From c843c33d76b7f2d91b70751033a173dd2e1f9702 Mon Sep 17 00:00:00 2001 From: =?utf8?q?Bartosz=20Dziewo=C5=84ski?= Date: Sun, 3 Jan 2016 02:51:12 +0100 Subject: [PATCH] Validate that $wgVariantArticlePath is absolute, too Follow-up to a4a3d0454069c25a24e2bfe732a665cc6a865878. Unlikely to be a security problem, as $2 generally has to appear somewhere before $1 in this config option. Bug: T48998 Change-Id: I08788713d9bd7c4c8d81479c18b5a404997a778d --- includes/Setup.php | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/includes/Setup.php b/includes/Setup.php index 2723258585..f4b0a247d9 100644 --- a/includes/Setup.php +++ b/includes/Setup.php @@ -523,13 +523,15 @@ require_once "$IP/includes/compat/normal/UtfNormalUtil.php"; $ps_validation = Profiler::instance()->scopedProfileIn( $fname . '-validation' ); // T48998: Bail out early if $wgArticlePath is non-absolute -if ( !preg_match( '/^(https?:\/\/|\/)/', $wgArticlePath ) ) { - throw new FatalError( - 'If you use a relative URL for $wgArticlePath, it must start ' . - 'with a slash (/).

See ' . - '' . - 'https://www.mediawiki.org/wiki/Manual:$wgArticlePath.' - ); +foreach ( array( 'wgArticlePath', 'wgVariantArticlePath' ) as $varName ) { + if ( $$varName && !preg_match( '/^(https?:\/\/|\/)/', $$varName ) ) { + throw new FatalError( + "If you use a relative URL for \$$varName, it must start " . + 'with a slash (/).

See ' . + "" . + "https://www.mediawiki.org/wiki/Manual:\$$varName." + ); + } } Profiler::instance()->scopedProfileOut( $ps_validation ); -- 2.20.1