Disable $wgServer autodetection to prevent cache poisoning attacks

[lhc/web/wiklou.git] / includes / installer / Installer.php

diff --git a/includes/installer/Installer.php b/includes/installer/Installer.php
index 091f93b..f84b974 100644 (file)
--- a/includes/installer/Installer.php
+++ b/includes/installer/Installer.php
@@ -1823,6 +1823,10 @@ abstract class Installer {
 
                // Don't try to use any object cache for SessionManager either.
                $GLOBALS['wgSessionCacheType'] = CACHE_NONE;
+
+               // Set a dummy $wgServer to bypass the check in Setup.php, the
+               // web installer will automatically detect it and not use this value.
+               $GLOBALS['wgServer'] = 'https://🌻.invalid';
        }
 
        /**