mirror of
https://gerrit.wikimedia.org/r/mediawiki/extensions/VisualEditor
synced 2024-11-15 18:39:52 +00:00
514039b2ba
getLookupMenuItemsFromData() constructed a regex from user input without escaping. I don't *think* there are any injection vulnerabilities here but at the very least it triggers exceptions when the input is, say, a backslash. Instead, use .lastIndexOf() which allows us to efficiently check whether a string starts with a certain prefix. getLookupCacheItemFromData() was stripping out the Category: prefix using a regex that hardcoded Category: (so failed to detect localized prefixes) and used global replacement, which meant that strings with multiple occurrences of 'Category:' were handled incorrectly. Instead, use mw.Title to strip the prefix. Also move away from .map() because we may need to drop a result if it doesn't pass mw.Title validation. this.categoryPrefix still has a few legitimate uses left, so keep it around but set it to the localized namespace prefix rather than Category: Change-Id: I6547f9df2e94fe81f6aefb9286e547425137344b |
||
|---|---|---|
| .docs | ||
| demos | ||
| maintenance | ||
| modules | ||
| .csslintrc | ||
| .gitignore | ||
| .gitreview | ||
| .jshintignore | ||
| .jshintrc | ||
| ApiVisualEditor.php | ||
| AUTHORS.txt | ||
| CODING.md | ||
| Gruntfile.js | ||
| LICENSE.txt | ||
| package.json | ||
| README.txt | ||
| VisualEditor.hooks.php | ||
| VisualEditor.i18n.php | ||
| VisualEditor.php | ||
| VisualEditorMessagesModule.php | ||
VisualEditor provides a visual editor for wiki pages. It is written in JavaScript and runs in a web browser. It uses the Parsoid parser to convert wikitext documents to annotated HTML which the VisualEditor is able to load, modify and emit back to Parsoid at which point it is converted back into wikitext. For more information about these projects, check out the wiki: * http://www.mediawiki.org/wiki/VisualEditor * http://www.mediawiki.org/wiki/Parsoid