Start cracking down on illegal titles: in UTF-8 mode reject titles which have had...

Moved the PATH_INFO check from index.php into WebRequest; it now just shoves the param into $_REQUEST['title'].

diff --git a/includes/Title.php b/includes/Title.php
index 22c1870..e262c5a 100644 (file)
--- a/includes/Title.php
+++ b/includes/Title.php
@@ -4,6 +4,8 @@
  *
  */
 
+require_once( 'normal/UtfNormal.php' );
+
 /**
  *
  */
@@ -709,6 +711,13 @@ class Title {
                        wfProfileOut( $fname );
                        return false;
                }
+               
+               global $wgUseLatin1;
+               if( !$wgUseLatin1 &&  false !== strpos( $t, UTF8_REPLACEMENT, $t ) ) {
+                       # Contained illegal UTF-8 sequences or forbidden Unicode chars.
+                       wfProfileOut( $fname );
+                       return false;
+               }
 
                $this->mDbkeyform = $t;
                $done = false;

diff --git a/includes/WebRequest.php b/includes/WebRequest.php
index 20f2c3e..1cf6928 100644 (file)
--- a/includes/WebRequest.php
+++ b/includes/WebRequest.php
@@ -28,6 +28,11 @@
 class WebRequest {
        function WebRequest() {
                $this->checkMagicQuotes();
+               global $wgUsePathInfo;
+               if( isset( $_SERVER['PATH_INFO'] ) && $wgUsePathInfo ) {
+                       # Stuff it!
+                       $_REQUEST['title'] = substr( $_SERVER['PATH_INFO'], 1 );
+               }
                global $wgUseLatin1;
                if( !$wgUseLatin1 ) {
                        require_once( 'normal/UtfNormal.php' );
@@ -64,7 +69,7 @@ class WebRequest {
                        if( is_array( $val ) ) {
                                $this->normalizeUnicode( $arr[$key ] );
                        } else {
-                               $arr[$key] = UtfNormal::toNFC( $val );
+                               $arr[$key] = UtfNormal::cleanUp( $val );
                        }
                }
        }

diff --git a/index.php b/index.php
index 8f60e00..411fec2 100644 (file)
--- a/index.php
+++ b/index.php
@@ -25,16 +25,7 @@ OutputPage::setEncodings(); # Not really used yet
 
 # Query string fields
 $action = $wgRequest->getVal( "action", "view" );
-
-if( isset( $_SERVER['PATH_INFO'] ) && $wgUsePathInfo ) {
-       $title = substr( $_SERVER['PATH_INFO'], 1 );
-       if( !$wgUseLatin1 ) {
-               require_once( 'includes/normal/UtfNormal.php' );
-               $title = UtfNormal::toNFC( $title );
-       }
-} else {
-       $title = $wgRequest->getVal( "title" );
-}
+$title = $wgRequest->getVal( "title" );
 
 # Placeholders in case of DB error
 $wgTitle = Title::newFromText( wfMsg( "badtitle" ) );