Merge "phpunit: Avoid use of deprecated getMock for PHPUnit 5 compat"

[lhc/web/wiklou.git] / includes / OutputPage.php

diff --git a/includes/OutputPage.php b/includes/OutputPage.php
index 9ecfa23..5380264 100644 (file)
--- a/includes/OutputPage.php
+++ b/includes/OutputPage.php
@@ -1568,6 +1568,7 @@ class OutputPage extends ContextSource {
                        // been changed somehow, and keep it if so.
                        $anonPO = ParserOptions::newFromAnon();
                        $anonPO->setEditSection( false );
+                       $anonPO->setAllowUnsafeRawHtml( false );
                        if ( !$options->matches( $anonPO ) ) {
                                wfLogWarning( __METHOD__ . ': Setting a changed bogus ParserOptions: ' . wfGetAllCallers( 5 ) );
                                $options->isBogus = false;
@@ -1581,6 +1582,7 @@ class OutputPage extends ContextSource {
                                // either.
                                $po = ParserOptions::newFromAnon();
                                $po->setEditSection( false );
+                               $po->setAllowUnsafeRawHtml( false );
                                $po->isBogus = true;
                                if ( $options !== null ) {
                                        $this->mParserOptions = empty( $options->isBogus ) ? $options : null;
@@ -1590,6 +1592,7 @@ class OutputPage extends ContextSource {
 
                        $this->mParserOptions = ParserOptions::newFromContext( $this->getContext() );
                        $this->mParserOptions->setEditSection( false );
+                       $this->mParserOptions->setAllowUnsafeRawHtml( false );
                }
 
                if ( $options !== null && !empty( $options->isBogus ) ) {
@@ -2724,7 +2727,9 @@ class OutputPage extends ContextSource {
                } else {
                        $titleObj = Title::newFromText( $returnto );
                }
-               if ( !is_object( $titleObj ) ) {
+               // We don't want people to return to external interwiki. That
+               // might potentially be used as part of a phishing scheme
+               if ( !is_object( $titleObj ) || $titleObj->isExternal() ) {
                        $titleObj = Title::newMainPage();
                }