MediaWiki 1.16.3

[autoinstallsdev/mediawiki.git] / includes / WebRequest.php

diff --git a/includes/WebRequest.php b/includes/WebRequest.php
index b6d6d27afc3c59e7c7a531cd2c40ad2afb5a9e1d..8a0ef48bf51fb9cf7ca1843f7914cd2214e0e18a 100644 (file)
--- a/includes/WebRequest.php
+++ b/includes/WebRequest.php
@@ -688,10 +688,27 @@ class WebRequest {
         * but only by prefixing it with the script name and maybe some other stuff,
         * the extension is not mangled. So this should be a reasonably portable
         * way to perform this security check.
+        *
+        * Also checks for anything that looks like a file extension at the end of
+        * QUERY_STRING, since IE 6 and earlier will use this to get the file type
+        * if there was no dot before the question mark (bug 28235).
         */
        public function isPathInfoBad() {
                global $wgScriptExtension;
 
+               if ( isset( $_SERVER['QUERY_STRING'] ) 
+                       && preg_match( '/\.[a-z]{1,4}$/i', $_SERVER['QUERY_STRING'] ) )
+               {
+                       // Bug 28235
+                       // Block only Internet Explorer, and requests with missing UA 
+                       // headers that could be IE users behind a privacy proxy.
+                       if ( !isset( $_SERVER['HTTP_USER_AGENT'] ) 
+                               || preg_match( '/; *MSIE/', $_SERVER['HTTP_USER_AGENT'] ) )
+                       {
+                               return true;
+                       }
+               }
+
                if ( !isset( $_SERVER['PATH_INFO'] ) ) {
                        return false;
                }