Legoktm has uploaded a new change for review.
https://gerrit.wikimedia.org/r/230988
Change subject: Disallow URLs that contain ports that aren't 80 or 443 by
default
......................................................................
Disallow URLs that contain ports that aren't 80 or 443 by default
Wikis can allow arbitrary ports (useful for test wikis which are on non-
standard ports) by setting $wgUrlShortenerAllowArbitraryPorts = true.
Bug: T108604
Change-Id: I757fe7b89f9f91f3e384fce28f00ec107c18351a
---
M README
M SpecialUrlShortener.php
M UrlShortener.utils.php
M extension.json
M i18n/en.json
M i18n/qqq.json
M modules/ext.urlShortener.special.js
7 files changed, 48 insertions(+), 13 deletions(-)
git pull ssh://gerrit.wikimedia.org:29418/mediawiki/extensions/UrlShortener
refs/changes/88/230988/1
diff --git a/README b/README
index 1f470f5..ade9412 100644
--- a/README
+++ b/README
@@ -36,6 +36,16 @@
$wgUrlShortenerDBName = false;
</source>
+=== Allow arbitrary ports ===
+
+By default, only URLs with ports 80 and 443 are accepted and are automatically
removed.
+If your wiki is set up using a custom port, set this to true to allow
shortening URLs
+that have arbitrary ports.
+
+<source lang="php">
+$wgUrlShortenerAllowArbitraryPorts = true
+</source>
+
=== Whitelist regex ===
Configures the acceptable domains that users can submit links for. This is an
diff --git a/SpecialUrlShortener.php b/SpecialUrlShortener.php
index 5547161..d37b265 100644
--- a/SpecialUrlShortener.php
+++ b/SpecialUrlShortener.php
@@ -45,12 +45,14 @@
* @param HTMLForm $form
*/
protected function alterForm( HTMLForm $form ) {
+ global $wgUrlShortenerAllowArbitraryPorts;
$form->setSubmitID( 'mw-urlshortener-submit' );
$form->setSubmitTextMsg( 'urlshortener-url-input-submit' );
$form->setFooterText(
$this->getApprovedDomainsMessage()->parse() );
$this->getOutput()->addModules( 'ext.urlShortener.special' );
$this->getOutput()->addJsConfigVars( array(
'wgUrlShortenerDomainsWhitelist' =>
UrlShortenerUtils::getWhitelistRegex(),
+ 'wgUrlShortenerAllowArbitraryPorts' =>
$wgUrlShortenerAllowArbitraryPorts,
) );
}
diff --git a/UrlShortener.utils.php b/UrlShortener.utils.php
index 33a03ad..8543900 100755
--- a/UrlShortener.utils.php
+++ b/UrlShortener.utils.php
@@ -174,10 +174,19 @@
* @return bool|Message true if it is valid, or error Message object if
invalid
*/
public static function validateUrl( $url ) {
+ global $wgUrlShortenerAllowArbitraryPorts;
+
$urlParts = wfParseUrl( $url );
if ( $urlParts === false ) {
return wfMessage( 'urlshortener-error-malformed-url' );
} else {
+ if ( isset( $urlParts['port'] ) &&
!$wgUrlShortenerAllowArbitraryPorts ) {
+ if ( $urlParts['port'] === 80 ||
$urlParts['port'] === 443 ) {
+ unset( $urlParts['port'] );
+ } else {
+ return wfMessage(
'urlshortener-error-badports' );
+ }
+ }
$domain = $urlParts['host'];
if ( preg_match( '/' . self::getWhitelistRegex() . '/',
$domain ) === 1 ) {
diff --git a/extension.json b/extension.json
index 24847da..3ec6709 100644
--- a/extension.json
+++ b/extension.json
@@ -55,6 +55,7 @@
"messages": [
"urlshortener-error-malformed-url",
"urlshortener-error-disallowed-url",
+ "urlshortener-error-badports",
"urlshortener-url-input-submit",
"urlshortener-url-input-submitting",
"urlshortener-shortened-url-label"
@@ -96,7 +97,8 @@
"UrlShortenerDomainsWhitelist": false,
"UrlShortenerIdSet":
"023456789ABCDEFGHJKLMNOPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz$-_.!",
"UrlShortenerServer": false,
