Create $wgAllowImageTag to whitelist <img>

I could have reused $wgAllowExternalImages, but that's . . . rather
ugly.  It makes some external links mysteriously behave differently, and
of course doesn't allow setting attributes.

diff --git a/RELEASE-NOTES b/RELEASE-NOTES
index 915b17c..04c06ba 100644 (file)
--- a/RELEASE-NOTES
+++ b/RELEASE-NOTES
@@ -23,6 +23,7 @@ it from source control: http://www.mediawiki.org/wiki/Download_from_SVN
   extensions has been removed.
 * $wgLogAutocreatedAccounts controls whether autocreation of accounts is logged
   to new users log.
+* $wgAllowImageTag can be set to true to whitelist the <img> tag in wikitext.
 
 === New features in 1.17 ===
 * (bug 10183) Users can now add personal styles and scripts to all skins via

diff --git a/includes/DefaultSettings.php b/includes/DefaultSettings.php
index 6ffe45c..803930e 100644 (file)
--- a/includes/DefaultSettings.php
+++ b/includes/DefaultSettings.php
@@ -1909,6 +1909,16 @@ $wgAllowExternalImagesFrom = '';
  */
 $wgEnableImageWhitelist = true;
 
+/**
+ * A different approach to the above: simply allow the <img> tag to be used.
+ * This allows you to specify alt text and other attributes, copy-paste HTML to
+ * your wiki more easily, etc.  However, allowing external images in any manner
+ * will allow anyone with editing rights to snoop on your visitors' IP
+ * addresses and so forth, if they wanted to, by inserting links to images on
+ * sites they control.
+ */
+$wgAllowImageTag = false;
+
 /** Allows to move images and other media files */
 $wgAllowImageMoving = true;
 

diff --git a/includes/Sanitizer.php b/includes/Sanitizer.php
index 01cd5b9..35908b9 100644 (file)
--- a/includes/Sanitizer.php
+++ b/includes/Sanitizer.php
@@ -389,6 +389,12 @@ class Sanitizer {
                                'li',
                        );
 
+                       global $wgAllowImageTag;
+                       if ( $wgAllowImageTag ) {
+                               $htmlsingle[] = 'img';
+                               $htmlsingleonly[] = 'img';
+                       }
+
                        $htmlsingleallowed = array_unique( array_merge( $htmlsingle, $tabletags ) );
                        $htmlelementsStatic = array_unique( array_merge( $htmlsingle, $htmlpairsStatic, $htmlnest ) );
 
@@ -1403,8 +1409,9 @@ class Sanitizer {
 
                        # 13.2
                        # Not usually allowed, but may be used for extension-style hooks
-                       # such as <math> when it is rasterized
-                       'img'        => array_merge( $common, array( 'alt' ) ),
+                       # such as <math> when it is rasterized, or if $wgAllowImageTag is
+                       # true
+                       'img'        => array_merge( $common, array( 'alt', 'src' ) ),
 
                        # 15.2.1
                        'tt'         => $common,