Skip to content
/ ErrorPages Public

Commit 89a007a

Browse files
SomeMWDevSomeMWDev
authored
Merge commit from fork
* Don't parse translations if they're used in attributes * Sanitize URLs in parsed links T14555
1 parent f78c7c6 commit 89a007a

File tree

6 files changed

+50
-30
lines changed

6 files changed

+50
-30
lines changed

‎404.php‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
require_once __DIR__ . '/getTranslations.php';
44

55
$getTranslation = 'getTranslation';
6+
$getParsedTranslation = 'getParsedTranslation';
67

78
header( 'Content-Type: text/html; charset=utf-8' );
89
header( 'Cache-Control: s-maxage=2678400, max-age=2678400' );
@@ -33,13 +34,13 @@
3334
</p>
3435
</a>
3536
</p>
36-
<h1><b>{$getTranslation( 'page-not-found' )}</b></h1>
37-
<p>{$getTranslation( 'page-not-found-more' )}</p>
37+
<h1><b>{$getParsedTranslation( 'page-not-found' )}</b></h1>
38+
<p>{$getParsedTranslation( 'page-not-found-more' )}</p>
3839
</div>
3940
</div>
4041
<div class="bottom-links">
41-
<a href="#" onClick="history.go(-1); return false;">&larr; {$getTranslation( 'wiki-not-found-goback' )}</a>
42-
<a href="/">{$getTranslation( 'page-not-found-mainpage' )}</a>
42+
<a href="#" onClick="history.go(-1); return false;">&larr; {$getParsedTranslation( 'wiki-not-found-goback' )}</a>
43+
<a href="/">{$getParsedTranslation( 'page-not-found-mainpage' )}</a>
4344
</div>
4445
</html>
4546
EOF;

‎DeletedWiki.php‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414

1515
$getLanguageCode = 'getLanguageCode';
1616
$getTranslation = 'getTranslation';
17+
$getParsedTranslation = 'getParsedTranslation';
1718

1819
header( 'Cache-control: no-cache' );
1920

@@ -139,17 +140,17 @@
139140
</g>
140141
</svg>
141142
</p>
142-
<h1><b>{$getTranslation( 'deletedwiki' )}</b></h1>
143-
<p class="lead">{$getTranslation( 'deletedwiki-body' )}</p>
143+
<h1><b>{$getParsedTranslation( 'deletedwiki' )}</b></h1>
144+
<p class="lead">{$getParsedTranslation( 'deletedwiki-body' )}</p>
144145
<p>
145-
<a href="https://meta.miraheze.org/wiki/Special:MyLanguage/Deleted_wikis" class="btn btn-lg btn-outline-primary" role="button">{$getTranslation( 'page-not-found-learnmore' )}</a>
146+
<a href="https://meta.miraheze.org/wiki/Special:MyLanguage/Deleted_wikis" class="btn btn-lg btn-outline-primary" role="button">{$getParsedTranslation( 'page-not-found-learnmore' )}</a>
146147
</p>
147148
</div>
148149
</div>
149150
<div class="bottom-links">
150-
<a href="#" onClick="history.go(-1); return false;">&larr; {$getTranslation( 'wiki-not-found-goback' )}</a>
151+
<a href="#" onClick="history.go(-1); return false;">&larr; {$getParsedTranslation( 'wiki-not-found-goback' )}</a>
151152
<a href="https://miraheze.org">Miraheze</a>
152-
<a href="https://meta.miraheze.org/wiki/Special:WikiDiscover">{$getTranslation( 'wiki-directory' )} &rarr;</a>
153+
<a href="https://meta.miraheze.org/wiki/Special:WikiDiscover">{$getParsedTranslation( 'wiki-directory' )} &rarr;</a>
153154
</div>
154155
</html>
155156
EOF;

‎MissingWiki.php‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -14,10 +14,13 @@
1414
} else {
1515
require_once __DIR__ . '/getTranslations.php';
1616

