Extension:NetworkLink/NetworkLink.php

From MediaWiki.org

Jump to: navigation, search
Zeichen 206.svg WARNING: the code or configuration described here poses a major security risk.

Problem: Vulnerable to Cross-site scripting attacks, because it passes user input directly to the browser. This may lead to user accounts being hijacked, among other things.
Solution: strictly validate user input and/or apply escaping to all characters that have a special meaning in HTML
Signed: Duesentrieb 21:20, 22 March 2007 (UTC)


<?php
// Link MediaWiki extension.
// Creates a link to a network location.
 
// Copyright (C) 2007, Aretai Systems.
//
// This program is free software; you can redistribute it and/or modify
// it under the terms of the GNU General Public License as published by
// the Free Software Foundation; either version 2 of the License, or
// (at your option) any later version.
//
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU General Public License for more details.
//
// You should have received a copy of the GNU General Public License
// along with this program; if not, write to the Free Software
// Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 
# Usage
# with this extension it is possible to define 
# new tags of the form 
# <link target="blank">network location</link>
# The behaviour of a window is configurable. Options are not obligatory: "SELF", "TOP", "PARENT", "BLANK" (default).
# the function registered by the extension gets the text between the 
# tags as input and renders a link.
# You can just copy the network location and paste it between <link></link>. 

$wgExtensionFunctions[] = "linkExtension";
 
function linkExtension() {
    global $wgParser;
    $wgParser->setHook( "link", "renderlink" );
}
 
# The callback function for converting the input text to HTML output
function renderlink( $loc='', $argv=array() ) {
    global $wgOut, $wgTitle, $wgParser;
 
    switch( strtoupper( $argv['TARGET'] ) ) {
    case "SELF":
       $out = "<a href=\"{$loc}\" target=\"_self\">$loc</a>";
       break;
    case "TOP":
       $out = "<a href=\"{$loc}\" target=\"_top\">$loc</a>";
       break;
    case "PARENT":
       $out = "<a href=\"{$loc}\" target=\"_parent\">$loc</a>";
       break;
    default:
       $out = "<a href=\"{$loc}\" target=\"_blank\">$loc</a>";
    }
 
    return $out;
 
}