Last modified: 2014-07-07 05:43:58 UTC

Wikimedia Bugzilla is closed!

Wikimedia migrated from Bugzilla to Phabricator. Bug reports are handled in Wikimedia Phabricator.
This static website is read-only and for historical purposes. It is not possible to log in and except for displaying bug reports and their history, links might be broken. See T68568, the corresponding Phabricator task for complete and up-to-date bug report information.
Bug 66568 - Exploit Skinning System by setting a skins name to the currently active skin
Exploit Skinning System by setting a skins name to the currently active skin
Status: RESOLVED INVALID
Product: MediaWiki
Classification: Unclassified
Interface (Other open bugs)
1.23.0
All All
: Unprioritized major (vote)
: ---
Assigned To: Nobody - You can work on this!
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2014-06-13 04:30 UTC by deanator71
Modified: 2014-07-07 05:43 UTC (History)
3 users (show)

See Also:
Web browser: ---
Mobile Platform: ---
Assignee Huggle Beta Tester: ---


Attachments

Description deanator71 2014-06-13 04:30:15 UTC
When I use the default skin vector and create a new skin with the name 'mvector' with the base skin file named 'MVector.php' and set it's $skinname property to 'vector' I can replace the default skin vector without having to go to localsettings.php and change the default skin.

This was my test skin (MVector.php):


if( !defined( 'MEDIAWIKI' ) )
	die( -1 );

//$wgExtensionMessagesFiles['MVector'] = dirname(__FILE__).'/mvector/i18n.php';


/**
 * Inherit main code from SkinTemplate, set the CSS and template filter.
 * @ingroup Skins
 */
class SkinMVector extends SkinVector {
	var $skinname = 'vector', $stylename = 'vector',
		$template = 'VectorTemplate', $useHeadElement = true;
	

	public function initPage( OutputPage $out ) {
		parent::initPage( $out );
		
		global $wgStylePath;
		global $wgScriptPath;
		
		$out->addHTML("<script src='".$wgStylePath."/mvector/MVector.js"."' type='text/javascript'></script>");
		// Add meta information to optimise for mobile sites
		$out->addMeta("viewport", "width=device-width; initial-scale=1.0; maximum-scale=1.0; user-scalable=no;");
		$out->addMeta("wgscript", "".$wgScriptPath."");
	}
	
	
	
	
	
	function setupSkinUserCss( OutputPage $out ) {
		parent::setupSkinUserCss( $out );

		//$out->addModuleStyles( 'skins.mvector' );
		
		$out->addStyle( 'mvector/styles/vector-min.css', 'screen' );
		//$out->addStyle( 'mvector/print.css', 'print' );
		
		$out->addStyle( 'mvector/ie8fixes.css', 'screen','lte IE 8' );
	}
}

/**
 * BaseTemplate class for MVector skin
 * @ingroup Skins
 */
class MVectorTemplate extends VectorTemplate {
 
	/**
	 * Outputs the entire contents of the page
	 */
	public function execute() {
		parent::execute();
	}
 
}
Comment 1 deanator71 2014-06-13 04:33:35 UTC
I recently found out that when i changed the skin line in LocalSettings.php to vector it showed the default skin vector
Comment 2 Andre Klapper 2014-06-13 10:02:29 UTC
What exactly is the problem created by this?
Comment 3 Andre Klapper 2014-07-06 22:13:31 UTC
deanator71: What exactly is the problem created by this?
Comment 4 Kunal Mehta (Legoktm) 2014-07-06 22:16:34 UTC
(In reply to deanator71 from comment #0)
> When I use the default skin vector and create a new skin with the name
> 'mvector' with the base skin file named 'MVector.php' and set it's $skinname
> property to 'vector' I can replace the default skin vector without having to
> go to localsettings.php and change the default skin.


> class SkinMVector extends SkinVector {
> 	var $skinname = 'vector', $stylename = 'vector',

If your skin isn't named vector, you shouldn't be doing this.
Comment 5 deanator71 2014-07-07 05:43:58 UTC
That wasn't actually a bug, I was using my other test skin when my LocalSettings.php's skin type was set to my own skin. Sorry about that.

Note You need to log in before you can comment on or make changes to this bug.


Navigation
Links