From 27d7bc2d376e45ead3e5ee75bf1a781096170a2c Mon Sep 17 00:00:00 2001
From: Pierre Schmitz <pierre@archlinux.de>
Date: Sat, 4 Oct 2014 10:10:15 +0200
Subject: Update to MediaWiki 1.22.12

---
 RELEASE-NOTES-1.22           |  8 +++++
 includes/DefaultSettings.php |  2 +-
 includes/OutputPage.php      | 73 +++++++++++++++++++++++++++-----------------
 3 files changed, 54 insertions(+), 29 deletions(-)

diff --git a/RELEASE-NOTES-1.22 b/RELEASE-NOTES-1.22
index 34ced35a..34292e1f 100644
--- a/RELEASE-NOTES-1.22
+++ b/RELEASE-NOTES-1.22
@@ -3,6 +3,14 @@
 Security reminder: MediaWiki does not require PHP's register_globals. If you
 have it on, turn it '''off''' if you can.
 
+== MediaWiki 1.22.12 ==
+
+This is a security release of the MediaWiki 1.22 branch.
+
+=== Changes since 1.22.11 ===
+* (bug 70672) SECURITY: OutputPage: Remove separation of css and js module
+  allowance.
+
 == MediaWiki 1.22.11 ==
 
 This is a security release of the MediaWiki 1.22 branch.
diff --git a/includes/DefaultSettings.php b/includes/DefaultSettings.php
index 1ec2ea35..84374c42 100644
--- a/includes/DefaultSettings.php
+++ b/includes/DefaultSettings.php
@@ -63,7 +63,7 @@ $wgConf = new SiteConfiguration;
  * MediaWiki version number
  * @since 1.2
  */
-$wgVersion = '1.22.11';
+$wgVersion = '1.22.12';
 
 /**
  * Name of the site. It must be changed in LocalSettings.php
diff --git a/includes/OutputPage.php b/includes/OutputPage.php
index 6bfba78b..363f2b62 100644
--- a/includes/OutputPage.php
+++ b/includes/OutputPage.php
@@ -151,12 +151,12 @@ class OutputPage extends ContextSource {
 
 	var $mFeedLinksAppendQuery = null;
 
-	# What level of 'untrustworthiness' is allowed in CSS/JS modules loaded on this page?
-	# @see ResourceLoaderModule::$origin
-	# ResourceLoaderModule::ORIGIN_ALL is assumed unless overridden;
-	protected $mAllowedModules = array(
-		ResourceLoaderModule::TYPE_COMBINED => ResourceLoaderModule::ORIGIN_ALL,
-	);
+	/**
+	 * @var int
+	 * The level of 'untrustworthiness' allowed for modules loaded on this page.
+	 * @see ResourceLoaderModule::$origin
+	 */
+	protected $mAllowedModuleOrigin = ResourceLoaderModule::ORIGIN_ALL;
 
 	/**
 	 * @EasterEgg I just love the name for this self documenting variable.
@@ -1271,14 +1271,13 @@ class OutputPage extends ContextSource {
 	}
 
 	/**
-	 * Do not allow scripts which can be modified by wiki users to load on this page;
-	 * only allow scripts bundled with, or generated by, the software.
+	 * Restrict the page to loading modules bundled the software.
+	 *
+	 * Disallows the queue to contain any modules which can be modified by wiki
+	 * users to load on this page.
 	 */
 	public function disallowUserJs() {
-		$this->reduceAllowedModules(
-			ResourceLoaderModule::TYPE_SCRIPTS,
-			ResourceLoaderModule::ORIGIN_CORE_INDIVIDUAL
-		);
+		$this->reduceAllowedModuleOrigin( ResourceLoaderModule::ORIGIN_CORE_INDIVIDUAL );
 	}
 
 	/**
@@ -1293,37 +1292,55 @@ class OutputPage extends ContextSource {
 	}
 
 	/**
-	 * Show what level of JavaScript / CSS untrustworthiness is allowed on this page
+	 * Get the level of JavaScript / CSS untrustworthiness allowed on this page.
+	 *
 	 * @see ResourceLoaderModule::$origin
-	 * @param string $type ResourceLoaderModule TYPE_ constant
+	 * @param string $type Unused: Module origin allowance used to be fragmented by
+	 *  ResourceLoaderModule TYPE_ constants.
 	 * @return Int ResourceLoaderModule ORIGIN_ class constant
 	 */
-	public function getAllowedModules( $type ) {
-		if ( $type == ResourceLoaderModule::TYPE_COMBINED ) {
-			return min( array_values( $this->mAllowedModules ) );
-		} else {
-			return isset( $this->mAllowedModules[$type] )
-				? $this->mAllowedModules[$type]
-				: ResourceLoaderModule::ORIGIN_ALL;
-		}
+	public function getAllowedModules( $type = null ) {
+		return $this->mAllowedModuleOrigin;
 	}
 
 	/**
 	 * Set the highest level of CSS/JS untrustworthiness allowed
+	 *
+	 * @deprecated since 1.24 Raising level of allowed untrusted content is no longer supported.
+	 *  Use reduceAllowedModuleOrigin() instead.
+	 *
 	 * @param  $type String ResourceLoaderModule TYPE_ constant
-	 * @param  $level Int ResourceLoaderModule class constant
+	 * @param int $level ResourceLoaderModule ORIGIN_ constant
 	 */
 	public function setAllowedModules( $type, $level ) {
-		$this->mAllowedModules[$type] = $level;
+		wfDeprecated( __METHOD__, '1.24' );
+		$this->reduceAllowedModuleOrigin( $level );
 	}
 
 	/**
-	 * As for setAllowedModules(), but don't inadvertently make the page more accessible
-	 * @param  $type String
-	 * @param  $level Int ResourceLoaderModule class constant
+	 * Limit the highest level of CSS/JS untrustworthiness allowed.
+	 *
+	 * @deprecated since 1.24 Module allowance is no longer fragmented by content type.
+	 *  Use reduceAllowedModuleOrigin() instead.
+	 *
+	 * @param string $type ResourceLoaderModule TYPE_ constant
+	 * @param int $level ResourceLoaderModule ORIGIN_ class constant
 	 */
 	public function reduceAllowedModules( $type, $level ) {
-		$this->mAllowedModules[$type] = min( $this->getAllowedModules( $type ), $level );
+		wfDeprecated( __METHOD__, '1.24' );
+		$this->reduceAllowedModuleOrigin( $level );
+	}
+
+	/**
+	 * Limit the highest level of CSS/JS untrustworthiness allowed.
+	 *
+	 * If passed the same or a higher level than the current level of untrustworthiness set, the
+	 * level will remain unchanged.
+	 *
+	 * @param int $level ResourceLoaderModule class constant
+	 */
+	public function reduceAllowedModuleOrigin( $level ) {
+		$this->mAllowedModuleOrigin = min( $this->mAllowedModuleOrigin, $level );
 	}
 
 	/**
-- 
cgit v1.2.3-54-g00ecf