MS Office creates vulnerabilities also, per comment on r72890.

[lhc/web/wiklou.git] / includes / OutputPage.php

diff --git a/includes/OutputPage.php b/includes/OutputPage.php
index 93f245f..b8d99b8 100644 (file)
--- a/includes/OutputPage.php
+++ b/includes/OutputPage.php
@@ -2283,19 +2283,44 @@ class OutputPage {
        static function makeResourceLoaderLink( $skin, $modules, $only ) {
                global $wgUser, $wgLang, $wgRequest, $wgLoadScript;
                // TODO: Should this be a static function of ResourceLoader instead?
+               // TODO: Divide off modules starting with "user", and add the user parameter to them
                $query = array(
-                       'modules' => implode( '|', array_unique( (array) $modules ) ),
                        'lang' => $wgLang->getCode(),
-                       'debug' => $wgRequest->getBool( 'debug' ) && $wgRequest->getVal( 'debug' ) !== 'false',
+                       'debug' => ( $wgRequest->getBool( 'debug' ) && $wgRequest->getVal( 'debug' ) == 'true' ) ? 'true' : 'false',
                        'skin' => $wgUser->getSkin()->getSkinName(),
                        'only' => $only,
                );
-               // Automatically select style/script elements
-               if ( $only === 'styles' ) {
-                       return Html::linkedStyle( wfAppendQuery( $wgLoadScript, $query ) );
-               } else {
-                       return Html::linkedScript( wfAppendQuery( $wgLoadScript, $query ) );
+               $moduleGroups = array( null => array(), 'user' => array() );
+               foreach ( (array) $modules as $name ) {
+                       $moduleGroups[strpos( $name, 'user' ) === 0 ? 'user' : null][] = $name;
+               }
+               $links = '';
+               foreach ( $moduleGroups as $group => $modules ) {
+                       if ( count( $modules ) ) {
+                               sort( $modules );
+                               $query['modules'] = implode( '|', array_unique( (array) $modules ) );
+                               if ( $group === 'user' ) {
+                                       $query['user'] = $wgUser->getName();
+                               }
+                               $context = new ResourceLoaderContext( new FauxRequest( $query ) );
+                               $timestamp = 0;
+                               foreach ( $modules as $name ) {
+                                       if ( $module = ResourceLoader::getModule( $name ) ) {
+                                               $timestamp = max( $timestamp, $module->getModifiedTime( $context ) );
+                                       }
+                               }
+                               $query['version'] = wfTimestamp( TS_ISO_8601, round( $timestamp, -2 ) );
+                               // Make queries uniform in order
+                               ksort( $query );
+                               // Automatically select style/script elements
+                               if ( $only === 'styles' ) {
+                                       $links .= Html::linkedStyle( wfAppendQuery( $wgLoadScript, $query ) );
+                               } else {
+                                       $links .= Html::linkedScript( wfAppendQuery( $wgLoadScript, $query ) );
+                               }
+                       }
                }
+               return $links;
        }
        
        /**
@@ -2307,14 +2332,14 @@ class OutputPage {
         * @return String: HTML fragment
         */
        function getHeadScripts( Skin $sk ) {
-               global $wgUser, $wgRequest, $wgJsMimeType;
+               global $wgUser, $wgRequest;
                global $wgUseSiteJs;
                
                // Statup - this will immediately load jquery and mediawiki modules
                $scripts = self::makeResourceLoaderLink( $sk, 'startup', 'scripts' );
                
-               // Configuration -- this could be merged together with the load and go, but makeGlobalVariablesScript returns a
-               // whole script tag -- grumble grumble
+               // Configuration -- This could be merged together with the load and go, but makeGlobalVariablesScript returns a
+               // whole script tag -- grumble grumble...
                $scripts .= Skin::makeGlobalVariablesScript( $sk->getSkinName() ) . "\n";
                
                // Script and Messages "only"
@@ -2346,7 +2371,6 @@ class OutputPage {
                        );
                }
                
-               // TODO: User Scripts should be included using the resource loader
                // Add user JS if enabled
                if( $this->isUserJsAllowed() && $wgUser->isLoggedIn() ) {
                        $action = $wgRequest->getVal( 'action', 'view' );
@@ -2354,14 +2378,7 @@ class OutputPage {
                                # XXX: additional security check/prompt?
                                $this->addInlineScript( $wgRequest->getText( 'wpTextbox1' ) );
                        } else {
-                               $userpage = $wgUser->getUserPage();
-                               foreach( array( 'common', $sk->getSkinName() ) as $name ) {
-                                       $scriptpage = Title::makeTitleSafe( NS_USER, $userpage->getDBkey() . '/' . $name . '.js' );
-                                       if ( $scriptpage && $scriptpage->exists() && ( $scriptpage->getLength() > 0 ) ) {
-                                               $userjs = $scriptpage->getLocalURL( 'action=raw&ctype=' . $wgJsMimeType );
-                                               $this->addScriptFile( $userjs, $scriptpage->getLatestRevID() );
-                                       }
-                               }
+                               $scripts .= self::makeResourceLoaderLink( $sk, 'user', 'scripts' );
                        }
                }
                $scripts .= "\n" . $this->mScripts;