UploadBase: Allow RDF Schema namespace in SVG files

[lhc/web/wiklou.git] / includes / upload / UploadBase.php

diff --git a/includes/upload/UploadBase.php b/includes/upload/UploadBase.php
index 91b4133..79166ef 100644 (file)
--- a/includes/upload/UploadBase.php
+++ b/includes/upload/UploadBase.php
@@ -775,7 +775,9 @@ abstract class UploadBase {
                                        User::IGNORE_USER_RIGHTS
                                );
                        }
-                       Hooks::run( 'UploadComplete', [ &$this ] );
+                       // Avoid PHP 7.1 warning of passing $this by reference
+                       $uploadBase = $this;
+                       Hooks::run( 'UploadComplete', [ &$uploadBase ] );
 
                        $this->postProcessUpload();
                }
@@ -1438,9 +1440,14 @@ abstract class UploadBase {
                        'http://www.w3.org/1999/02/22-rdf-syntax-ns#',
                        'http://www.w3.org/2000/svg',
                        'http://www.w3.org/tr/rec-rdf-syntax/',
+                       'http://www.w3.org/2000/01/rdf-schema#',
                ];
 
-               if ( !in_array( $namespace, $validNamespaces ) ) {
+               // Inkscape mangles namespace definitions created by Adobe Illustrator.
+               // This is nasty but harmless. (T144827)
+               $isBuggyInkscape = preg_match( '/^&(#38;)*ns_[a-z_]+;$/', $namespace );
+
+               if ( !( $isBuggyInkscape || in_array( $namespace, $validNamespaces ) ) ) {
                        wfDebug( __METHOD__ . ": Non-svg namespace '$namespace' in uploaded file.\n" );
                        /** @todo Return a status object to a closure in XmlTypeCheck, for MW1.21+ */
                        $this->mSVGNSError = $namespace;
@@ -1503,6 +1510,7 @@ abstract class UploadBase {
                        # fragment links are allowed. For all other tags, only data:
                        # and fragment are allowed.
                        if ( $stripped == 'href'
+                               && $value !== ''
                                && strpos( $value, 'data:' ) !== 0
                                && strpos( $value, '#' ) !== 0
                        ) {