Updated mediawiki/extensions
Project: mediawiki/extensions/GWToolset  329cfb85c908924ce4343c6eaf1dd37c60c06ffb

filter

chris steipp requested that we:

* $filter_sanitize === null in sanitize() should not be allowed. Since you use
Filter::evaluate() to sanitize for xss in several places, there can't be a
chance that would return without any filtering. If you can remove setting a
custom filter, that would be even better.

* Split array handling into another class that calls the scalar version, so all
filtering logic is in one class, but when you filter, it's explicit if you're
expecting an array or scalar.

* Attack can get arbitrary values through getWhitelistedPost by passing in a
whitelisted name as an array with 'filter-sanitize'=null. Fixing Filter should
prevent this from being an issue.

i have removed the Php\Filter class and created a GWToolset\Util class, also for
use in another request chris made, that contains static methods that replace those
that were used in Php\Filter. while re-factoring the code i realized that the
array handling in Php\Filter was no longer needed, so i did not create a method
for that at this time.

Change-Id: I3d118a4fdc4c1726815ab735527e636b883c41c7