Skip to content

Commit

Permalink
Update CanonURL.php
Browse files Browse the repository at this point in the history
Fixing a security issue
  • Loading branch information
Abhi-M committed Mar 14, 2013
1 parent eb54e6b commit 6faa256
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions CanonURL.php
Expand Up @@ -39,10 +39,10 @@ function CanonURL($out)
{
global $CanonBaseURL;
global $wgRequest;
$pg_title = $wgRequest->getVal( 'title' );
$pg_title = urlencode($wgRequest->getVal( 'title' ));
$out->addHeadItem( 'canonical',
'<link rel="canonical" href="'.$CanonBaseURL.$pg_title.'" />'."\n"

);
return true;
}
}

1 comment on commit 6faa256

@Krinkle
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This does not output a canonical url, it will urlencode any wiki-friendly characters such as space to %20 instead of _ and encode slashes.

As a result it will output urls that are potentially a 301 redirect (if MediaWiki auto-corrects) and even if it doesn't, it will never be the url that everything points to.

Use wfUrlencode instead, or better yet, Title::getCanonicalURL. See #4.

Please sign in to comment.