From 6237fe4bb5fdd60a2c41b3a2d1e988b274dcb34a Mon Sep 17 00:00:00 2001 From: Tim Starling Date: Thu, 5 Feb 2009 08:56:35 +0000 Subject: [PATCH] * Fixed a whole lot of XSS vulnerabilities in the installer. All require a live installer, i.e. with no LocalSettings.php present. * Implemented taint support in the installer and fixed some false positives (and false negatives) --- config/index.php | 100 ++++--- includes/GlobalFunctions.php | 15 ++ maintenance/convertLinks.inc | 52 ++-- maintenance/initStats.inc | 22 +- maintenance/populateCategory.inc | 12 +- maintenance/populateParentId.inc | 18 +- maintenance/updaters.inc | 447 +++++++++++++++---------------- maintenance/userDupes.inc | 46 ++-- 8 files changed, 379 insertions(+), 333 deletions(-) diff --git a/config/index.php b/config/index.php index 5016da1667..b1485c0870 100644 --- a/config/index.php +++ b/config/index.php @@ -92,7 +92,8 @@ $ourdb['ibm_db2']['rootuser'] = 'db2admin'; - MediaWiki <?php echo( $wgVersion ); ?> Installation + + MediaWiki <?php echo htmlspecialchars( $wgVersion ); ?> Installation