Merge "SpecialContributions: Avoid using 'contributions' slave for getParentLengths"

diff --git a/img_auth.php b/img_auth.php
index 2d2db9a..72a7dab 100644 (file)
--- a/img_auth.php
+++ b/img_auth.php
@@ -92,12 +92,17 @@ function wfImageAuthMain() {
                if ( strpos( $path, $prefix ) === 0 ) {
                        $be = FileBackendGroup::singleton()->backendFromPath( $storageDir );
                        $filename = $storageDir . substr( $path, strlen( $prefix ) ); // strip prefix
+                       // Check basic user authorization
+                       if ( !RequestContext::getMain()->getUser()->isAllowed( 'read' ) ) {
+                               wfForbidden( 'img-auth-accessdenied', 'img-auth-noread', $path );
+                               return;
+                       }
                        if ( $be->fileExists( array( 'src' => $filename ) ) ) {
                                wfDebugLog( 'img_auth', "Streaming `" . $filename . "`." );
                                $be->streamFile( array( 'src' => $filename ),
                                        array( 'Cache-Control: private', 'Vary: Cookie' ) );
                        } else {
-                               wfForbidden( 'img-auth-accessdenied', 'img-auth-nofile', $filename );
+                               wfForbidden( 'img-auth-accessdenied', 'img-auth-nofile', $path );
                        }
                        return;
                }

diff --git a/includes/Sanitizer.php b/includes/Sanitizer.php
index a6fb6d0..0de8cda 100644 (file)
--- a/includes/Sanitizer.php
+++ b/includes/Sanitizer.php
@@ -867,7 +867,7 @@ class Sanitizer {
 
                // Normalize Halfwidth and Fullwidth Unicode block that IE6 might treat as ascii
                $value = preg_replace_callback(
-                       '/[ï¼\81-ï½\9a]/u', // U+FF01 to U+FF5A
+                       '/[ï¼\81-［］-ï½\9a]/u', // U+FF01 to U+FF5A, excluding U+FF3C (bug 58088)
                        function ( $matches ) {
                                $cp = utf8ToCodepoint( $matches[0] );
                                if ( $cp === false ) {
@@ -926,9 +926,16 @@ class Sanitizer {
                if ( preg_match( '/[\000-\010\013\016-\037\177]/', $value ) ) {
                        return '/* invalid control char */';
                } elseif ( preg_match(
-                       '! expression | filter\s*: | accelerator\s*: | url\s*\( | image\s*\( | image-set\s*\( !ix',
-                       $value
-               ) ) {
+                       '! expression
+                               | filter\s*:
+                               | accelerator\s*:
+                               | -o-link\s*:
+                               | -o-link-source\s*:
+                               | -o-replace\s*:
+                               | url\s*\(
+                               | image\s*\(
+                               | image-set\s*\(
+                       !ix', $value ) ) {
                        return '/* insecure input */';
                }
                return $value;

diff --git a/includes/api/ApiQueryLogEvents.php b/includes/api/ApiQueryLogEvents.php
index 356fa3e..e4ce256 100644 (file)
--- a/includes/api/ApiQueryLogEvents.php
+++ b/includes/api/ApiQueryLogEvents.php
@@ -299,18 +299,22 @@ class ApiQueryLogEvents extends ApiQueryBase {
 
                if ( $this->fld_ids ) {
                        $vals['logid'] = intval( $row->log_id );
-                       $vals['pageid'] = intval( $row->page_id );
                }
 
                if ( $this->fld_title || $this->fld_parsedcomment ) {
                        $title = Title::makeTitle( $row->log_namespace, $row->log_title );
                }
 
-               if ( $this->fld_title ) {
+               if ( $this->fld_title || $this->fld_ids ) {
                        if ( LogEventsList::isDeleted( $row, LogPage::DELETED_ACTION ) ) {
                                $vals['actionhidden'] = '';
                        } else {
-                               ApiQueryBase::addTitleInfo( $vals, $title );
+                               if ( $this->fld_title ) {
+                                       ApiQueryBase::addTitleInfo( $vals, $title );
+                               }
+                               if ( $this->fld_ids ) {
+                                       $vals['pageid'] = intval( $row->page_id );
+                               }
                        }
                }
 