- "UrlShortenerTemplate": false
+ "UrlShortenerTemplate": false,
+ "UrlShortenerAllowArbitraryPorts": false
},
"manifest_version": 1
}
diff --git a/i18n/en.json b/i18n/en.json
index f008684..688f06b 100644
--- a/i18n/en.json
+++ b/i18n/en.json
@@ -17,5 +17,6 @@
"urlshortener-error-disallowed-url": "URLs to domain $1 are not allowed
to be shortened",
"urlshortener-approved-domains": "Links to the following
{{PLURAL:$1|domain|domains}} may be shortened: $2.",
"urlshortener-ratelimit": "Please wait some time before shortening more
URLs.",
- "urlshortener-toolbox": "Get shortened URL"
+ "urlshortener-toolbox": "Get shortened URL",
+ "urlshortener-error-badports": "URLs that contain ports are not allowed
to be shortened"
}
diff --git a/i18n/qqq.json b/i18n/qqq.json
index 280c27b..60524da 100644
--- a/i18n/qqq.json
+++ b/i18n/qqq.json
@@ -18,5 +18,6 @@
"urlshortener-error-disallowed-url": "Message shown to user when they
try to shorten URLs to a domain that isn't whitelisted. $1 refers to the domain
of the URL that the user tried to shorten",
"urlshortener-approved-domains": "Help message displayed on
Special:UrlShortener showing which domains can be shortened. $1 is the number
of domains, $2 is a comma separated list of domains.",
"urlshortener-ratelimit": "Error message shown when a user shortens too
many urls in a short period of time",
- "urlshortener-toolbox": "Text of link in toolbox to get shortened URL"
+ "urlshortener-toolbox": "Text of link in toolbox to get shortened URL",
+ "urlshortener-error-badports": "Error message shown when the URL cannot
be shortened because it contains a port (e.g. http://example.org:90/path)"
}
diff --git a/modules/ext.urlShortener.special.js
b/modules/ext.urlShortener.special.js
index c169066..b2ef6c0 100644
--- a/modules/ext.urlShortener.special.js
+++ b/modules/ext.urlShortener.special.js
@@ -12,6 +12,11 @@
regex: new RegExp( mw.config.get(
'wgUrlShortenerDomainsWhitelist' ) ),
/**
+ * @var {boolean}
+ */
+ allowArbitraryPorts: mw.config.get(
'wgUrlShortenerAllowArbitraryPorts' ),
+
+ /**
* @var {OO.ui.TextInputWidget}
*/
shortened: null,
@@ -36,21 +41,26 @@
* returned by the API in case of error.
*/
validateInput: function ( input ) {
- var parsed, error, self = mw.urlshortener;
+ var parsed, error, self = mw.urlshortener,
+ showError = function( error ) {
+ self.input.setLabel( error );
+ return false;
+ };
try {
parsed = new mw.Uri( input );
- if ( parsed.host.match( self.regex ) ) {
- this.setLabel( null );
- return true;
- } else {
- error = mw.msg(
'urlshortener-error-disallowed-url', parsed.host );
- }
} catch ( e ) {
- error = mw.msg(
'urlshortener-error-malformed-url' );
+ return showError( mw.msg(
'urlshortener-error-malformed-url' ) );
+ }
+ if ( !parsed.host.match( self.regex ) ) {
+ return showError( mw.msg(
'urlshortener-error-disallowed-url', parsed.host ) );
+ }
+ if ( parsed.port && !self.allowArbitraryPorts
+ && !( parsed.port === '80' || parsed.port ===
'443' ) ) {
+ return showError( 'urlshortener-error-badports'
);
}
- this.setLabel( error );
- return false;
+ self.input.setLabel( null );
+ return true;
},
/**
--
To view, visit https://gerrit.wikimedia.org/r/230988
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: newchange
Gerrit-Change-Id: I757fe7b89f9f91f3e384fce28f00ec107c18351a
Gerrit-PatchSet: 1
Gerrit-Project: mediawiki/extensions/UrlShortener
Gerrit-Branch: master
Gerrit-Owner: Legoktm <[email protected]>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
