Fix register_globals vulnerability checked in last week.

diff --git a/includes/DefaultSettings.php b/includes/DefaultSettings.php
index 133ab55..55d758e 100644 (file)
--- a/includes/DefaultSettings.php
+++ b/includes/DefaultSettings.php
@@ -678,12 +678,13 @@ $wgUseRCPatrol = true;
 # If you rename it, then you can access them through the new namespace name.
 #
 # Custom namespaces should start at 100.
-#$wgExtraNamespaces= 
-#      array(100 => "Hilfe", 
+#$wgExtraNamespaces =
+#      array(100 => "Hilfe",
 #            101 => "Hilfe_Diskussion",
-#            102 =>"Aide", 
-#            103 =>"Discussion_Aide"
+#            102 => "Aide",
+#            103 => "Discussion_Aide"
 #            );
+$wgExtraNamespaces = NULL;
 
 # Enable SOAP interface. Off by default
 # SOAP is a protocoll for remote procedure calls (RPC) using http as middleware.

diff --git a/includes/Namespace.php b/includes/Namespace.php
index 43f0d78..a52e06d 100644 (file)
--- a/includes/Namespace.php
+++ b/includes/Namespace.php
@@ -34,8 +34,8 @@ $wgCanonicalNamespaceNames = array(
        NS_CATEGORY_TALK    => 'Category_talk'
 );
 
-if(isset($wgExtraNamespaces)) {
-       $wgCanonicalNamespaceNames=$wgCanonicalNamespaceNames+$wgExtraNamespaces;
+if( defined( 'MEDIAWIKI' ) && is_array( $wgExtraNamespaces ) ) {
+       $wgCanonicalNamespaceNames = $wgCanonicalNamespaceNames + $wgExtraNamespaces;
 }
 
 /**