From 6f5403ca6e8561c3dcd19284f86b4c3c8dd715ff Mon Sep 17 00:00:00 2001
From: Pierre Schmitz <pierre@archlinux.de>
Date: Tue, 9 Mar 2010 07:22:49 +0100
Subject: update to MediaWiki 1.15.2

---
 includes/DefaultSettings.php   |  4 ++--
 includes/Sanitizer.php         | 50 +++++++++++++++++++++++++++++++-----------
 includes/db/DatabaseSqlite.php |  7 ++++++
 3 files changed, 46 insertions(+), 15 deletions(-)

(limited to 'includes')

diff --git a/includes/DefaultSettings.php b/includes/DefaultSettings.php
index 136817bf..4ac466c8 100644
--- a/includes/DefaultSettings.php
+++ b/includes/DefaultSettings.php
@@ -33,7 +33,7 @@ if ( !defined( 'MW_PHP4' ) ) {
 }
 
 /** MediaWiki version number */
-$wgVersion			= '1.15.1';
+$wgVersion			= '1.15.2';
 
 /** Name of the site. It must be changed in LocalSettings.php */
 $wgSitename         = 'MediaWiki';
@@ -2561,7 +2561,7 @@ $wgAutoloadClasses = array();
  * $wgExtensionCredits[$type][] = array(
  * 	'name' => 'Example extension',
  *  'version' => 1.9,
- *  'svn-revision' => '$LastChangedRevision: 53179 $',
+ *  'svn-revision' => '$LastChangedRevision: 63438 $',
  *	'author' => 'Foo Barstein',
  *	'url' => 'http://wwww.example.com/Example%20Extension/',
  *	'description' => 'An example extension',
diff --git a/includes/Sanitizer.php b/includes/Sanitizer.php
index 5d58b036..0b70e002 100644
--- a/includes/Sanitizer.php
+++ b/includes/Sanitizer.php
@@ -658,24 +658,48 @@ class Sanitizer {
 	 * @return mixed
 	 */
 	static function checkCss( $value ) {
-		$stripped = Sanitizer::decodeCharReferences( $value );
+		$value = Sanitizer::decodeCharReferences( $value );
 
 		// Remove any comments; IE gets token splitting wrong
-		$stripped = StringUtils::delimiterReplace( '/*', '*/', ' ', $stripped );
-
-		$value = $stripped;
-
-		// ... and continue checks
-		$stripped = preg_replace( '!\\\\([0-9A-Fa-f]{1,6})[ \\n\\r\\t\\f]?!e',
-			'codepointToUtf8(hexdec("$1"))', $stripped );
-		$stripped = str_replace( '\\', '', $stripped );
-		if( preg_match( '/(?:expression|tps*:\/\/|url\\s*\().*/is',
-				$stripped ) ) {
-			# haxx0r
+		$value = StringUtils::delimiterReplace( '/*', '*/', ' ', $value );
+
+		// Decode escape sequences and line continuation
+		// See the grammar in the CSS 2 spec, appendix D, Mozilla implements it accurately.
+		// IE 8 doesn't implement it at all, but there's no way to introduce url() into
+		// IE that doesn't hit Mozilla also.
+		static $decodeRegex;
+		if ( !$decodeRegex ) {
+			$space = '[\\x20\\t\\r\\n\\f]';
+			$nl = '(?:\\n|\\r\\n|\\r|\\f)';
+			$backslash = '\\\\';
+			$decodeRegex = "/ $backslash 
+				(?:
+					($nl) |  # 1. Line continuation
+					([0-9A-Fa-f]{1,6})$space? |  # 2. character number
+					(.) # 3. backslash cancelling special meaning
+				)/xu";
+		}
+		$decoded = preg_replace_callback( $decodeRegex, 
+			array( __CLASS__, 'cssDecodeCallback' ), $value );
+		if ( preg_match( '!expression|https?://|url\s*\(!i', $decoded ) ) {
+			// Not allowed
 			return false;
+		} else {
+			// Allowed, return CSS with comments stripped
+			return $value;
 		}
+	}
 
-		return $value;
+	static function cssDecodeCallback( $matches ) {
+		if ( $matches[1] !== '' ) {
+			return '';
+		} elseif ( $matches[2] !== '' ) {
+			return codepointToUtf8( hexdec( $matches[2] ) );
+		} elseif ( $matches[3] !== '' ) {
+			return $matches[3];
+		} else {
+			throw new MWException( __METHOD__.': invalid match' );
+		}
 	}
 
 	/**
diff --git a/includes/db/DatabaseSqlite.php b/includes/db/DatabaseSqlite.php
index 7a595697..455c0b48 100644
--- a/includes/db/DatabaseSqlite.php
+++ b/includes/db/DatabaseSqlite.php
@@ -497,6 +497,13 @@ class DatabaseSqlite extends Database {
 		return $s;
 	}
 
+	/*
+	 * Build a concatenation list to feed into a SQL query
+	 */
+	function buildConcat( $stringList ) {
+		return '(' . implode( ') || (', $stringList ) . ')';
+	}
+
 } // end DatabaseSqlite class
 
 /**
-- 
cgit v1.2.2