r100520 MediaWiki - Code Review archive

Repository:MediaWiki
Revision:r100519‎ | r100520 | r100521 >
Date:22:19, 22 October 2011
Author:platonides
Status:deferred (Comments)
Tags:
Comment:
Escape html
Modified paths:
  • /trunk/extensions/RecordAdmin/RecordAdmin_body.php (modified) (history)

Diff [purge]

Index: trunk/extensions/RecordAdmin/RecordAdmin_body.php
@@ -87,7 +87,7 @@
8888 # Add a tab for each type with a form filled in with the parameters from its template call
8989 $jsFormsList = array();
9090 $tabset = "<div class=\"tabset\">";
91 - $tabset .= "<fieldset><legend>" . wfMsg( 'recordadmin-properties' ) . "</legend>";
 91+ $tabset .= "<fieldset><legend>" . wfMsgHtml( 'recordadmin-properties' ) . "</legend>";
9292 $tabset .= wfMsg( 'recordadmin-edit-info', $wgRequest->appendQuery( 'nora=1' ) ) . "</fieldset>";
9393 foreach( $records as $type => $record ) {
9494 $jsFormsList[] = "'$type'";
@@ -95,7 +95,7 @@
9696 $this->examineForm();
9797 $values = $this->valuesFromText( $record );
9898 $this->populateForm( $values );
99 - $tabset .= "<fieldset><legend>$type " . strtolower( wfMsg( 'recordadmin-properties' ) ) . "</legend>\n";
 99+ $tabset .= "<fieldset><legend>$type " . strtolower( wfMsgHtml( 'recordadmin-properties' ) ) . "</legend>\n";
100100 $tabset .= "<form id=\"" . strtolower($type) . "-form\" class=\"{$this->formClass}\"{$this->formAtts}>$this->form</form>\n";
101101 $tabset .= "</fieldset>";
102102 }
@@ -303,7 +303,7 @@
304304 */
305305 function renderRecords( $records, $cols = false, $sortable = true, $template = false, $name = 'wpSelect', $export = true, $groupby = false ) {
306306 global $wgOut, $wgParser, $wgTitle, $wgRequest;
307 - if( count( $records ) < 1 ) return wfMsg( 'recordadmin-nomatch' );
 307+ if( count( $records ) < 1 ) return wfMsgHtml( 'recordadmin-nomatch' );
308308 if( $groupby ) $groupby = self::split( $groupby, ',' );
309309
310310 $type = $this->type;
@@ -324,11 +324,11 @@
325325 # Table header (col0-3 class atts are for backward compatibility, only use named from now on)
326326 $table = "<table$id class='recordadmin$sortable $type-record'>\n<tr>";
327327 $th = array(
328 - 'select' => "<th class='col-select'>" . wfMsg( 'recordadmin-select' ) . "$br</th>",
329 - 'title' => "<th class='col0 col-title'>" . wfMsg( 'recordadmin-title', $type ) . "$br</th>",
330 - 'actions' => "<th class='col1 col-actions'>" . wfMsg( 'recordadmin-actions' ) . "$br</th>",
331 - 'created' => "<th class='col2 col-created'>" . wfMsg( 'recordadmin-created' ) . "$br</th>",
332 - 'modified' => "<th class='col3 col-modified'>" . wfMsg( 'recordadmin-modified' ) . "$br</th>"
 328+ 'select' => "<th class='col-select'>" . wfMsgHtml( 'recordadmin-select' ) . "$br</th>",
 329+ 'title' => "<th class='col0 col-title'>" . wfMsgHtml( 'recordadmin-title', $type ) . "$br</th>",
 330+ 'actions' => "<th class='col1 col-actions'>" . wfMsgHtml( 'recordadmin-actions' ) . "$br</th>",
 331+ 'created' => "<th class='col2 col-created'>" . wfMsgHtml( 'recordadmin-created' ) . "$br</th>",
 332+ 'modified' => "<th class='col3 col-modified'>" . wfMsgHtml( 'recordadmin-modified' ) . "$br</th>"
333333 );
334334 foreach( array_keys( $this->types ) as $col ) {
335335 $class = 'col' . preg_replace( "|\W|", "-", $col );
@@ -353,13 +353,13 @@
354354 $tmp = array();
355355 foreach( $records as $k1 => $v1 ) {
356356 if( empty( $k1 ) ) {
357 - $k1 = wfMsg( 'recordadmin-notset', $groupby[0] );
 357+ $k1 = wfMsgHtml( 'recordadmin-notset', $groupby[0] );
358358 }
359359 $tmp[] = "$td<h2>$k1</h2></td>\n";
360360 foreach( $v1 as $k2 => $v2 ) {
361361 if( isset( $groupby[1] ) ) {
362362 if( empty( $k2 ) ) {
363 - $k2 = wfMsg( 'recordadmin-notset', $groupby[1] );
 363+ $k2 = wfMsgHtml( 'recordadmin-notset', $groupby[1] );
364364 }
365365 $tmp[] = "$td<h3>$k2</h3></td>\n";
366366 foreach( $v2 as $v3 ) $tmp[] = $v3;
@@ -429,7 +429,7 @@
430430 'select' => "<td class='col-select'>$sel</td>\n",
431431 'title' => "<td class='col0 col-title'><a href='$u'>$col</a></td>",
432432 'actions' => "<td class='col1 col-actions'><a href='" . $t->getLocalURL( "action=edit" ) . "'>"
433 - . wfMsg( 'recordadmin-editlink' ) . "</a></td>",
 433+ . wfMsgHtml( 'recordadmin-editlink' ) . "</a></td>",
434434 'created' => "<td class='col2 col-created'>$tsc</td>\n",
