to true to whitelist the <img> tag in wikitext.
 
 === New features in 1.17 ===
 * (bug 10183) Users can now add personal styles and scripts to all skins via
diff --git a/includes/DefaultSettings.php b/includes/DefaultSettings.php
index 6ffe45c2c2..803930ec96 100644
--- a/includes/DefaultSettings.php
+++ b/includes/DefaultSettings.php
@@ -1909,6 +1909,16 @@ $wgAllowExternalImagesFrom = '';
  */
 $wgEnableImageWhitelist = true;
 
+/**
+ * A different approach to the above: simply allow the <img> tag to be used.
+ * This allows you to specify alt text and other attributes, copy-paste HTML to
+ * your wiki more easily, etc.  However, allowing external images in any manner
+ * will allow anyone with editing rights to snoop on your visitors' IP
+ * addresses and so forth, if they wanted to, by inserting links to images on
+ * sites they control.
+ */
+$wgAllowImageTag = false;
+
 /** Allows to move images and other media files */
 $wgAllowImageMoving = true;
 
diff --git a/includes/Sanitizer.php b/includes/Sanitizer.php
index 01cd5b97ed..35908b92a9 100644
--- a/includes/Sanitizer.php
+++ b/includes/Sanitizer.php
@@ -389,6 +389,12 @@ class Sanitizer {
 				'li',
 			);
 
+			global $wgAllowImageTag;
+			if ( $wgAllowImageTag ) {
+				$htmlsingle[] = 'img';
+				$htmlsingleonly[] = 'img';
+			}
+
 			$htmlsingleallowed = array_unique( array_merge( $htmlsingle, $tabletags ) );
 			$htmlelementsStatic = array_unique( array_merge( $htmlsingle, $htmlpairsStatic, $htmlnest ) );
 
@@ -1403,8 +1409,9 @@ class Sanitizer {
 
 			# 13.2
 			# Not usually allowed, but may be used for extension-style hooks
-			# such as <math> when it is rasterized
-			'img'        => array_merge( $common, array( 'alt' ) ),
+			# such as <math> when it is rasterized, or if $wgAllowImageTag is
+			# true
+			'img'        => array_merge( $common, array( 'alt', 'src' ) ),
 
 			# 15.2.1
 			'tt'         => $common,
-- 
2.20.1