Extension:Cinderella

From MediaWiki.org

Jump to: navigation, search
Zeichen 206.svg WARNING: the code or configuration described here poses a major security risk.

Problem: Arbitrary HTML can be inserted into any wiki page
Solution: properly escape $argv['width'], $argv['height'] and $input. Not sure what values are valid for $input, therefore I can't fix the code myself (it seems like some HTML needs to be allowed from $input, so the filtering needs to be more finegrained than just using htmlspecialchars())
Signed: Tbleher 13:52, 8 May 2008 (UTC)


         

Manual on MediaWiki Extensions
List of MediaWiki Extensions
Crystal Clear action run.png
Cinderella

Release status: beta
Implementation  Tag
Description Embeds Cinderella files (cdy) into wiki pages using the cinderella.jar applet
Author(s)  Russel Philip (RusselTalk)
Last Version  0.1
MediaWiki  tested on 1.11
License No license specified
Download Extension:Cinderella#Code

check usage (experimental)

Contents

[edit] What can this extension do?

Embeds Cinderella files(cdy), previously uploaded into the wiki, into wiki pages using the cinderella.jar that comes with Cinderella

[edit] What is Cinderella?

Cinderella's official description is "interactive geometry software", but in practice it is much more. It is a powerful mathematics simulation environment the includes simple physics and a programming language CindyScript that can be used to create complex, and even interactive, mathematical constructions.

[edit] Usage

<cinderella width=XXX height=YYY filename=MyCinderellaFile.cdy>
  <param />
</cinderella>

[edit] Concerning <param />

As kindly noted above, the current implementation passes the <param/> content directly though to the body of the generated <applet> tag, which is a huge security no-no. I hope to find the time to find a clean and secure way to filter the rather large amount of parameters the need to be copied from the exported Cinderella construction.

[edit] Download instructions

Please cut and paste the code found below and place it in $IP/extensions/Cinderella/cinderella.php. Note: $IP stands for the root directory of your MediaWiki installation, the same directory that holds LocalSettings.php.

[edit] Installation

  1. From Cinderella, copy the cinderella.jar file to the extensions/Cinderella/ folder.
  2. Add the following to LocalSettings.php:
require_once("$IP/extensions/Cinderella/cinderella.php");

[edit] Code

<?php
/**
 * MediaWiki Cinderella extension
 * Usage 
 * <cinderella width=XXX height=YYY filename=MyCinderellaFile.cdy>
 *   <param />
 * </cinderella>
 *
 * @author Russel Philip
 * @version 0.1
 * @link http://www.mediawiki.org/wiki/Extension:Cinderella
 */
 
$wgExtensionFunctions[] = 'wfCinderella';
$wgExtensionCredits['parserhook'][] = array(
        'name' => 'Cinderella',
        'description' => 'Embeds Cinedrella files (cdy) into wiki pages using the cinderella.jar applet',
        'author' => 'Russel Philip',
        'url' => 'http://www.mediawiki.org/wiki/Extension:Cinderella',
        'version' => '0.1'
);
function wfCinderella() {
    global $wgParser;
    $wgParser->setHook( "cinderella", "renderCinderellaApplet" );
}
 
# The callback function for converting the input text to HTML output
function renderCinderellaApplet( $input, $argv ) {
	$errors = false;
 
	if (!$argv["width"])
		$errors .= "<li>width not specified</li>";
 
	if (!$argv["height"])
	 	$errors .= "<li>height not specified</li>";
 
	if (!$argv["filename"])
	 	$errors .= "<li>cdy file not specified</li>";
	elseif(!($myFile=Image::newFromName($argv["filename"])))
		$errors .= "<li>invalide file specified</li>";
 
	if (!$input)
		$errors .= "<li>applet parameters not specified</li>";
 
	if (!$errors){
		$output = '<applet code="de.cinderella.CindyApplet" archive="/nltl/extensions/cinderella/cindyrun.jar" width="'. $argv["width"].'" height="'. $argv["height"].'">';
		$output .= '<param name=filename value="'.$myFile->getURL().'">';
		$output .= $input;
		$output .= '</applet>';
	}else{
		$output = "Cinderella - errors found:<ol>".$errors."</ol>";
	}
 
    return $output;
}

[edit] See also

Cindy extension. Futher development of Cinderella extension.

Retrieved from "http://www.mediawiki.org/wiki/Extension:Cinderella"