https://bugzilla.wikimedia.org/show_bug.cgi?id=63445
--- Comment #3 from Chris Steipp <[email protected]> --- I'm still working on the review, but a couple of comments: In includes/TemplateHelper.php * getTemplateFilenames() should check for directory traversal * progressiveEnhancement() should escape $insertionType and $sectionId * Can you whitelist function names in pipelist, eachPost? * diffRevision: update @param comments to indicate diffContent isn't escaped * Seems like addReturnTo shouldn't setup the parameters if the request was a POST * flow_block_header.handlebars and flow_block_header_single_view.handlebars assume revision.content is safe html. flow_preview.handlebars assumes content is safe. It's hard to find where I can prove that-- maybe add a comment in the template to where that is generated, so it's easy to check the correctness? * form_element's setting the {{tag}} seems like it could be abused. Maybe adding a comment that it really shouldn't be used except in FlowHandlebars.prototype.formElement, and having the default in the switch raise an exception or reset tag to a sane value? -- You are receiving this mail because: You are on the CC list for the bug. _______________________________________________ Wikibugs-l mailing list [email protected] https://lists.wikimedia.org/mailman/listinfo/wikibugs-l
