Difference between revisions of "MediaWiki/Parser50"

From Nick Jenkins
Jump to: navigation, search
(woplhzYuNPrz)
m (Revert to non-vandal version.)
Line 1: Line 1:
Nice work, thanks  , <a href=" http://hanapporo.com/cp/scripts/63/free-nude-strippers164.html ">Free Nude Strippers</a> ,  214 , <a href=" http://opencasuals.com/images/icons/35/naked-lesbian122.html ">Naked Lesbian</a> ,  wqrv , <a href=" http://next-enterprises.net/cp/scripts/71/force-fucked-wives173.html ">Force Fucked Wives</a> ,  >:))) , <a href=" http://honeystreams.org/cp/images/74/coral-real-world210.html ">Coral Real World</a> ,  551 , <a href=" http://zenelevations.com/images/_vti_cnf/47/huge-toys-fisting35.html ">Huge Toys Fisting</a> ,  100 , <a href=" http://miamijobbank.net/images/icons/63/sexual-position-pregnancy272.html ">Sexual Position Pregnancy</a> ,  749 , <a href=" http://honkanen.us/cp/images/55/black-nude-gallery38.html ">Black Nude Gallery</a> ,  5535 , <a href=" http://fortwaynebusiness.net/aspnet_client/system_web/71/party-sex209.html ">Party Sex</a> , kpc , <a href=" http://atlantajobbank.org/images/icons/90/keeley-hazell-nude179.html ">Keeley Hazell Nude</a> ,  9808 , <a href=" http://kawai101.com/cp/scripts/930/naked-lesbians-having-sex59.html ">Naked Lesbians Having Sex</a> ,  tgfru ,
+
URL:
 +
<pre>
 +
http://en.wikipedia.org/w/index.php?title=Special:Userlogin&action=submitlogin&type=login&returnto="><a href="ownage
 +
</pre>
 +
 
 +
Alternate URL on a test wiki (replace IP address with appropriate details):
 +
<pre>
 +
http://192.168.0.64/wiki/index.php?title=Special:Userlogin&action=submitlogin&type=login&returnto="><a href="ownage
 +
</pre>
 +
 
 +
Then login.
 +
 
 +
Output on a wiki showing errors:
 +
<pre>
 +
Fatal error: Call to a member function escapeFullURL() on a non-object in /var/www/hosts/mediawiki/phase3/includes/OutputPage.php on line 921
 +
</pre>
 +
 
 +
Output on the wikipedia:
 +
Blank page (errors are being logged).
 +
 
 +
This test as a curl command line:
 +
<pre>
 +
curl --silent --include --cookie 'wikidb_session=1' -F 'wpName'='SOME_VALID_USERNAME' -F 'wpPassword'='SOME_VALID_PASSWORD' \
 +
'192.168.0.64/wiki/index.php?title=Special:Userlogin&action=submitlogin&type=login&returnto=<'
 +
</pre>
 +
 
 +
Also seems to be reproducible without having to login:
 +
<pre>
 +
curl --silent --include \
 +
  --cookie 'enwiki_session=1'\
 +
-F 'wpCookieCheck'=\
 +
-F 'returnto'='|'\
 +
'en.wikipedia.org/w/index.php/Special:Userlogin'
 +
</pre>

Revision as of 22:16, 24 September 2009

URL:

http://en.wikipedia.org/w/index.php?title=Special:Userlogin&action=submitlogin&type=login&returnto="><a href="ownage

Alternate URL on a test wiki (replace IP address with appropriate details):

http://192.168.0.64/wiki/index.php?title=Special:Userlogin&action=submitlogin&type=login&returnto="><a href="ownage

Then login.

Output on a wiki showing errors:

Fatal error: Call to a member function escapeFullURL() on a non-object in /var/www/hosts/mediawiki/phase3/includes/OutputPage.php on line 921

Output on the wikipedia: Blank page (errors are being logged).

This test as a curl command line:

curl --silent --include --cookie 'wikidb_session=1' -F 'wpName'='SOME_VALID_USERNAME' -F 'wpPassword'='SOME_VALID_PASSWORD' \
'192.168.0.64/wiki/index.php?title=Special:Userlogin&action=submitlogin&type=login&returnto=<'

Also seems to be reproducible without having to login:

curl --silent --include \
 --cookie 'enwiki_session=1'\
 -F 'wpCookieCheck'=\
 -F 'returnto'='|'\
 'en.wikipedia.org/w/index.php/Special:Userlogin'