https://bugzilla.wikimedia.org/show_bug.cgi?id=32611
Web browser: ---
Bug #: 32611
Summary: SemanticForms: Invalid input leads to fatal error.
Product: MediaWiki extensions
Version: any
Platform: All
OS/Version: All
Status: NEW
Severity: normal
Priority: Unprioritized
Component: SemanticForms
AssignedTo: [email protected]
ReportedBy: [email protected]
CC: [email protected]
Classification: Unclassified
A HTTP request with the following query string:
title=Special:FormEdit&Form=SomeForm&target=xxx%7B
causes
Fatal error: Call to a member function getPrefixedText() on a non-object in
/var/www/ocw/mediawiki-1.17.1/extensions/SemanticForms/specials/SF_FormEdit.php
on line 361
Not a big deal, because target page name is invalid, but it is kind of security
issue -- code should control input to avoid crashes. It would be more better to
show error page and say "`xxx{' is not a valid page title."
--
Configure bugmail: https://bugzilla.wikimedia.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.
_______________________________________________
Wikibugs-l mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/wikibugs-l
