From d9022f63880ce039446fba8364f68e656b7bf4cb Mon Sep 17 00:00:00 2001
From: Pierre Schmitz <pierre@archlinux.de>
Date: Thu, 3 May 2012 13:01:35 +0200
Subject: Update to MediaWiki 1.19.0

---
 includes/libs/IEUrlExtension.php | 58 +++++++++++++++++++++-------------------
 1 file changed, 31 insertions(+), 27 deletions(-)

(limited to 'includes/libs/IEUrlExtension.php')

diff --git a/includes/libs/IEUrlExtension.php b/includes/libs/IEUrlExtension.php
index 100454d4..e00e6663 100644
--- a/includes/libs/IEUrlExtension.php
+++ b/includes/libs/IEUrlExtension.php
@@ -1,31 +1,31 @@
 <?php
 
 /**
- * Internet Explorer derives a cache filename from a URL, and then in certain 
- * circumstances, uses the extension of the resulting file to determine the 
- * content type of the data, ignoring the Content-Type header. 
+ * Internet Explorer derives a cache filename from a URL, and then in certain
+ * circumstances, uses the extension of the resulting file to determine the
+ * content type of the data, ignoring the Content-Type header.
  *
  * This can be a problem, especially when non-HTML content is sent by MediaWiki,
  * and Internet Explorer interprets it as HTML, exposing an XSS vulnerability.
  *
- * Usually the script filename (e.g. api.php) is present in the URL, and this 
+ * Usually the script filename (e.g. api.php) is present in the URL, and this
  * makes Internet Explorer think the extension is a harmless script extension.
- * But Internet Explorer 6 and earlier allows the script extension to be 
- * obscured by encoding the dot as "%2E". 
+ * But Internet Explorer 6 and earlier allows the script extension to be
+ * obscured by encoding the dot as "%2E".
  *
- * This class contains functions which help in detecting and dealing with this 
+ * This class contains functions which help in detecting and dealing with this
  * situation.
  *
- * Checking the URL for a bad extension is somewhat complicated due to the fact 
+ * Checking the URL for a bad extension is somewhat complicated due to the fact
  * that CGI doesn't provide a standard method to determine the URL. Instead it
- * is necessary to pass a subset of $_SERVER variables, which we then attempt 
+ * is necessary to pass a subset of $_SERVER variables, which we then attempt
  * to use to guess parts of the URL.
  */
 class IEUrlExtension {
 	/**
 	 * Check a subset of $_SERVER (or the whole of $_SERVER if you like)
-	 * to see if it indicates that the request was sent with a bad file 
-	 * extension. Returns true if the request should be denied or modified, 
+	 * to see if it indicates that the request was sent with a bad file
+	 * extension. Returns true if the request should be denied or modified,
 	 * false otherwise. The relevant $_SERVER elements are:
 	 *
 	 *   - SERVER_SOFTWARE
@@ -37,6 +37,7 @@ class IEUrlExtension {
 	 *
 	 * @param $vars A subset of $_SERVER.
 	 * @param $extWhitelist Extensions which are allowed, assumed harmless.
+	 * @return bool
 	 */
 	public static function areServerVarsBad( $vars, $extWhitelist = array() ) {
 		// Check QUERY_STRING or REQUEST_URI
@@ -55,7 +56,7 @@ class IEUrlExtension {
 			return true;
 		}
 
-		// Some servers have PATH_INFO but not REQUEST_URI, so we check both 
+		// Some servers have PATH_INFO but not REQUEST_URI, so we check both
 		// to be on the safe side.
 		if ( isset( $vars['PATH_INFO'] )
 			&& self::isUrlExtensionBad( $vars['PATH_INFO'], $extWhitelist ) )
@@ -71,7 +72,7 @@ class IEUrlExtension {
 	 * Given a right-hand portion of a URL, determine whether IE would detect
 	 * a potentially harmful file extension.
 	 *
-	 * @param $urlPart The right-hand portion of a URL
+	 * @param $urlPart string The right-hand portion of a URL
 	 * @param $extWhitelist An array of file extensions which may occur in this
 	 *    URL, and which should be allowed.
 	 * @return bool
@@ -97,10 +98,10 @@ class IEUrlExtension {
 		}
 
