Menu

#98 possible register_globals vulnerability

workingwiki
open
None
5
2013-05-07
2011-05-03
Lee Worden
No

http://www.mediawiki.org/wiki/Manual:Developing_extensions#Publishing says:

Warning Warning: To avoid register_globals vulnerabilities, ALWAYS explicitly set all your extension's configurastion variables in extension setup file. Constructs like
if ( !isset( $wgMyLeetOption ) )
$wgMyLeetOption = somevalue;
do not safeguard against register_globals!

I have been using this isset() construct, so I may need to remove it. This construct allows admins to set some WW config variables before the require_once(), which can be very useful. Removing it may make certain things harder to configure, and may require some admins to rewrite their LocalSettings code.

Discussion

Anonymous
Anonymous

Add attachments
Cancel