diff --git a/includes/changes/EnhancedChangesList.php b/includes/changes/EnhancedChangesList.php
index 42b112c..cc299a9 100644 (file)
--- a/includes/changes/EnhancedChangesList.php
+++ b/includes/changes/EnhancedChangesList.php
@@ -223,7 +223,7 @@ class EnhancedChangesList extends ChangesList {
                if ( $block[0]->mAttribs['rc_log_type'] ) {
                        # Log entry
                        $classes[] = Sanitizer::escapeClass( 'mw-changeslist-log-'
-                               . $block[0]->mAttribs['rc_log_type'] . '-' . $block[0]->mAttribs['rc_title'] );
+                               . $block[0]->mAttribs['rc_log_type'] );
                } else {
                        $classes[] = Sanitizer::escapeClass( 'mw-changeslist-ns'
                                . $block[0]->mAttribs['rc_namespace'] . '-' . $block[0]->mAttribs['rc_title'] );
@@ -589,8 +589,7 @@ class EnhancedChangesList extends ChangesList {
                $classes = array( 'mw-enhanced-rc' );
                if ( $logType ) {
                        # Log entry
-                       $classes[] = Sanitizer::escapeClass( 'mw-changeslist-log-'
-                               . $logType . '-' . $rcObj->mAttribs['rc_title'] );
+                       $classes[] = Sanitizer::escapeClass( 'mw-changeslist-log-' . $logType );
                } else {
                        $classes[] = Sanitizer::escapeClass( 'mw-changeslist-ns' .
                                $rcObj->mAttribs['rc_namespace'] . '-' . $rcObj->mAttribs['rc_title'] );

diff --git a/includes/objectcache/DBABagOStuff.php b/includes/objectcache/DBABagOStuff.php
index c82b3aa..a81b5c5 100644 (file)
--- a/includes/objectcache/DBABagOStuff.php
+++ b/includes/objectcache/DBABagOStuff.php
@@ -125,6 +125,7 @@ class DBABagOStuff extends BagOStuff {
                }
 
                $val = dba_fetch( $key, $handle );
+               $casToken = $val;
                list( $val, $expiry ) = $this->decode( $val );
 
                # Must close ASAP because locks are held
@@ -139,8 +140,6 @@ class DBABagOStuff extends BagOStuff {
                        $val = false;
                }
 
-               $casToken = $val;
-
                wfProfileOut( __METHOD__ );
 
                return $val;
@@ -193,7 +192,6 @@ class DBABagOStuff extends BagOStuff {
                // DBA is locked to any other write connection, so we can safely
                // compare the current & previous value before saving new value
                $val = dba_fetch( $key, $handle );
-               list( $val, $exptime ) = $this->decode( $val );
                if ( $casToken !== $val ) {
                        dba_close( $handle );
                        wfProfileOut( __METHOD__ );

diff --git a/includes/objectcache/HashBagOStuff.php b/includes/objectcache/HashBagOStuff.php
index d061eff..bc5167d 100644 (file)
--- a/includes/objectcache/HashBagOStuff.php
+++ b/includes/objectcache/HashBagOStuff.php
@@ -64,7 +64,7 @@ class HashBagOStuff extends BagOStuff {
                        return false;
                }
 
-               $casToken = $this->bag[$key][0];
+               $casToken = serialize( $this->bag[$key][0] );
 
                return $this->bag[$key][0];
        }
@@ -88,7 +88,7 @@ class HashBagOStuff extends BagOStuff {
         * @return bool
         */
        function cas( $casToken, $key, $value, $exptime = 0 ) {
-               if ( $this->get( $key ) === $casToken ) {
+               if ( serialize( $this->get( $key ) ) === $casToken ) {
                        return $this->set( $key, $value, $exptime );
                }
 

diff --git a/includes/objectcache/RedisBagOStuff.php b/includes/objectcache/RedisBagOStuff.php
index adcf762..3c97480 100644 (file)
--- a/includes/objectcache/RedisBagOStuff.php
+++ b/includes/objectcache/RedisBagOStuff.php
@@ -79,12 +79,13 @@ class RedisBagOStuff extends BagOStuff {
                        return false;
                }
                try {
-                       $result = $this->unserialize( $conn->get( $key ) );
+                       $value = $conn->get( $key );
+                       $casToken = $value;
+                       $result = $this->unserialize( $value );
                } catch ( RedisException $e ) {
                        $result = false;
                        $this->handleException( $server, $conn, $e );
                }
-               $casToken = $result;
 
                $this->logRequest( 'get', $key, $server, $result );
                return $result;
@@ -125,7 +126,7 @@ class RedisBagOStuff extends BagOStuff {
                try {
                        $conn->watch( $key );
 
-                       if ( $this->get( $key ) !== $casToken ) {
+                       if ( $this->serialize( $this->get( $key ) ) !== $casToken ) {
                                $conn->unwatch();
                                return false;
                        }

diff --git a/includes/specials/SpecialWatchlist.php b/includes/specials/SpecialWatchlist.php
index c947c78..2c2a824 100644 (file)
--- a/includes/specials/SpecialWatchlist.php
+++ b/includes/specials/SpecialWatchlist.php
@@ -300,6 +300,23 @@ class SpecialWatchlist extends SpecialRecentChanges {
                        }
                }
 
