* (bug 19355) Added .xhtml, .xht to upload file extension blacklist

diff --git a/RELEASE-NOTES b/RELEASE-NOTES
index 9d2a265..ddccf5e 100644 (file)
--- a/RELEASE-NOTES
+++ b/RELEASE-NOTES
@@ -293,6 +293,7 @@ this. Was used when mwEmbed was going to be an extension.
 * (bug 19761) Removed autogenerated <meta keywords> tag with link data.
   Keyword set was not useful, and is ignored by modern search engines anway.
 * (bug 19827) Special:SpecialPages title is "Upload file
+* (bug 19355) Added .xhtml, .xht to upload file extension blacklist
 
 == API changes in 1.16 ==
 

diff --git a/includes/DefaultSettings.php b/includes/DefaultSettings.php
index 4ad8bbd..99ef085 100644 (file)
--- a/includes/DefaultSettings.php
+++ b/includes/DefaultSettings.php
@@ -2014,7 +2014,7 @@ $wgFileExtensions = array( 'png', 'gif', 'jpg', 'jpeg' );
 /** Files with these extensions will never be allowed as uploads. */
 $wgFileBlacklist = array(
        # HTML may contain cookie-stealing JavaScript and web bugs
-       'html', 'htm', 'js', 'jsb', 'mhtml', 'mht',
+       'html', 'htm', 'js', 'jsb', 'mhtml', 'mht', 'xhtml', 'xht',
        # PHP scripts may execute arbitrary code on the server
        'php', 'phtml', 'php3', 'php4', 'php5', 'phps',
        # Other types that may be interpreted by some servers