435435 'modified' => "<td class='col3 col-modified'>$tsm</td>\n"
436436 );
@@ -497,10 +497,10 @@
498498 $url = $wgTitle->getLocalURL( $qs );
499499 $table .= "\n<a class=\"recordadmin-export-url\" href=\"$url\">URL</a>";
500500 if( in_array( 'csv', $export ) ) {
501 - $table .= "\n<a class=\"recordadmin-export-csv\" href=\"$url&export=csv\">" . wfMsg( 'recordadmin-export-csv' ) . "</a>";
 501+ $table .= "\n<a class=\"recordadmin-export-csv\" href=\"$url&export=csv\">" . wfMsgHtml( 'recordadmin-export-csv' ) . "</a>";
502502 }
503503 if( in_array( 'pdf', $export ) ) {
504 - $table .= "\n<a class=\"recordadmin-export-pdf\" href=\"$url&export=pdf\">" . wfMsg( 'recordadmin-export-pdf' ) . "</a>";
 504+ $table .= "\n<a class=\"recordadmin-export-pdf\" href=\"$url&export=pdf\">" . wfMsgHtml( 'recordadmin-export-pdf' ) . "</a>";
505505 }
506506 }
507507
@@ -551,9 +551,9 @@
552552 else {
553553
554554 # Create a red link to the form if it doesn't exist
555 - $form = '<b>' . wfMsg( 'recordadmin-noform', $type ) . '</b>'
 555+ $form = '<b>' . wfMsgHtml( 'recordadmin-noform', $type ) . '</b>'
556556 . '<br /><a href="' . $title->getLocalURL( 'action=edit' )
557 - . '">(' . wfMsg( 'recordadmin-createlink' ) . ')</a><br />';
 557+ . '">(' . wfMsgHtml( 'recordadmin-createlink' ) . ')</a><br />';
558558 }
559559 } else $form = '';
560560 $this->form = $form;
@@ -884,19 +884,19 @@
885885 $ttitle = Title::newFromtext( $newtype, NS_TEMPLATE );
886886 $ftitle = Title::newFromtext( $newtype, NS_FORM );
887887 if( !is_object( $ttitle ) || !is_object( $ftitle ) ) {
888 - $wgOut->addHTML( "<div class='errorbox'>" . wfMsg( 'recordadmin-createerror', $rtype ) . "</div>\n" );
 888+ $wgOut->addHTML( "<div class='errorbox'>" . wfMsgHtml( 'recordadmin-createerror', $rtype ) . "</div>\n" );
889889 }
890890 $tttext = $ttitle->getPrefixedText();
891891 $fttext = $ftitle->getPrefixedText();
892892
893893 # check if the template already exists
894894 if( $ttitle->exists() ) {
895 - $wgOut->addHTML( "<div class='errorbox'>" . wfMsg( 'recordadmin-alreadyexist', $tttext ) . "</div>\n" );
 895+ $wgOut->addHTML( "<div class='errorbox'>" . wfMsgHtml( 'recordadmin-alreadyexist', $tttext ) . "</div>\n" );
896896 }
897897
898898 # check if the form already exists
899899 elseif( $ftitle->exists() ) {
900 - $wgOut->addHTML( "<div class='errorbox'>" . wfMsg( 'recordadmin-alreadyexist', $fttext ) . "</div>\n" );
 900+ $wgOut->addHTML( "<div class='errorbox'>" . wfMsgHtml( 'recordadmin-alreadyexist', $fttext ) . "</div>\n" );
901901 }
902902
903903 # Attempt to create the template and form
@@ -914,15 +914,15 @@
915915 if( $success ) {
916916 $cat = Title::newFromText( $wgRecordAdminCategory, NS_CATEGORY )->getPrefixedText();
917917 $url = $ftitle->getLocalUrl( 'action=edit' );
918 - $link = "<a href=\"$url\">" . wfMsg( 'recordadmin-needscontent' ) . "</a>";
 918+ $link = "<a href=\"$url\">" . wfMsgHtml( 'recordadmin-needscontent' ) . "</a>";
919919 $text = "<html>\n\t<form>\n\t\t<table>\n\t\t$link\n\t\t</table>\n\t</form>\n</html>";
920920 $article = new Article( $ftitle );
921921 $success = $article->doEdit( $text, $summary, EDIT_NEW );
922 - if( !$success ) $wgOut->addHTML( "<div class='errorbox'>" . wfMsg( 'recordadmin-createerror', $fttext ) . "</div>\n" );
923 - } else $wgOut->addHTML( "<div class='errorbox'>" . wfMsg( 'recordadmin-createerror', $tttext ) . "</div>\n" );
 922+ if( !$success ) $wgOut->addHTML( "<div class='errorbox'>" . wfMsgHtml( 'recordadmin-createerror', $fttext ) . "</div>\n" );
 923+ } else $wgOut->addHTML( "<div class='errorbox'>" . wfMsgHtml( 'recordadmin-createerror', $tttext ) . "</div>\n" );
924924
925925 # Report success
926 - if( $success ) $wgOut->addHTML( "<div class='successbox'>" . wfMsg( 'recordadmin-createsuccess', $rtype ) . "</div>\n" );
 926+ if( $success ) $wgOut->addHTML( "<div class='successbox'>" . wfMsgHtml( 'recordadmin-createsuccess', $rtype ) . "</div>\n" );
927927 }
928928 }
929929

Follow-up revisions

RevisionCommit summaryAuthorDate
r100612Follow up r100520: Also escape message parametersplatonides16:19, 24 October 2011

Comments

#Comment by Nikerabbit (talk | contribs)   08:03, 23 October 2011

wfMsgHtml doesn't escape parameter values.

Status & tagging log