17-
$requestWikiUrl = 'https://meta.miraheze.org/wiki/Special:RequestWiki?wpsubdomain=' . substr($wgDBname, 0, -4);
17+
$escapedRequestWikiUrl = htmlspecialchars(
18+
'https://meta.miraheze.org/wiki/Special:RequestWiki?wpsubdomain=' . substr($wgDBname, 0, -4)
19+
);
1820

1921
$getLanguageCode = 'getLanguageCode';
2022
$getTranslation = 'getTranslation';
23+
$getParsedTranslation = 'getParsedTranslation';
2124

2225
http_response_code( 404 );
2326

@@ -143,17 +146,17 @@
143146
style="stroke-width:3.86688" />
144147
</svg>
145148
</p>
146-
<h1><b>{$getTranslation( 'missingwiki' )}</b></h1>
147-
<p class="lead">{$getTranslation( 'wiki-not-found' )}</p>
149+
<h1><b>{$getParsedTranslation( 'missingwiki' )}</b></h1>
150+
<p class="lead">{$getParsedTranslation( 'wiki-not-found' )}</p>
148151
<p>
149-
<a href="{$requestWikiUrl}" class="btn btn-lg btn-outline-primary" role="button">{$getTranslation( 'wiki-not-found-startwiki' )}</a>
152+
<a href="{$escapedRequestWikiUrl}" class="btn btn-lg btn-outline-primary" role="button">{$getParsedTranslation( 'wiki-not-found-startwiki' )}</a>
150153
</p>
151154
</div>
152155
</div>
153156
<div class="bottom-links">
154-
<a href="#" onClick="history.go(-1); return false;">&larr; {$getTranslation( 'wiki-not-found-goback' )}</a>
157+
<a href="#" onClick="history.go(-1); return false;">&larr; {$getParsedTranslation( 'wiki-not-found-goback' )}</a>
155158
<a href="https://miraheze.org">Miraheze</a>
156-
<a href="https://meta.miraheze.org/wiki/Special:WikiDiscover">{$getTranslation( 'wiki-directory' )} &rarr;</a>
159+
<a href="https://meta.miraheze.org/wiki/Special:WikiDiscover">{$getParsedTranslation( 'wiki-directory' )} &rarr;</a>
157160
</div>
158161
</html>
159162
EOF;

‎UnknownWiki.php‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44

55
$getLanguageCode = 'getLanguageCode';
66
$getTranslation = 'getTranslation';
7+
$getParsedTranslation = 'getParsedTranslation';
78

89
header( 'Cache-control: no-cache' );
910

@@ -136,18 +137,18 @@
136137
</g>
137138
</svg>
138139
</p>
139-
<h1><b>{$getTranslation( 'unknownwiki' )}</b></h1>
140-
<p class="lead">{$getTranslation( 'unknownwiki-body' )}</p>
140+
<h1><b>{$getParsedTranslation( 'unknownwiki' )}</b></h1>
141+
<p class="lead">{$getParsedTranslation( 'unknownwiki-body' )}</p>
141142
<p>
142-
<a href="https://meta.miraheze.org/wiki/Special:MyLanguage/Help_center" class="btn btn-lg btn-outline-primary" role="button">{$getTranslation( 'get-help' )}</a>
143-
<a href="https://meta.miraheze.org/wiki/Special:MyLanguage/Custom_domains" class="btn btn-lg btn-outline-info" role="button">{$getTranslation( 'custom-domain-instructions' )}</a>
143+
<a href="https://meta.miraheze.org/wiki/Special:MyLanguage/Help_center" class="btn btn-lg btn-outline-primary" role="button">{$getParsedTranslation( 'get-help' )}</a>
144+
<a href="https://meta.miraheze.org/wiki/Special:MyLanguage/Custom_domains" class="btn btn-lg btn-outline-info" role="button">{$getParsedTranslation( 'custom-domain-instructions' )}</a>
144145
</p>
145146
</div>
146147
</div>
147148
<div class="bottom-links">
148-
<a href="#" onClick="history.go(-1); return false;">&larr; {$getTranslation( 'wiki-not-found-goback' )}</a>
149+
<a href="#" onClick="history.go(-1); return false;">&larr; {$getParsedTranslation( 'wiki-not-found-goback' )}</a>
149150
<a href="https://miraheze.org">Miraheze</a>
150-
<a href="https://meta.miraheze.org/wiki/Special:WikiDiscover">{$getTranslation( 'wiki-directory' )} &rarr;</a>
151+
<a href="https://meta.miraheze.org/wiki/Special:WikiDiscover">{$getParsedTranslation( 'wiki-directory' )} &rarr;</a>
151152
</div>
152153
</html>
153154
EOF;