+               // Log entries with DELETED_ACTION must not show up unless the user has
+               // the necessary rights.
+               if ( !$user->isAllowed( 'deletedhistory' ) ) {
+                       $bitmask = LogPage::DELETED_ACTION;
+               } elseif ( !$user->isAllowed( 'suppressrevision' ) ) {
+                       $bitmask = LogPage::DELETED_ACTION | LogPage::DELETED_RESTRICTED;
+               } else {
+                       $bitmask = 0;
+               }
+               if ( $bitmask ) {
+                       $conds[] = $dbr->makeList( array(
+                               'rc_type != ' . RC_LOG,
+                               $dbr->bitAnd( 'rc_deleted', $bitmask ) . " != $bitmask",
+                       ), LIST_OR );
+               }
+
+
                ChangeTags::modifyDisplayQuery( $tables, $fields, $conds, $join_conds, $options, '' );
                wfRunHooks( 'SpecialWatchlistQuery', array( &$conds, &$tables, &$join_conds, &$fields, $opts ) );
 

diff --git a/includes/upload/UploadBase.php b/includes/upload/UploadBase.php
index 8ee36a6..67bffc3 100644 (file)
--- a/includes/upload/UploadBase.php
+++ b/includes/upload/UploadBase.php
@@ -474,9 +474,10 @@ abstract class UploadBase {
                                return array( 'uploadscripted' );
                        }
                        if ( $this->mFinalExtension == 'svg' || $mime == 'image/svg+xml' ) {
-                               if ( $this->detectScriptInSvg( $this->mTempPath ) ) {
+                               $svgStatus = $this->detectScriptInSvg( $this->mTempPath );
+                               if ( $svgStatus !== false ) {
                                        wfProfileOut( __METHOD__ );
-                                       return array( 'uploadscripted' );
+                                       return $svgStatus;
                                }
                        }
                }
@@ -1164,7 +1165,7 @@ abstract class UploadBase {
 
        /**
         * @param $filename string
-        * @return bool
+        * @return mixed false of the file is verified (does not contain scripts), array otherwise.
         */
        protected function detectScriptInSvg( $filename ) {
                $check = new XmlTypeCheck(
@@ -1173,7 +1174,13 @@ abstract class UploadBase {
                        true,
                        array( 'processing_instruction_handler' => 'UploadBase::checkSvgPICallback' )
                );
-               return $check->filterMatch;
+               if ( $check->wellFormed !== true ) {
+                       // Invalid xml (bug 58553)
+                       return array( 'uploadinvalidxml' );
+               } elseif ( $check->filterMatch ) {
+                       return array( 'uploadscripted' );
+               }
+               return false;
        }
 
        /**

diff --git a/languages/messages/MessagesEn.php b/languages/messages/MessagesEn.php
index 0728d28..41a38e4 100644 (file)
--- a/languages/messages/MessagesEn.php
+++ b/languages/messages/MessagesEn.php
@@ -2343,6 +2343,7 @@ You should ask someone with the ability to view suppressed file data to review t
 'php-uploaddisabledtext'      => 'File uploads are disabled in PHP.
 Please check the file_uploads setting.',
 'uploadscripted'              => 'This file contains HTML or script code that may be erroneously interpreted by a web browser.',
+'uploadinvalidxml'            => 'The XML in the uploaded file could not be parsed.',
 'uploadvirus'                 => 'The file contains a virus!
 Details: $1',
 'uploadjava'                  => 'The file is a ZIP file that contains a Java .class file.

diff --git a/languages/messages/MessagesQqq.php b/languages/messages/MessagesQqq.php
index 15a3ff3..1f47bf0 100644 (file)
--- a/languages/messages/MessagesQqq.php
+++ b/languages/messages/MessagesQqq.php
@@ -4073,6 +4073,7 @@ See also:
 * {{msg-mw|zip-wrong-format}}
 * {{msg-mw|uploadjava}}
 * {{msg-mw|uploadvirus}}',
+'uploadinvalidxml' => 'Error message displayed when the uploaded file contains XML that cannot be properly parsed and checked.',
 'uploadvirus' => 'Error message displayed when uploaded file contains a virus.
 
 Parameters:

diff --git a/tests/parser/parserTests.txt b/tests/parser/parserTests.txt
index 6dff54e..d853889 100644 (file)
--- a/tests/parser/parserTests.txt
+++ b/tests/parser/parserTests.txt
@@ -12160,6 +12160,17 @@ MSIE CSS safety test: sup/sub script
 
 !! end
 
+!! test
+Opera -o-link CSS
+!! input
+<div
+title="&#100;&#97;&#116;&#97;&#58;&#116;&#101;&#120;&#116;&#47;&#104;&#116;&#109;&#108;&#44;&#60;&#105;&#109;&#103;&#32;&#115;&#114;&#99;&#61;&#49;&#32;&#111;&#110;&#101;&#114;&#114;&#111;&#114;&#61;&#97;&#108;&#101;&#114;&#116;&#40;&#49;&#41;&#62;"
+style="-o-link:attr(title);-o-link-source:current">X</div>
+!! result
+<div title="data:text/html,&lt;img src=1 onerror=alert(1)&gt;" style="/* insecure input */">X</div>
+
+!! end
+
 !! test
 MSIE CSS safety test: Repetition markers
 !! input