mirror of
https://github.com/Universal-Omega/PortableInfobox.git
synced 2024-11-15 03:35:53 +00:00
c006c42035
A security fix from MW core added quotes to the Parser's strip tag markers in order to prevent an XSS vulnerability. When this was deployed PIs and our Wikia tag extensions broke in Mercury because ArticlesAsJson JSON encodes the parser output in the ParserAfterTidy, but then PI and the tag extensions were manually replacing the Parser tag strip markers on the already JSON encoded string within their own ParserAfterTidy methods (which were always run after the ArticlesAsJson method). This meant that the strip marker had the quote escaped with a backslash in the encoded string, so the string replacements failed. This change follows the previous quick and dirty fix by moving the replacements in PI and the tag extensions to just before ArticlesAsJson encodes the output. Which also removes the need from before the fix in #10701 to JSON encode the parser output of the tags that will be replaced into the text. |
||
|---|---|---|
| controllers | ||
| js | ||
| maintenance | ||
| querypage | ||
| services | ||
| styles | ||
| templates | ||
| tests | ||
| crowdin.conf | ||
| PortableInfobox.i18n.php | ||
| PortableInfobox.setup.php | ||
| PortableInfoboxHooks.class.php | ||