EditPage: Don't allow clients that mangle unicode to edit
authorMax Semenik <maxsem.wiki@gmail.com>
Mon, 28 Aug 2017 21:14:44 +0000 (14:14 -0700)
committerKunal Mehta <legoktm@member.fsf.org>
Thu, 21 Sep 2017 02:57:51 +0000 (19:57 -0700)
commit19b739bd19c437c5a637d85f431f139da7521508
treeca731281e9348488e92ca7d9a23c1b6a883d934d
parent2dd8c6efe97cfb38e13fab8f34bfd887f51b1877
EditPage: Don't allow clients that mangle unicode to edit

Get rid of the hack that turns unicode into hexadecimal codes for
browsers that don't support unicode, and prevent their edits entirely.

And instead of relying on $wgBrowserBlacklist, use a hidden HTML form
field - if the contents are mangled and don't match the original, then
reject the edit.

Bug: T67297
Change-Id: I20c2e396d7dfd6a3b23b94b218f94a847522576b
RELEASE-NOTES-1.30
includes/DefaultSettings.php
includes/EditPage.php
includes/api/ApiEditPage.php
languages/i18n/en.json
languages/i18n/qqq.json
tests/phpunit/includes/EditPageTest.php