From 124299758ca7454561118f466a0470905758924f Mon Sep 17 00:00:00 2001
From: Pierre Schmitz <pierre@archlinux.de>
Date: Wed, 13 Apr 2011 05:42:02 +0200
Subject: update to MediaWiki 1.16.3

---
 img_auth.php | 7 +++++++
 1 file changed, 7 insertions(+)

(limited to 'img_auth.php')

diff --git a/img_auth.php b/img_auth.php
index bc4464d4..534d1fd2 100644
--- a/img_auth.php
+++ b/img_auth.php
@@ -37,6 +37,13 @@ if ( $wgImgAuthPublicTest
 	wfForbidden('img-auth-accessdenied','img-auth-public');
 }
 
+// Check for bug 28235: QUERY_STRING overriding the correct extension
+if ( isset( $_SERVER['QUERY_STRING'] )
+	&& preg_match( '/\.[a-z]{1,4}$/i', $_SERVER['QUERY_STRING'] ) )
+{
+	wfForbidden( 'img-auth-accessdenied', 'img-auth-bad-query-string' );
+}
+
 // Extract path and image information
 if( !isset( $_SERVER['PATH_INFO'] ) )
 	wfForbidden('img-auth-accessdenied','img-auth-nopathinfo');
-- 
cgit v1.2.2