HomePhorge

GlobalFunctions: Remove check for MEDIAWIKI constant

This commit no longer exists in the repository. It may have been part of a branch which was deleted.

Description

GlobalFunctions: Remove check for MEDIAWIKI constant

This was added in r19841 (5b487b32c0f488bd) to patch a file inclusion
vulnerability introduced in r19835 (baaee13afceb192e). The vulnerability
was that the global variable $IP, possibly attacker-controlled due to
register_globals, was used to construct paths to PHP files to include.

The require_once statements are no longer present in the file, and
register_globals is no longer something we need to be concerned about,
as PHP 5.3 and earlier have been unsupported for years. There is also
no file-scope code in the file (only use statements and functions).

Use of $IP in code has also fallen out of favor; see cf581bb2ca9ca37d,
bedd996fe63b754e, and 4f4f283d1d3ac23a. And finally, it is unlikely
that include statements or other potentially dangerous file-scope code
will again be added to this file, given that any additional files could
be included from Setup.php after 41ea7e2fefff6513 and 8b7bafec2185b66b.

Change-Id: I7508892c0ba41901f7c0f03cacfb9c9a9c40a400
(cherry picked from commit fd7fe3abcf6d24c1e0abe35bef4a25f997807e64)

Details

Provenance
Kevin Israel <pleasestand@live.com>Authored on Jan 11 2023, 10:21 AM
Reedy <reedy@wikimedia.org>Committed on Thu, Feb 23, 11:17 AM

Event Timeline

Reedy <reedy@wikimedia.org> committed rMW20c96a9b2aea: GlobalFunctions: Remove check for MEDIAWIKI constant (authored by Kevin Israel <pleasestand@live.com>).Thu, Feb 23, 11:17 AM

Commit No Longer Exists

This commit no longer exists in the repository.