I've changed my LocalSettings.php file to change some settings based on the subdomain that it comes under. Example: texas.domain.com will swap out the logo to a texas based logo. Everything seems to work ok except for saving after editting a page. When the form gets submitted, the url for the article page changed from texas.domain.com to domain.com. I thought it had to do with the action on the form, but it doesn't. The search form on the page has an action very similar and the domain stays texas.domain.com. I went throught the code and traced it to the getFullURL() function in includes/Title.php. It builds the url from the $wgServer var and $this->getLocalUrl. The $wgServer var is set to just 'domain.com', so thats where things get messed up. $wgServer variable gets set in the includes/DefaultSettings.php file from the $wgProto.'://' . $_SERVER['SERVER_NAME']; My question is I overwrote the $wgServer variable in my LocalSettings.php file to use $_SERVER["HTTP_HOST"] instead and preserve the subdomain. Does anyone know if this will mess anything up? It seems to work ok so far, and it fixed the problem with saving a page. Oh yeah I'm using mediawiki-1.3.2.
Adam
On Dec 6, 2004, at 1:01 PM, Adam Edwards wrote:
My question is I overwrote the $wgServer variable in my LocalSettings.php file to use $_SERVER["HTTP_HOST"] instead and preserve the subdomain. Does anyone know if this will mess anything up?
This value is provided by the client, so it may be possible to exploit, depending on your server configuration. Cache poisoning attacks with HTML/JavaScript injections might be a possibility if it's not properly sanitized in output.
You should ensure that the variable can only have certain predefined values before using it in this way.
Oh yeah I'm using mediawiki-1.3.2.
Please upgrade to 1.3.8 immediately; there are numerous bug fixes and some important security fixes.
-- brion vibber (brion @ pobox.com)
mediawiki-l@lists.wikimedia.org