* Don't show non-functional toolbar buttons on Opera 7 anymore
* (bug 9151) Fix relative subpage links with section fragments
* (bug 10560) Adding a space between category letter heading and "continues"
+* Security fix: Disable retrieving pages as raw js/css that should not contain
+ such content.
== API changes since 1.10 ==
}
function getRawText() {
- global $wgUser, $wgOut, $wgRequest;
+ global $wgUser, $wgOut, $wgRequest, $wgJsMimeType;
+
+ /* Disable retrieving content pages as raw js/css */
+ $dangerousTypes = array( $wgJsMimeType, 'text/css' );
+ if ( in_array( $this->mContentType, $dangerousTypes ) &&
+ !($this->mTitle->isCssOrJsPage() || $this->mTitle->isCssJsSubpage() ) )
+ return '/* EMPTY */';
+
if($this->mGen) {
$sk = $wgUser->getSkin();
$sk->initPage($wgOut);