MS Office creates vulnerabilities also, per comment on r72890.

[lhc/web/wiklou.git] / includes / OutputPage.php

diff --git a/includes/OutputPage.php b/includes/OutputPage.php
index c22882b..b8d99b8 100644 (file)
--- a/includes/OutputPage.php
+++ b/includes/OutputPage.php
@@ -2286,21 +2286,32 @@ class OutputPage {
                // TODO: Divide off modules starting with "user", and add the user parameter to them
                $query = array(
                        'lang' => $wgLang->getCode(),
-                       'debug' => $wgRequest->getBool( 'debug' ) && $wgRequest->getVal( 'debug' ) !== 'false',
+                       'debug' => ( $wgRequest->getBool( 'debug' ) && $wgRequest->getVal( 'debug' ) == 'true' ) ? 'true' : 'false',
                        'skin' => $wgUser->getSkin()->getSkinName(),
                        'only' => $only,
                );
                $moduleGroups = array( null => array(), 'user' => array() );
-               foreach ( (array) $modules as $module ) {
-                       $moduleGroups[strpos( $module, 'user' ) === 0 ? 'user' : null][] = $module;
+               foreach ( (array) $modules as $name ) {
+                       $moduleGroups[strpos( $name, 'user' ) === 0 ? 'user' : null][] = $name;
                }
                $links = '';
                foreach ( $moduleGroups as $group => $modules ) {
                        if ( count( $modules ) ) {
+                               sort( $modules );
                                $query['modules'] = implode( '|', array_unique( (array) $modules ) );
                                if ( $group === 'user' ) {
                                        $query['user'] = $wgUser->getName();
                                }
+                               $context = new ResourceLoaderContext( new FauxRequest( $query ) );
+                               $timestamp = 0;
+                               foreach ( $modules as $name ) {
+                                       if ( $module = ResourceLoader::getModule( $name ) ) {
+                                               $timestamp = max( $timestamp, $module->getModifiedTime( $context ) );
+                                       }
+                               }
+                               $query['version'] = wfTimestamp( TS_ISO_8601, round( $timestamp, -2 ) );
+                               // Make queries uniform in order
+                               ksort( $query );
                                // Automatically select style/script elements
                                if ( $only === 'styles' ) {
                                        $links .= Html::linkedStyle( wfAppendQuery( $wgLoadScript, $query ) );
@@ -2321,7 +2332,7 @@ class OutputPage {
         * @return String: HTML fragment
         */
        function getHeadScripts( Skin $sk ) {
-               global $wgUser, $wgRequest, $wgJsMimeType;
+               global $wgUser, $wgRequest;
                global $wgUseSiteJs;
                
                // Statup - this will immediately load jquery and mediawiki modules
@@ -2360,7 +2371,6 @@ class OutputPage {
                        );
                }
                
-               // TODO: User Scripts should be included using the resource loader
                // Add user JS if enabled
                if( $this->isUserJsAllowed() && $wgUser->isLoggedIn() ) {
                        $action = $wgRequest->getVal( 'action', 'view' );
@@ -2368,14 +2378,7 @@ class OutputPage {
                                # XXX: additional security check/prompt?
                                $this->addInlineScript( $wgRequest->getText( 'wpTextbox1' ) );
                        } else {
-                               $userpage = $wgUser->getUserPage();
-                               foreach( array( 'common', $sk->getSkinName() ) as $name ) {
-                                       $scriptpage = Title::makeTitleSafe( NS_USER, $userpage->getDBkey() . '/' . $name . '.js' );
-                                       if ( $scriptpage && $scriptpage->exists() && ( $scriptpage->getLength() > 0 ) ) {
-                                               $userjs = $scriptpage->getLocalURL( 'action=raw&ctype=' . $wgJsMimeType );
-                                               $this->addScriptFile( $userjs, $scriptpage->getLatestRevID() );
-                                       }
-                               }
+                               $scripts .= self::makeResourceLoaderLink( $sk, 'user', 'scripts' );
                        }
                }
                $scripts .= "\n" . $this->mScripts;