SECURITY: Disallow loading JS/CSS/Json subpages from unregistered users and log

[lhc/web/wiklou.git] / includes / Linker.php

diff --git a/includes/Linker.php b/includes/Linker.php
index 9f6d34e..5fc5eb1 100644 (file)
--- a/includes/Linker.php
+++ b/includes/Linker.php
@@ -894,24 +894,12 @@ class Linker {
                $classes = 'mw-userlink';
                $page = null;
                if ( $userId == 0 ) {
-                       $pos = strpos( $userName, '>' );
-                       if ( $pos !== false ) {
-                               $iw = explode( ':', substr( $userName, 0, $pos ) );
-                               $firstIw = array_shift( $iw );
-                               $interwikiLookup = MediaWikiServices::getInstance()->getInterwikiLookup();
-                               if ( $interwikiLookup->isValidInterwiki( $firstIw ) ) {
-                                       $title = MWNamespace::getCanonicalName( NS_USER ) . ':' . substr( $userName, $pos + 1 );
-                                       if ( $iw ) {
-                                               $title = join( ':', $iw ) . ':' . $title;
-                                       }
-                                       $page = Title::makeTitle( NS_MAIN, $title, '', $firstIw );
-                               }
+                       $page = ExternalUserNames::getUserLinkTitle( $userName );
+
+                       if ( ExternalUserNames::isExternal( $userName ) ) {
                                $classes .= ' mw-extuserlink';
-                       } else {
-                               $page = SpecialPage::getTitleFor( 'Contributions', $userName );
-                               if ( $altUserName === false ) {
-                                       $altUserName = IP::prettifyIP( $userName );
-                               }
+                       } elseif ( $altUserName === false ) {
+                               $altUserName = IP::prettifyIP( $userName );
                        }
                        $classes .= ' mw-anonuserlink'; // Separate link class for anons (T45179)
                } else {
@@ -948,7 +936,7 @@ class Linker {
                $blockable = !( $flags & self::TOOL_LINKS_NOBLOCK );
                $addEmailLink = $flags & self::TOOL_LINKS_EMAIL && $userId;
 
-               if ( $userId == 0 && strpos( $userText, '>' ) !== false ) {
+               if ( $userId == 0 && ExternalUserNames::isExternal( $userText ) ) {
                        // No tools for an external user
                        return '';
                }
@@ -1764,9 +1752,10 @@ class Linker {
                $dbr = wfGetDB( DB_REPLICA );
 
                // Up to the value of $wgShowRollbackEditCount revisions are counted
+               $revQuery = Revision::getQueryInfo();
                $res = $dbr->select(
-                       'revision',
-                       [ 'rev_user_text', 'rev_deleted' ],
+                       $revQuery['tables'],
+                       [ 'rev_user_text' => $revQuery['fields']['rev_user_text'], 'rev_deleted' ],
                        // $rev->getPage() returns null sometimes
                        [ 'rev_page' => $rev->getTitle()->getArticleID() ],
                        __METHOD__,
@@ -1774,7 +1763,8 @@ class Linker {
                                'USE INDEX' => [ 'revision' => 'page_timestamp' ],
                                'ORDER BY' => 'rev_timestamp DESC',
                                'LIMIT' => $wgShowRollbackEditCount + 1
-                       ]
+                       ],
+                       $revQuery['joins']
                );
 
                $editCount = 0;