https://www.mediawiki.org/wiki/Special:Code/MediaWiki/112534
Revision: 112534
Author: catrope
Date: 2012-02-27 22:41:20 +0000 (Mon, 27 Feb 2012)
Log Message:
-----------
In ResourceLoaderContext, normalize invalid skin names to $wgDefaultSkin . This
should help a lot with the pollution of the module_deps table, which is
currently littered with invalid skin names from people trying to hack the site.
I found 3,897 (!!) distinct values for md_skin
Sample from the query result:
| md_module | md_skin |
|-----------------------------|----------------------------------|
| ext.vector.collapsibleNav | vector' |
| ext.vector.collapsibleNav | vector' and 1=1-- |
| ext.vector.collapsibleNav | vector' and 1=2-- |
| ext.vector.collapsibleNav | vector')waitfor delay'0:0:20'-- |
| ext.vector.collapsibleNav | vector',0)waitfor delay'0:0:20'- |
| ext.vector.collapsibleNav | vector',0,0)waitfor delay'0:0:20 |
| ext.vector.collapsibleNav | vector',0,0,0)waitfor delay'0:0: |
| ext.vector.collapsibleNav | vector'waitfor delay'0:0:20'-- |
| ext.vector.collapsibleNav | vector../../../../../../../../.. |
[...]
| ext.vector.sectionEditLinks | vector<script src= |
| ext.vector.sectionEditLinks | vector?.tri.co.id/ |
| ext.vector.sectionEditLinks | vector??id=jCustomerWAPProv |
| ext.vector.sectionEditLinks | vector??id=wap.mauj.com.... |
| ext.vector.sectionEditLinks | vector?id=202.87.41.147.... |
| ext.vector.sectionEditLinks | vector?java |
| ext.vector.sectionEditLinks | vector?m.vuclip.com/ |
| ext.vector.sectionEditLinks | vector?toyota.co.id |
| ext.vector.sectionEditLinks | vectorGET |
| ext.vector.sectionEditLinks | vector]]>> |
| ext.vector.sectionEditLinks | vector`ping -c 20 127.0.0.1` |
| ext.vector.sectionEditLinks | vector|echo 9e7f7fd5750593ab cef |
| ext.vector.sectionEditLinks | vector|ping -c 20 127.0.0.1||x |
Modified Paths:
--------------
trunk/phase3/includes/resourceloader/ResourceLoaderContext.php
Modified: trunk/phase3/includes/resourceloader/ResourceLoaderContext.php
===================================================================
--- trunk/phase3/includes/resourceloader/ResourceLoaderContext.php
2012-02-27 22:33:14 UTC (rev 112533)
+++ trunk/phase3/includes/resourceloader/ResourceLoaderContext.php
2012-02-27 22:41:20 UTC (rev 112534)
@@ -63,7 +63,9 @@
$this->only = $request->getVal( 'only' );
$this->version = $request->getVal( 'version' );
- if ( !$this->skin ) {
+ $skinnames = Skin::getSkinNames();
+ // If no skin is specified, or we don't recognize the skin, use
the default skin
+ if ( !$this->skin || !isset( $skinnames[$this->skin] ) ) {
$this->skin = $wgDefaultSkin;
}
}
_______________________________________________
MediaWiki-CVS mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-cvs
