diff options
Diffstat (limited to 'includes')
| -rw-r--r-- | includes/DefaultSettings.php | 2 | ||||
| -rw-r--r-- | includes/Sanitizer.php | 14 |
2 files changed, 15 insertions, 1 deletions
diff --git a/includes/DefaultSettings.php b/includes/DefaultSettings.php index bba8c6dc3811..ffb26c194be9 100644 --- a/includes/DefaultSettings.php +++ b/includes/DefaultSettings.php @@ -18,7 +18,7 @@ if( !defined( 'MEDIAWIKI' ) ) { } /** MediaWiki version number */ -$wgVersion = '1.5alpha1'; +$wgVersion = '1.5alpha2'; /** Name of the site. It must be changed in LocalSettings.php */ $wgSitename = 'MediaWiki'; diff --git a/includes/Sanitizer.php b/includes/Sanitizer.php index 40016d93b2d1..9f05ed87cd86 100644 --- a/includes/Sanitizer.php +++ b/includes/Sanitizer.php @@ -539,6 +539,20 @@ class Sanitizer { continue; } + # Templates and links may be expanded in later parsing, + # creating invalid or dangerous output. Suppress this. + $value = strtr( $value, array( + '{' => '{', + '[' => '[', + "''" => '''', + 'ISBN' => 'ISBN', + 'RFC' => 'RFC', + 'PMID' => 'PMID', + ) ); + $value = preg_replace( + '/(' . URL_PROTOCOLS . '):/', + '\\1:', $value ); + if( !isset( $attribs[$attribute] ) ) { $attribs[$attribute] = "$attribute=\"$value\""; } |