From 8f93926e1bc6e96fc11b4d0d201025022d471de7 Mon Sep 17 00:00:00 2001 From: Pierre Schmitz Date: Tue, 4 Jan 2011 12:24:29 +0100 Subject: update to MediaWiki 1.16.1 --- includes/Article.php | 5 ++++ includes/DefaultSettings.php | 32 +++++++++++++++++++--- includes/HTMLForm.php | 3 +++ includes/HistoryPage.php | 19 +++++++++++++ includes/ImagePage.php | 26 ++++++++++++++++++ includes/OutputPage.php | 43 ++++++++++++++++++++++++++++++ includes/Skin.php | 2 +- includes/Title.php | 5 ++-- includes/api/ApiBase.php | 12 +++++++-- includes/api/ApiBlock.php | 6 ++++- includes/api/ApiDelete.php | 6 ++++- includes/api/ApiEditPage.php | 6 ++++- includes/api/ApiEmailUser.php | 6 ++++- includes/api/ApiImport.php | 6 ++++- includes/api/ApiMove.php | 6 ++++- includes/api/ApiPatrol.php | 6 ++++- includes/api/ApiProtect.php | 8 ++++-- includes/api/ApiQueryAllUsers.php | 11 ++++++-- includes/api/ApiQueryRevisions.php | 7 +++-- includes/api/ApiUnblock.php | 6 ++++- includes/api/ApiUndelete.php | 6 ++++- includes/api/ApiUpload.php | 4 +++ includes/api/ApiUserrights.php | 6 ++++- includes/diff/DifferenceInterface.php | 3 +++ includes/json/Services_JSON.php | 2 +- includes/specials/SpecialAllpages.php | 1 + includes/specials/SpecialCategories.php | 1 + includes/specials/SpecialContributions.php | 10 +++++++ includes/specials/SpecialLinkSearch.php | 4 ++- includes/specials/SpecialSearch.php | 1 + includes/specials/SpecialSpecialpages.php | 1 + includes/specials/SpecialUpload.php | 38 +++++++++++++------------- includes/specials/SpecialVersion.php | 1 + 33 files changed, 253 insertions(+), 46 deletions(-) (limited to 'includes') diff --git a/includes/Article.php b/includes/Article.php index d3863c77..5edfc10d 100644 --- a/includes/Article.php +++ b/includes/Article.php @@ -792,6 +792,9 @@ class Article { return; } + # Allow frames by default + $wgOut->allowClickjacking(); + # Should the parser cache be used? $useParserCache = $this->useParserCache( $oldid ); wfDebug( 'Article::view using parser cache: ' . ( $useParserCache ? 'yes' : 'no' ) . "\n" ); @@ -1452,6 +1455,8 @@ class Article { ); if ( !$dbr->numRows( $tbs ) ) return; + $wgOut->preventClickjacking(); + $tbtext = ""; while ( $o = $dbr->fetchObject( $tbs ) ) { $rmvtxt = ""; diff --git a/includes/DefaultSettings.php b/includes/DefaultSettings.php index a369fccd..c118075e 100644 --- a/includes/DefaultSettings.php +++ b/includes/DefaultSettings.php @@ -33,7 +33,7 @@ if ( !defined( 'MW_PHP4' ) ) { } /** MediaWiki version number */ -$wgVersion = '1.16.0'; +$wgVersion = '1.16.1'; /** Name of the site. It must be changed in LocalSettings.php */ $wgSitename = 'MediaWiki'; @@ -2502,6 +2502,11 @@ $wgRightsUrl = null; $wgRightsText = null; $wgRightsIcon = null; +/** + * Set to an array of metadata terms. Else they will be loaded based on $wgRightsUrl + */ +$wgLicenseTerms = false; + /** Set this to some HTML to override the rights icon with an arbitrary logo */ $wgCopyrightIcon = null; @@ -3981,11 +3986,32 @@ $wgParserTestFiles = array( $wgParserTestRemote = false; /** - * Break out of framesets. This can be used to prevent external sites from - * framing your site with ads. + * Break out of framesets. This can be used to prevent clickjacking attacks, + * or to prevent external sites from framing your site with ads. */ $wgBreakFrames = false; +/** + * The X-Frame-Options header to send on pages sensitive to clickjacking + * attacks, such as edit pages. This prevents those pages from being displayed + * in a frame or iframe. The options are: + * + * - 'DENY': Do not allow framing. This is recommended for most wikis. + * + * - 'SAMEORIGIN': Allow framing by pages on the same domain. This can be used + * to allow framing within a trusted domain. This is insecure if there + * is a page on the same domain which allows framing of arbitrary URLs. + * + * - false: Allow all framing. This opens up the wiki to XSS attacks and thus + * full compromise of local user accounts. Private wikis behind a + * corporate firewall are especially vulnerable. This is not + * recommended. + * + * For extra safety, set $wgBreakFrames = true, to prevent framing on all pages, + * not just edit pages. + */ +$wgEditPageFrameOptions = 'DENY'; + /** * Set this to an array of special page names to prevent * maintenance/updateSpecialPages.php from updating those pages. diff --git a/includes/HTMLForm.php b/includes/HTMLForm.php index fddc887b..12687dc4 100644 --- a/includes/HTMLForm.php +++ b/includes/HTMLForm.php @@ -311,6 +311,9 @@ class HTMLForm { $this->displayErrors( $submitResult ); } + # For good measure (it is the default) + $wgOut->preventClickjacking(); + $html = '' . $this->mHeader . $this->getBody() diff --git a/includes/HistoryPage.php b/includes/HistoryPage.php index e515d3dd..8f5c2dda 100644 --- a/includes/HistoryPage.php +++ b/includes/HistoryPage.php @@ -166,6 +166,7 @@ class HistoryPage { $pager->getBody() . $pager->getNavigationBar() ); + $wgOut->preventClickjacking( $pager->getPreventClickjacking() ); wfProfileOut( __METHOD__ ); } @@ -301,6 +302,7 @@ class HistoryPage { class HistoryPager extends ReverseChronologicalPager { public $lastRow = false, $counter, $historyPage, $title, $buttons, $conds; protected $oldIdChecked; + protected $preventClickjacking = false; function __construct( $historyPage, $year='', $month='', $tagFilter = '', $conds = array() ) { parent::__construct(); @@ -382,6 +384,7 @@ class HistoryPager extends ReverseChronologicalPager { $this->buttons = '
'; if( $wgUser->isAllowed('deleterevision') ) { + $this->preventClickjacking(); $float = $wgContLang->alignEnd(); # Note bug #20966,