dépôts / lhc / web / wiklou.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 7e4a134) | patch
SECURITY: Don't use m modifier when checking link prefix
authorcsteipp <csteipp@wikimedia.org>
Thu, 7 Jan 2016 16:13:16 +0000 (08:13 -0800)
committerChad Horohoe <chadh@wikimedia.org>
Fri, 20 May 2016 16:47:45 +0000 (09:47 -0700)
commitfdc70074bbe9cec0e83a2ef512c356861e60dc88
tree29c3311b36030ffc0deb4fb5bc42473bf888760etree | snapshot
parent7e4a134f49d05c93c70968d238671b680922b79ccommit | diff
SECURITY: Don't use m modifier when checking link prefix

SVG filter incorrectly used the m modifier when checking if an href
attribute started with 'https?://', incorrectly matching attributes
such as, "javascript:alert('&#10;http://foo')".

Bug: T122653
Change-Id: I41291fff344241cad3171f3e8050de99b62a2296

Signed-off-by: Chad Horohoe <chadh@wikimedia.org>
includes/upload/UploadBase.php diff | blob | history
tests/phpunit/includes/upload/UploadBaseTest.php diff | blob | history
Wiklou, le Wiki du Wiklou