Last modified: 2014-06-09 16:47:58 UTC

Wikimedia Bugzilla is closed!

Wikimedia migrated from Bugzilla to Phabricator. Bug reports are handled in Wikimedia Phabricator.
This static website is read-only and for historical purposes. It is not possible to log in and except for displaying bug reports and their history, links might be broken. See T14495, the corresponding Phabricator task for complete and up-to-date bug report information.
Bug 12495 - Automatic subst-ing of templates in user signature is easily circumvented
Automatic subst-ing of templates in user signature is easily circumvented
Status: NEW
Product: MediaWiki
Classification: Unclassified
User preferences (Other open bugs)
unspecified
All All
: Low normal with 6 votes (vote)
: ---
Assigned To: Nobody - You can work on this!
: newparser, parser
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2008-01-03 20:05 UTC by Mormegil
Modified: 2014-06-09 16:47 UTC (History)
3 users (show)

See Also:
Web browser: ---
Mobile Platform: ---
Assignee Huggle Beta Tester: ---


Attachments

Description Mormegil 2008-01-03 20:05:05 UTC
Since r12486, templates within user signature are always substed (by automatic modification (see Parser::cleanSig) upon saving of user preferences), which is probably meant to decrease the server load.

However, since {{subst:X}} substitutes only the first level of template transclusion, this feature is very easily circumvented: you only need to create a page containing the desired template call and use this page as your signature.

The most straightforward idea how to solve this could be to introduce the desired {{substall:X}} functionality (see bug 2777) and use that instead of plain subst. Or, you could maybe ensure the full recursive substing during parsing of ~~~[~] (somewhere around Parser::getUserSig), but I guess it would be not much compatible with the current parser design.

Note You need to log in before you can comment on or make changes to this bug.


Navigation
Links