Brian Wolff has uploaded a new change for review.
https://gerrit.wikimedia.org/r/150048
Change subject: [DO NOT MERGE] Relax filter attribute filtering to allow
self-referential urls
......................................................................
[DO NOT MERGE] Relax filter attribute filtering to allow self-referential urls
The filter attribute will often have things like filter="url( #foo )"
These local to the file filters in svgs should be fine (We already
disallow non-local xlink:href attributes on <filter> elements). In
fact, users can already do the exact same thing by doing:
style="filter: url( #foo )"
Marked "DO NOT MERGE" until CSteipp gives the go-ahead.
Bug: 67044
Change-Id: Ib25328c160c0d5ea7e01dc84616b76e1b9dcd0eb
---
M includes/upload/UploadBase.php
1 file changed, 1 insertion(+), 1 deletion(-)
git pull ssh://gerrit.wikimedia.org:29418/mediawiki/core
refs/changes/48/150048/1
diff --git a/includes/upload/UploadBase.php b/includes/upload/UploadBase.php
index 5defd45..cb76e5d 100644
--- a/includes/upload/UploadBase.php
+++ b/includes/upload/UploadBase.php
@@ -1483,7 +1483,7 @@
# image filters can pull in url, which could be svg
that executes scripts
if ( $strippedElement == 'image'
&& $stripped == 'filter'
- && preg_match( '!url\s*\(!sim', $value )
+ && preg_match( '!url\s*\(\s*["\']?\s*[^#]!sim',
$value )
) {
wfDebug( __METHOD__ . ": Found image filter
with url: "
. "\"<$strippedElement
$stripped='$value'...\" in uploaded file.\n" );
--
To view, visit https://gerrit.wikimedia.org/r/150048
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: newchange
Gerrit-Change-Id: Ib25328c160c0d5ea7e01dc84616b76e1b9dcd0eb
Gerrit-PatchSet: 1
Gerrit-Project: mediawiki/core
Gerrit-Branch: master
Gerrit-Owner: Brian Wolff <bawolff...@gmail.com>
_______________________________________________
MediaWiki-commits mailing list
MediaWiki-commits@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
