On Dec 6, 2004, at 1:01 PM, Adam Edwards wrote:
My question is I overwrote the $wgServer variable in my LocalSettings.php file to use $_SERVER["HTTP_HOST"] instead and preserve the subdomain. Does anyone know if this will mess anything up?
This value is provided by the client, so it may be possible to exploit, depending on your server configuration. Cache poisoning attacks with HTML/JavaScript injections might be a possibility if it's not properly sanitized in output.
You should ensure that the variable can only have certain predefined values before using it in this way.
Oh yeah I'm using mediawiki-1.3.2.
Please upgrade to 1.3.8 immediately; there are numerous bug fixes and some important security fixes.
-- brion vibber (brion @ pobox.com)