summaryrefslogtreecommitdiff
path: root/languages/Language.php
diff options
context:
space:
mode:
authorPierre Schmitz <pierre@archlinux.de>2011-02-02 07:54:46 +0100
committerPierre Schmitz <pierre@archlinux.de>2011-02-02 07:54:46 +0100
commit3bddedf685051638fdba61268ad195fee041db1c (patch)
tree93ed42491453fef8fe0614d2620146b8b603db1d /languages/Language.php
parent8f93926e1bc6e96fc11b4d0d201025022d471de7 (diff)
update to MediaWiki 1.16.2
Diffstat (limited to 'languages/Language.php')
-rw-r--r--languages/Language.php23
1 files changed, 23 insertions, 0 deletions
diff --git a/languages/Language.php b/languages/Language.php
index 343ac8a7..3416fb27 100644
--- a/languages/Language.php
+++ b/languages/Language.php
@@ -144,6 +144,14 @@ class Language {
protected static function newFromCode( $code ) {
global $IP;
static $recursionLevel = 0;
+
+ // Protect against path traversal below
+ if ( !Language::isValidCode( $code )
+ || strcspn( $code, "/\\\000" ) !== strlen( $code ) )
+ {
+ throw new MWException( "Invalid language code \"$code\"" );
+ }
+
if ( $code == 'en' ) {
$class = 'Language';
} else {
@@ -174,6 +182,14 @@ class Language {
}
/**
+ * Returns true if a language code string is of a valid form, whether or
+ * not it exists.
+ */
+ public static function isValidCode( $code ) {
+ return strcspn( $code, "/\\\000" ) === strlen( $code );
+ }
+
+ /**
* Get the LocalisationCache instance
*/
public static function getLocalisationCache() {
@@ -2462,6 +2478,13 @@ class Language {
* @return string $prefix . $mangledCode . $suffix
*/
static function getFileName( $prefix = 'Language', $code, $suffix = '.php' ) {
+ // Protect against path traversal
+ if ( !Language::isValidCode( $code )
+ || strcspn( $code, "/\\\000" ) !== strlen( $code ) )
+ {
+ throw new MWException( "Invalid language code \"$code\"" );
+ }
+
return $prefix . str_replace( '-', '_', ucfirst( $code ) ) . $suffix;
}