X-Git-Url: https://git.heureux-cyclage.org/?a=blobdiff_plain;f=includes%2FTemplateParser.php;h=924c347aa53f537b19e714e8a241cc64c13fc0d3;hb=005a128c0f9da54734074d71b3bf84636f6d9c44;hp=a1e6d5b5a7126e12b1a7a86391cf22a036b5ad71;hpb=bdfe02223205923d923923dd420ba0dd863cd0fe;p=lhc%2Fweb%2Fwiklou.git

diff --git a/includes/TemplateParser.php b/includes/TemplateParser.php
index a1e6d5b5a7..924c347aa5 100644
--- a/includes/TemplateParser.php
+++ b/includes/TemplateParser.php
@@ -1,4 +1,6 @@
 <?php
+use MediaWiki\MediaWikiServices;
+
 /**
  * Handles compiling Mustache templates into PHP rendering functions
  *
@@ -52,18 +54,11 @@ class TemplateParser {
 	 * @throws UnexpectedValueException If $templateName attempts upwards directory traversal
 	 */
 	protected function getTemplateFilename( $templateName ) {
-		// Prevent upwards directory traversal using same methods as Title::secureAndSplit
+		// Prevent path traversal. Based on Language::isValidCode().
+		// This is for paranoia. The $templateName should never come from
+		// untrusted input.
 		if (
-			strpos( $templateName, '.' ) !== false &&
-			(
-				$templateName === '.' || $templateName === '..' ||
-				strpos( $templateName, './' ) === 0 ||
-				strpos( $templateName, '../' ) === 0 ||
-				strpos( $templateName, '/./' ) !== false ||
-				strpos( $templateName, '/../' ) !== false ||
-				substr( $templateName, -2 ) === '/.' ||
-				substr( $templateName, -3 ) === '/..'
-			)
+			strcspn( $templateName, ":/\\\000&<>'\"%" ) !== strlen( $templateName )
 		) {
 			throw new UnexpectedValueException( "Malformed \$templateName: $templateName" );
 		}
@@ -98,7 +93,7 @@ class TemplateParser {
 		$fastHash = md5( $fileContents );
 
 		// Fetch a secret key for building a keyed hash of the PHP code
-		$config = ConfigFactory::getDefaultInstance()->makeConfig( 'main' );
+		$config = MediaWikiServices::getInstance()->getMainConfig();
 		$secretKey = $config->get( 'SecretKey' );
 
 		if ( $secretKey ) {