diff options
author | Brion Vibber <brion@users.mediawiki.org> | 2007-09-10 21:35:30 +0000 |
---|---|---|
committer | Brion Vibber <brion@users.mediawiki.org> | 2007-09-10 21:35:30 +0000 |
commit | 24c2ec00db6db447f30c67b96ffaae11af3b77d4 (patch) | |
tree | 73a46787c45b878742f0c275a411897b0a81ef64 | |
parent | 95828bd404c3e0519e823ee7cdd047dd8e09d30c (diff) |
Bump to 1.8.5origin/REL1_8
Notes
http://mediawiki.org/wiki/Special:Code/MediaWiki/25743
-rw-r--r-- | RELEASE-NOTES | 33 | ||||
-rw-r--r-- | includes/DefaultSettings.php | 2 | ||||
-rw-r--r-- | includes/api/ApiFormatBase.php | 7 |
3 files changed, 39 insertions, 3 deletions
diff --git a/RELEASE-NOTES b/RELEASE-NOTES index 559a0c7f3040..6cb39b307150 100644 --- a/RELEASE-NOTES +++ b/RELEASE-NOTES @@ -3,6 +3,39 @@ Security reminder: MediaWiki does not require PHP's register_globals setting since version 1.2.0. If you have it on, turn it *off* if you can. +== MediaWiki 1.8.5 == + +September 10, 2007 + +This is a security fix update to the Fall 2006 quarterly release snapshot. +A possible HTML/XSS injection vector in the API pretty-printing mode has +been found and fixed. + +The vulnerability may be worked around in an unfixed version by simply +disabling the API interface if it is not in use, by adding this to +LocalSettings.php: + + $wgEnableAPI = false; + +(This is the default setting in 1.8.x.) + +Not vulnerable versions: +* 1.11 >= 1.11.0 +* 1.10 >= 1.10.2 +* 1.9 >= 1.9.4 +* 1.8 >= 1.8.5 + +Vulnerable versions: +* 1.11 <= 1.11.0rc1 +* 1.10 <= 1.10.1 +* 1.9 <= 1.9.3 +* 1.8 <= 1.8.4 (if $wgEnableAPI has been switched on) + +MediaWiki 1.7 and below are not affected as they do not include +the faulty function, however the BotQuery extension is similarly +vulnerable unless updated to the latest SVN version. + + == MediaWiki 1.8.4 == February 20, 2007 diff --git a/includes/DefaultSettings.php b/includes/DefaultSettings.php index 15dcff732996..5d1929d5a14d 100644 --- a/includes/DefaultSettings.php +++ b/includes/DefaultSettings.php @@ -32,7 +32,7 @@ require_once( 'includes/SiteConfiguration.php' ); $wgConf = new SiteConfiguration; /** MediaWiki version number */ -$wgVersion = '1.8.4'; +$wgVersion = '1.8.5'; /** Name of the site. It must be changed in LocalSettings.php */ $wgSitename = 'MediaWiki'; diff --git a/includes/api/ApiFormatBase.php b/includes/api/ApiFormatBase.php index 92c9213ad83e..a4efe1a8e870 100644 --- a/includes/api/ApiFormatBase.php +++ b/includes/api/ApiFormatBase.php @@ -133,8 +133,11 @@ abstract class ApiFormatBase extends ApiBase { * This method also replaces any '<' with < */ protected function formatHTML($text) { - // encode all tags as safe blue strings - $text = ereg_replace('\<([^>]+)\>', '<font color=blue><\1></font>', $text); + // Escape everything first for full coverage + $text = htmlspecialchars($text); + + // encode all comments or tags as safe blue strings + $text = preg_replace('/\<(!--.*?--|.*?)\>/', '<span style="color:blue;"><\1></span>', $text); // identify URLs $text = ereg_replace("[a-zA-Z]+://[^ '()<\n]+", '<a href="\\0">\\0</a>', $text); // identify requests to api.php |