Page MenuHomePhabricator

mediawiki doesn't allow "%ab" as page name, but does allow "%ft" or "%a"
Closed, InvalidPublic

Description

Author: debian

Description:
Forwarded bug from Ubuntu.


Binary package hint: mediawiki

mediawiki blocked %[a-f][a-f] only, that's confusing

if these names will lead to problems, you'd better block "%" entirely for better understanding.
and i don't know what are the problems. it doesn't appears to be any problems since all links to the name "%ft%rs" works well. if there are, those should be bugs.

if these names will not lead to problems, why should you have such a limit? remove it.


Version: 1.15.x
Severity: enhancement

Details

Reference
bz24258

Event Timeline

bzimport raised the priority of this task from to Medium.Nov 21 2014, 10:59 PM
bzimport set Reference to bz24258.
bzimport added a subscriber: Unknown Object (MLST).

http://www.mediawiki.org/wiki/%ab - works, though because it's not valid UTF-8 it gets converted to « according to content language's fallback encoding.

http://www.mediawiki.org/wiki/%ft - "Bad Request" by Apache
http://www.mediawiki.org/w/index.php?title=%ft - works, though because %ft is not a valid URL-encoded sequence, it gets eventually converted to %25ft

same thing with %a

I see no problem with MediaWiki, just Apache/rewrite rules.

This is the correct behavior, since we only block "%[0-9A-Fa-f]{2}" to not conflict with URL escaping sequences (includes/Title.php line 2420 in trunk).

debian wrote:

So to clarify, this behaviour is by design? Is it likely to be left like that or changed in future?

Bryan.TongMinh wrote:

This behaviour is by design indeed.