bastique.bz wrote:

Example: http://en.wikipedia.org/wiki/Castlebar

This is caused by the fix to bug 2304, which is a major security vulnerability.

Allowing validated plaintext template/parameter substitutions in HTML attribute values with our
current parser architecture is theoretically possible, but will take some work to ensure that it
remains safe.

Also broken by this:
http://en.wikipedia.org/wiki/Template:Ref
http://en.wikipedia.org/wiki/Template:Note

I've done some work on this bug but need to check it over a bit to make sure I haven't reintroduced a vulnerability,
particularly on the 1.4 backport (where the HTML attribute validation code is pretty crappy). Will try to finish it up
tonight.

lowzl wrote:

I recently upgraded my MediaWiki installation to 1.4.5 - we've experienced this
problem on precisely one template at the moment. I suppose it is because no one
has edited the other ones using this technique yet.

Curiously, {{subst:xyz}} works, but {{xyz}} uses the inclusion guard.

Fix applied to CVS HEAD. Still working on REL1_4.

Fix applied to REL1_4 as well (Parser.php).

lowzl wrote:

Is there a specific patch we can apply now, or will there be a new release of
1.4 soon?

I can't release a 1.4.6 just now as there's an issue with upgrades and an unnecessary
but performance-enhancing index.

Here's the change for REL1_4:
http://cvs.sourceforge.net/viewcvs.py/wikipedia/phase3/includes/Parser.php?
r1=1.357.2.49&r2=1.357.2.50&diff_format=u

zigger wrote:

*** Bug 2743 has been marked as a duplicate of this bug. ***

zigger wrote:

1.4.6 has been released.
Release notes: https://sourceforge.net/project/shownotes.php?release_id=340290
Downloads: https://sourceforge.net/project/showfiles.php?group_id=34373