‎databaseMaintenance.php‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44

55
$getLanguageCode = 'getLanguageCode';
66
$getTranslation = 'getTranslation';
7+
$getParsedTranslation = 'getParsedTranslation';
78

89
http_response_code( 503 );
910

@@ -129,17 +130,17 @@
129130
style="fill:#3366cc" />
130131
</g>
131132
</svg>
132-
<h1><b>{$getTranslation( 'database-maintenance' )}</b></h1>
133-
<p class="lead">{$getTranslation( 'wiki-unscheduled-database-maintenance' )}</p>
133+
<h1><b>{$getParsedTranslation( 'database-maintenance' )}</b></h1>
134+
<p class="lead">{$getParsedTranslation( 'wiki-unscheduled-database-maintenance' )}</p>
134135
<p>
135-
<a href="https://miraheze.org/discord" class="btn btn-lg btn-outline-primary" role="button">{$getTranslation( 'database-maintenance-join-discord' )}</a>
136+
<a href="https://miraheze.org/discord" class="btn btn-lg btn-outline-primary" role="button">{$getParsedTranslation( 'database-maintenance-join-discord' )}</a>
136137
</p>
137138
<!--<small>Maintenance has been extended for this database cluster to 12:00 UTC, Monday, 19 December, 2022. Please check back soon.</small>-->
138139
</div>
139140
</div>
140141
<div class="bottom-links">
141-
<a href="#" onClick="history.go(-1); return false;">&larr; {$getTranslation( 'wiki-not-found-goback' )}</a>
142-
<!--<a href="https://meta.miraheze.org/wiki/Special:MyLanguage/Miraheze">{$getTranslation( 'wiki-not-found-meta' )}</a>-->
142+
<a href="#" onClick="history.go(-1); return false;">&larr; {$getParsedTranslation( 'wiki-not-found-goback' )}</a>
143+
<!--<a href="https://meta.miraheze.org/wiki/Special:MyLanguage/Miraheze">{$getParsedTranslation( 'wiki-not-found-meta' )}</a>-->
143144
</div>
144145
</html>
145146
EOF;

‎getTranslations.php‎

Lines changed: 17 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,23 @@ function getTranslation( $key ) {
55
return "({$key})";
66
}
77

8-
return preg_replace( '/\[(.*?)[\|| ](.*?)\]/', '<a href="$1">$2</a>',
9-
nl2br( htmlspecialchars(
10-
getLocalisation()[$key] ?? getFallback()[$key] ?? getDefault()[$key]
11-
) )
8+
return htmlspecialchars( getLocalisation()[$key] ?? getFallback()[$key] ?? getDefault()[$key] );
9+
}
10+
11+
function getParsedTranslation( $key ) {
12+
return preg_replace_callback(
13+
'/\[(.*?)[\|| ](.*?)\]/',
14+
function ( $matches ) {
15+
$url = $matches[1];
16+
$text = $matches[2];
17+
18+
if ( !preg_match( '#^(?:https?://|/)#', $url ) ) {
19+
return '<!--Invalid URL-->';
20+
}
21+
22+
return '<a href="' . $url . '">' . $text . '</a>';
23+
},
24+
nl2br( getTranslation( $key ) ),
1225
);
1326
}
1427

0 commit comments

Comments
 (0)