From: Platonides Date: Mon, 29 Nov 2010 16:34:28 +0000 (+0000) Subject: Fix potential html injection when the database server isn't available (bug 26164). X-Git-Tag: 1.31.0-rc.0~33691 X-Git-Url: https://git.cyclocoop.org/%242?a=commitdiff_plain;h=6e81d60086a6b431c363843f91376b2bb0fb1322;p=lhc%2Fweb%2Fwiklou.git Fix potential html injection when the database server isn't available (bug 26164). Wikis which set $wgServer in their LocalSettings or are in a virtual host would never be vulnerable. For sites which show the wiki in the default host, it will depend on how forgiving is their webserver and php stack for that garbled input, although some kind of foolable proxy —moreover wrongly caching errors (or the default output buffering is disabled and something incorrectly sent a previous text)— would also need to be present in order to make that useful for a potential attacker. --- diff --git a/RELEASE-NOTES b/RELEASE-NOTES index 83bbf7bf89..084cad188d 100644 --- a/RELEASE-NOTES +++ b/RELEASE-NOTES @@ -441,6 +441,7 @@ LocalSettings.php. The specific bugs are listed below in the general notes. * (bug 25451) Improved datetime representation in 32 bit php >= 5.2. * Show "skin does not exist error" only when the skin is inputted in the wrong case. +* (bug 26164) Potential html injection when the database server isn't available === API changes in 1.17 === * (bug 22738) Allow filtering by action type on query=logevent. diff --git a/includes/Exception.php b/includes/Exception.php index ac336bf5a3..ff5d4b196f 100644 --- a/includes/Exception.php +++ b/includes/Exception.php @@ -236,13 +236,15 @@ class MWException extends Exception { header( 'Pragma: nocache' ); } - $title = $this->getPageTitle(); + $logo = htmlspecialchars( $wgLogo, ENT_QUOTES ); + $title = htmlspecialchars( $this->getPageTitle() ); + return " $title -

$title

"; } diff --git a/includes/db/Database.php b/includes/db/Database.php index 26d4d2b7d0..174b8f2d6b 100644 --- a/includes/db/Database.php +++ b/includes/db/Database.php @@ -2805,7 +2805,7 @@ class DBConnectionError extends DBError { } function searchForm() { - global $wgSitename, $wgServer, $wgLang, $wgInputEncoding; + global $wgSitename, $wgServer, $wgLang; $usegoogle = "You can try searching via Google in the meantime."; $outofdate = "Note that their indexes of our content may be out of date."; @@ -2819,20 +2819,23 @@ class DBConnectionError extends DBError { $search = htmlspecialchars( @$_REQUEST['search'] ); + $server = htmlspecialchars( $wgServer ); + $sitename = htmlspecialchars( $wgSitename ); + $trygoogle = <<$usegoogle
$outofdate