From f80b2307028ed4d9231a0bd46496b241dcf4aa5c Mon Sep 17 00:00:00 2001 From: Pierre Schmitz Date: Thu, 26 Jun 2014 05:36:14 +0200 Subject: Update to MediaWiki 1.22.8 --- includes/upload/UploadBase.php | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) (limited to 'includes/upload') diff --git a/includes/upload/UploadBase.php b/includes/upload/UploadBase.php index c0c37b3f..40b3b19a 100644 --- a/includes/upload/UploadBase.php +++ b/includes/upload/UploadBase.php @@ -1283,11 +1283,20 @@ abstract class UploadBase { return true; } - # href with javascript target - if ( $stripped == 'href' && strpos( strtolower( $value ), 'javascript:' ) !== false ) { - wfDebug( __METHOD__ . ": Found script in href attribute '$attrib'='$value' in uploaded file.\n" ); + # href with non-local target (don't allow http://, javascript:, etc) + if ( $stripped == 'href' + && strpos( $value, 'data:' ) !== 0 + && strpos( $value, '#' ) !== 0 + ) { + if ( !( $strippedElement === 'a' + && preg_match( '!^https?://!im', $value ) ) + ) { + wfDebug( __METHOD__ . ": Found href attribute <$strippedElement " + . "'$attrib'='$value' in uploaded file.\n" ); + return true; } + } # href with embedded svg as target if ( $stripped == 'href' && preg_match( '!data:[^,]*image/svg[^,]*,!sim', $value ) ) { -- cgit v1.2.2