 		if ( !preg_match( '/^[a-zA-Z0-9_-]+$/', $extension ) ) {
-			// Non-alphanumeric extension, unlikely to be registered. 
+			// Non-alphanumeric extension, unlikely to be registered.
 			//
 			// The regex above is known to match all registered file extensions
-			// in a default Windows XP installation. It's important to allow 
+			// in a default Windows XP installation. It's important to allow
 			// extensions with ampersands and percent signs, since that reduces
 			// the number of false positives substantially.
 			return false;
@@ -111,8 +112,11 @@ class IEUrlExtension {
 	}
 
 	/**
-	 * Returns a variant of $url which will pass isUrlExtensionBad() but has the 
+	 * Returns a variant of $url which will pass isUrlExtensionBad() but has the
 	 * same GET parameters, or false if it can't figure one out.
+	 * @param $url
+	 * @param $extWhitelist array
+	 * @return bool|string
 	 */
 	public static function fixUrlForIE6( $url, $extWhitelist = array() ) {
 		$questionPos = strpos( $url, '?' );
@@ -127,7 +131,7 @@ class IEUrlExtension {
 			$query = substr( $url, $questionPos + 1 );
 		}
 
-		// Multiple question marks cause problems. Encode the second and 
+		// Multiple question marks cause problems. Encode the second and
 		// subsequent question mark.
 		$query = str_replace( '?', '%3E', $query );
 		// Append an invalid path character so that IE6 won't see the end of the
@@ -153,16 +157,16 @@ class IEUrlExtension {
 	 * insecure.
 	 *
 	 * The criteria for finding an extension are as follows:
-	 * - a possible extension is a dot followed by one or more characters not 
+	 * - a possible extension is a dot followed by one or more characters not
 	 *   in <>\"/:|?.#
-	 * - if we find a possible extension followed by the end of the string or 
+	 * - if we find a possible extension followed by the end of the string or
 	 *   a #, that's our extension
 	 * - if we find a possible extension followed by a ?, that's our extension
-	 *    - UNLESS it's exe, dll or cgi, in which case we ignore it and continue 
+	 *    - UNLESS it's exe, dll or cgi, in which case we ignore it and continue
 	 *      searching for another possible extension
-	 * - if we find a possible extension followed by a dot or another illegal 
+	 * - if we find a possible extension followed by a dot or another illegal
 	 *   character, we ignore it and continue searching
-	 * 
+	 *
 	 * @param $url string URL
 	 * @return mixed Detected extension (string), or false if none found
 	 */
@@ -182,7 +186,7 @@ class IEUrlExtension {
 				// End of string, we're done
 				return false;
 			}
-			
+
 			// We found a dot. Skip past it
 			$pos++;
 			$remainingLength = $urlLength - $pos;
@@ -220,12 +224,12 @@ class IEUrlExtension {
 	 * with %2E not decoded to ".". On such a server, it is possible to detect
 	 * whether the script filename has been obscured.
 	 *
-	 * The function returns false if the server is not known to have this 
+	 * The function returns false if the server is not known to have this
 	 * behaviour. Microsoft IIS in particular is known to decode escaped script
 	 * filenames.
 	 *
 	 * SERVER_SOFTWARE typically contains either a plain string such as "Zeus",
-	 * or a specification in the style of a User-Agent header, such as 
+	 * or a specification in the style of a User-Agent header, such as
 	 * "Apache/1.3.34 (Unix) mod_ssl/2.8.25 OpenSSL/0.9.8a PHP/4.4.2"
 	 *
 	 * @param $serverSoftware
@@ -234,8 +238,8 @@ class IEUrlExtension {
 	 */
 	public static function haveUndecodedRequestUri( $serverSoftware ) {
 		static $whitelist = array(
-			'Apache', 
-			'Zeus', 
+			'Apache',
+			'Zeus',
 			'LiteSpeed' );
 		if ( preg_match( '/^(.*?)($|\/| )/', $serverSoftware, $m ) ) {
 			return in_array( $m[1], $whitelist );
-- 
cgit v1.2.3-54-g00ecf