Introduce $wgAllowTitlesInSVG, which allows the <title> attribute in uploaded files...

diff --git a/RELEASE-NOTES b/RELEASE-NOTES
index 060c55b..f3f0fe7 100644 (file)
--- a/RELEASE-NOTES
+++ b/RELEASE-NOTES
@@ -204,6 +204,9 @@ it from source control: http://www.mediawiki.org/wiki/Download_from_SVN
 * Rewritten removeUnusedAccounts to be more efficient, print names of inactive
   accounts
 * Redirect Special:Userlist to Special:Listusers
+* Introduce $wgAllowTitlesInSVG, which allows the <title> attribute in uploaded files
+  bearing the image/svg MIME type. Disabled by default due to the vast majority of
+  web servers being hideously misconfigured. See DefaultSettings.php for more details.
 
 == Compatibility ==
 

diff --git a/includes/DefaultSettings.php b/includes/DefaultSettings.php
index 22b4944..1109a2f 100644 (file)
--- a/includes/DefaultSettings.php
+++ b/includes/DefaultSettings.php
@@ -1951,4 +1951,13 @@ $wgAllowDisplayTitle = false ;
  */
 $wgReservedUsernames = array( 'MediaWiki default', 'Conversion script' );
 
+/**
+ * MediaWiki will reject HTMLesque tags in uploaded files due to idiotic browsers which can't
+ * perform basic stuff like MIME detection and which are vulnerable to further idiots uploading
+ * crap files as images. When this directive is on, <title> will be allowed in files with
+ * an "image/svg" MIME type. You should leave this disabled if your web server is misconfigured
+ * and doesn't send appropriate MIME types for SVG images.
+ */
+$wgAllowTitlesInSVG = false;
+
 ?>

diff --git a/includes/SpecialUpload.php b/includes/SpecialUpload.php
index f08b6e1..ef695f3 100644 (file)
--- a/includes/SpecialUpload.php
+++ b/includes/SpecialUpload.php
@@ -845,6 +845,7 @@ class UploadForm {
        * @return bool true if the file contains something looking like embedded scripts
        */
        function detectScript($file,$mime) {
+               global $wgAllowTitlesInSVG;
 
                #ugly hack: for text files, always look at the entire file.
                #For binarie field, just check the first K.
@@ -899,9 +900,10 @@ class UploadForm {
                        '<img',
                        '<pre',
                        '<script', #also in safari
-                       '<table',
-                       '<title'   #also in safari
+                       '<table'
                        );
+               if( $mime != 'image/svg' || !$wgAllowTitlesInSVG )
+                       $tags[] = '<title';
 
                foreach( $tags as $tag ) {
                        if( false !== strpos( $chunk, $tag ) ) {