https://bugzilla.wikimedia.org/show_bug.cgi?id=66568
Bug ID: 66568
Summary: Exploit Skinning System by setting a skins name to the
currently active skin
Product: MediaWiki
Version: 1.23.0
Hardware: All
OS: All
Status: UNCONFIRMED
Severity: major
Priority: Unprioritized
Component: Skin and page rendering
Assignee: [email protected]
Reporter: [email protected]
CC: [email protected], [email protected]
Web browser: ---
Mobile Platform: ---
When I use the default skin vector and create a new skin with the name
'mvector' with the base skin file named 'MVector.php' and set it's $skinname
property to 'vector' I can replace the default skin vector without having to go
to localsettings.php and change the default skin.
This was my test skin (MVector.php):
if( !defined( 'MEDIAWIKI' ) )
die( -1 );
//$wgExtensionMessagesFiles['MVector'] = dirname(__FILE__).'/mvector/i18n.php';
/**
* Inherit main code from SkinTemplate, set the CSS and template filter.
* @ingroup Skins
*/
class SkinMVector extends SkinVector {
var $skinname = 'vector', $stylename = 'vector',
$template = 'VectorTemplate', $useHeadElement = true;
public function initPage( OutputPage $out ) {
parent::initPage( $out );
global $wgStylePath;
global $wgScriptPath;
$out->addHTML("<script src='".$wgStylePath."/mvector/MVector.js"."'
type='text/javascript'></script>");
// Add meta information to optimise for mobile sites
$out->addMeta("viewport", "width=device-width; initial-scale=1.0;
maximum-scale=1.0; user-scalable=no;");
$out->addMeta("wgscript", "".$wgScriptPath."");
}
function setupSkinUserCss( OutputPage $out ) {
parent::setupSkinUserCss( $out );
//$out->addModuleStyles( 'skins.mvector' );
$out->addStyle( 'mvector/styles/vector-min.css', 'screen' );
//$out->addStyle( 'mvector/print.css', 'print' );
$out->addStyle( 'mvector/ie8fixes.css', 'screen','lte IE 8' );
}
}
/**
* BaseTemplate class for MVector skin
* @ingroup Skins
*/
class MVectorTemplate extends VectorTemplate {
/**
* Outputs the entire contents of the page
*/
public function execute() {
parent::execute();
}
}
--
You are receiving this mail because:
You are the assignee for the bug.
You are on the CC list for the bug.
_______________________________________________
Wikibugs-l mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/wikibugs-l
