Recommit SpecialPage.php and SpecialPageFactory.php parts of r89406 (removal of magic...

[lhc/web/wiklou.git] / api.php

diff --git a/api.php b/api.php
index 978e8d4..7fff048 100644 (file)
--- a/api.php
+++ b/api.php
@@ -61,18 +61,7 @@ wfProfileIn( 'api.php' );
 $starttime = microtime( true );
 
 // URL safety checks
-//
-// See RawPage.php for details; summary is that MSIE can override the
-// Content-Type if it sees a recognized extension on the URL, such as
-// might be appended via PATH_INFO after 'api.php'.
-//
-// Some data formats can end up containing unfiltered user-provided data
-// which will end up triggering HTML detection and execution, hence
-// XSS injection and all that entails.
-//
-if ( $wgRequest->isPathInfoBad() ) {
-       wfHttpError( 403, 'Forbidden',
-               'Invalid file extension found in PATH_INFO or QUERY_STRING.' );
+if ( !$wgRequest->checkUrlExtension() ) {
        return;
 }