Last modified: 2011-01-25 00:30:30 UTC

Wikimedia Bugzilla is closed!

Wikimedia migrated from Bugzilla to Phabricator. Bug reports are handled in Wikimedia Phabricator.
This static website is read-only and for historical purposes. It is not possible to log in and except for displaying bug reports and their history, links might be broken. See T24675, the corresponding Phabricator task for complete and up-to-date bug report information.
Bug 22675 - Dynamic page Links broken
Dynamic page Links broken
Status: RESOLVED FIXED
Product: MediaWiki extensions
Classification: Unclassified
DynamicPageList2 (Other open bugs)
unspecified
All All
: High major with 1 vote (vote)
: ---
Assigned To: Nobody - You can work on this!
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2010-02-28 14:32 UTC by Bertrand GRONDIN
Modified: 2011-01-25 00:30 UTC (History)
4 users (show)

See Also:
Web browser: ---
Mobile Platform: ---
Assignee Huggle Beta Tester: ---


Attachments
Patch that fixes <html> issue - however this entire thing is insecure... (1.09 KB, patch)
2010-07-01 00:29 UTC, Bawolff (Brian Wolff)
Details

Description Bertrand GRONDIN 2010-02-28 14:32:19 UTC
In revision r63067 DynamicPageList extention displays all web links without pointing to them

By example I read  in a wikipage !

* <html><a href="/wiki/index.php/D%C3%A9cret_n%C2%B0_2006-1657_du_21_d%C3%A9cembre_2006" title="Décret n° 2006-1657 du 21 décembre 2006">Décret n° 2006-1657 du 21 décembre 2006</a></html>
* <html><a href="/wiki/index.php/D%C3%A9cret_n%C2%B0_2006-1658_du_21_d%C3%A9cembre_2006" title="Décret n° 2006-1658 du 21 décembre 2006">Décret n° 2006-1658 du 21 décembre 2006</a></html>
Comment 1 Bawolff (Brian Wolff) 2010-02-28 17:17:06 UTC
I cannot reproduce this. Can you give me the wikicode that generated this?
Comment 2 Bertrand GRONDIN 2010-02-28 17:45:01 UTC
source code:

<includeonly><DPL>
debug=1
ordermethod=lastedit
category=Arrêts et jugements
count=10
addeditdate=true
order=descending
</DPL></includeonly>
<noinclude><DPL>
debug=1
ordermethod=title
category=Arrêts et jugements
order=ascending
mode=ordered
</DPL></noinclude>
Comment 3 Bawolff (Brian Wolff) 2010-02-28 17:48:01 UTC
Thats a different extension. (DyanmicPageList on bugzilla refers to the version used by wikimedia - the one's using <DynamicPageList> tags. the extension using <DPL> tags is referred to as DynamicPageList2 on bugzilla.

Moving component
Comment 4 Laurence 'GreenReaper' Parry 2010-03-14 17:42:37 UTC
It appears to be linked to calling $parser->recursiveTagParse() (Parser.php) from ExtDynamicPageList::executeTag() (DPLSetup.php). Going in, it appears to be a mix of HTML and templates that needs parsing. The returned text now has <html> tags around it and is in escaped format.

If you set $wgRawHtml = true;, the problem goes away. (Obviously this is not a good workaround.)
Comment 5 Carl Austin Bennett 2010-06-20 22:43:59 UTC
I've been able to replicate the same issue with DynamicPageList as of MediaWiki 1.17alpha (http://toolserver.org/~vvv/mw-nightly/ Dumped on: 12:13, 20 June 2010 Subversion revision: r68310). I downloaded both the core code and extensions.

The "third party" DynamicPageList in MediaWiki SVN had been working quite well under MediaWiki 1.16 and today is now broken on "upgrade" to 1.17 alpha:

DynamicPageList (Versão 1.8.6)	A highly flexible report generator for MediaWikis - manual and examples: see [1]  	Gero Scholz

Últimas notícias:

    * 2010-06-20: <html><a href="/wiki/Desnot%C3%ADcias:Faltou_gana_para_Gana" title="Desnotícias:Faltou gana para Gana">Faltou gana para Gana</a></html>
    * 2010-06-20: <html><a href="/wiki/Desnot%C3%ADcias:Em_partida_catimbada,_Brasil_vence_jogo_de_capoeira_contra_Costa_do_Marfim" title="Desnotícias:Em partida catimbada, Brasil vence jogo de capoeira contra Costa do Marfim">Em partida catimbada, Brasil vence jogo de capoeira contra Costa do Marfim</a></html>
[...]

The Wikimedia-style "intersection" still works - aka:

DynamicPageList  	(r55550)	constrói uma lista pontuada dos itens mais recentes presentes numa categoria, ou uma união de várias categorias  	Amgine e IlyaHaykinson

Últimas notícias:

    * 20 de junho de 2010: Faltou gana para Gana
    * 20 de junho de 2010: Em partida catimbada, Brasil vence jogo de capoeira contra Costa do Marfim


I've changed http://notici.as and other sites on the same servers to use the less-powerful "intersection" version until a proper fix is available but otherwise haven't tried changing anything in the configuration files from what was a properly-working MW 1.16 configuration.
Comment 6 Bawolff (Brian Wolff) 2010-07-01 00:29:37 UTC
Created attachment 7536 [details]
Patch that fixes <html> issue - however this entire thing is insecure...

I found what was wrong. DPL was using <html> in a rather hacky (and somewhat insecure way). When mediawiki changed how it handled <html> in r61913, the hack this extension used broke.

the attached patch fixes the issue as far as I can tell. However, not only is the approach this extension takes to raw html utterly scary, it is also insecure. (This patch doesn't add any new security issues, but i feel hesitant contributing a fix to the mechinism, which in my opinion is insecure until the underlying security problems have been addressed)
Comment 7 Bawolff (Brian Wolff) 2010-07-01 03:46:42 UTC
fixed in r68812

I also fixed some of the obvious security issues in r68811 however this extension still scares me somewhat.
Comment 8 Morgon Kanter 2010-10-20 00:25:51 UTC
This is still not fixed. Strangely it works just fine for #dpl, but when using &lt;dpl&gt; you encounter the same bug.

Using the latest release of DPL, with r68812, we have the following two pages:

* #dpl, working: http://www.dnd-wiki.org/w/index.php?title=3.5e_Feats_Category_Format&oldid=91469
* &lt;dpl&gt;, not working: http://www.dnd-wiki.org/w/index.php?title=3.5e_Feats_Category_Format&oldid=91470

This is really weird because it appears to me that the fix wasn't dependent on a tag-vs-parser conditional.
Comment 9 Morgon Kanter 2010-10-20 01:11:13 UTC
Apologies for the previous reopen, seems to be a results cache issue. Anyone else having this problem, try waiting 24 hours.

Note You need to log in before you can comment on or make changes to this bug.


Navigation
Links