From: Platonides <platonides@users.mediawiki.org>
Date: Tue, 20 Apr 2010 19:04:00 +0000 (+0000)
Subject: Follow up r65286. If we are going to support <img we should support width and height
X-Git-Tag: 1.31.0-rc.0~37059
X-Git-Url: https://git.cyclocoop.org/%7B%24www_url%7Dadmin/compta/exercices/journal.php?a=commitdiff_plain;h=df6d1309e09caeca6d2e914612dcb4cc283c2c8d;p=lhc%2Fweb%2Fwiklou.git

Follow up r65286. If we are going to support <img we should support width and height
attributes, too. Since there's a potential for creating webbugs of 1x1px we might want
to enforce a minimum size for them. But that has always existed when the attacker provides
the image.

The sanitizer isn't treating numeric-like arguments in a special way. That is something
to fix.
---

diff --git a/includes/Sanitizer.php b/includes/Sanitizer.php
index 35908b92a9..3d9317e388 100644
--- a/includes/Sanitizer.php
+++ b/includes/Sanitizer.php
@@ -1411,7 +1411,7 @@ class Sanitizer {
 			# Not usually allowed, but may be used for extension-style hooks
 			# such as <math> when it is rasterized, or if $wgAllowImageTag is
 			# true
-			'img'        => array_merge( $common, array( 'alt', 'src' ) ),
+			'img'        => array_merge( $common, array( 'alt', 'src', 'width', 'height' ) ),
 
 			# 15.2.1
 			'tt'         => $common,