Merge "mw.ForeignApi: Percent-encode dots in the 'origin' parameter"

[lhc/web/wiklou.git] / resources / src / mediawiki / api.js

diff --git a/resources/src/mediawiki/api.js b/resources/src/mediawiki/api.js
index b4ff40a..1f21fc6 100644 (file)
--- a/resources/src/mediawiki/api.js
+++ b/resources/src/mediawiki/api.js
@@ -212,16 +212,17 @@
                                // Prevent jQuery from overriding the Content-Type header
                                ajaxOptions.contentType = false;
                        } else {
-                               // Some deployed MediaWiki >= 1.17 forbid periods in URLs, due to an IE XSS bug
-                               // So let's escape them here. See bug #28235
                                // This works because jQuery accepts data as a query string or as an Object
-                               ajaxOptions.data = $.param( parameters ).replace( /\./g, '%2E' );
-
+                               ajaxOptions.data = $.param( parameters );
                                // If we extracted a token parameter, add it back in.
                                if ( token ) {
                                        ajaxOptions.data += '&token=' + encodeURIComponent( token );
                                }
 
+                               // Depending on server configuration, MediaWiki may forbid periods in URLs, due to an IE 6
+                               // XSS bug. So let's escape them here. See WebRequest::checkUrlExtension() and T30235.
+                               ajaxOptions.data = ajaxOptions.data.replace( /\./g, '%2E' );
+
                                if ( ajaxOptions.contentType === 'multipart/form-data' ) {
                                        // We were asked to emulate but can't, so drop the Content-Type header, otherwise
                                        // it'll be wrong and the server will fail to decode the POST body