Merge "mw.ForeignApi: Percent-encode dots in the 'origin' parameter"

diff --git a/resources/src/mediawiki/ForeignApi.js b/resources/src/mediawiki/ForeignApi.js
index b8cc059..899daa5 100644 (file)
--- a/resources/src/mediawiki/ForeignApi.js
+++ b/resources/src/mediawiki/ForeignApi.js
@@ -94,7 +94,9 @@
                        url = ( ajaxOptions && ajaxOptions.url ) || this.defaults.ajax.url;
                        origin = ( parameters && parameters.origin ) || this.defaults.parameters.origin;
                        url += ( url.indexOf( '?' ) !== -1 ? '&' : '?' ) +
-                               'origin=' + encodeURIComponent( origin );
+                               // Depending on server configuration, MediaWiki may forbid periods in URLs, due to an IE 6
+                               // XSS bug. So let's escape them here. See WebRequest::checkUrlExtension() and T30235.
+                               'origin=' + encodeURIComponent( origin ).replace( /\./g, '%2E' );
                        newAjaxOptions = $.extend( {}, ajaxOptions, { url: url } );
                } else {
                        newAjaxOptions = ajaxOptions;

diff --git a/resources/src/mediawiki/api.js b/resources/src/mediawiki/api.js
index b4ff40a..1f21fc6 100644 (file)
--- a/resources/src/mediawiki/api.js
+++ b/resources/src/mediawiki/api.js
@@ -212,16 +212,17 @@
                                // Prevent jQuery from overriding the Content-Type header
                                ajaxOptions.contentType = false;
                        } else {
-                               // Some deployed MediaWiki >= 1.17 forbid periods in URLs, due to an IE XSS bug
-                               // So let's escape them here. See bug #28235
                                // This works because jQuery accepts data as a query string or as an Object
-                               ajaxOptions.data = $.param( parameters ).replace( /\./g, '%2E' );
-
+                               ajaxOptions.data = $.param( parameters );
                                // If we extracted a token parameter, add it back in.
                                if ( token ) {
                                        ajaxOptions.data += '&token=' + encodeURIComponent( token );
                                }
 
+                               // Depending on server configuration, MediaWiki may forbid periods in URLs, due to an IE 6
+                               // XSS bug. So let's escape them here. See WebRequest::checkUrlExtension() and T30235.
+                               ajaxOptions.data = ajaxOptions.data.replace( /\./g, '%2E' );
+
                                if ( ajaxOptions.contentType === 'multipart/form-data' ) {
                                        // We were asked to emulate but can't, so drop the Content-Type header, otherwise
                                        // it'll be wrong and the server will fail to decode the POST body