| Index: trunk/phase3/RELEASE-NOTES-1.19 |
| — | — | @@ -26,6 +26,9 @@ |
| 27 | 27 | * (bug 32239) Removed wgEnableTooltipsAndAccesskeys. |
| 28 | 28 | * Removed $wgVectorShowVariantName. |
| 29 | 29 | * Removed $wgExtensionAliasesFiles. Use wgExtensionMessagesFiles. |
| | 30 | +* Introduced $wgAllowATag to allow <a> tags to be used for external links, |
| | 31 | + so rel and ref attributes can be used with microdata resp RDFa. |
| | 32 | + Defaults is false. |
| 30 | 33 | |
| 31 | 34 | === New features in 1.19 === |
| 32 | 35 | * (bug 19838) Possibility to get all interwiki prefixes if the interwiki |
| Index: trunk/phase3/includes/Sanitizer.php |
| — | — | @@ -407,6 +407,11 @@ |
| 408 | 408 | $htmlsingleonly[] = 'img'; |
| 409 | 409 | } |
| 410 | 410 | |
| | 411 | + global $wgAllowATag; |
| | 412 | + if ( $wgAllowATag ) { |
| | 413 | + $htmlpairsStatic[] = 'a'; |
| | 414 | + } |
| | 415 | + |
| 411 | 416 | $htmlsingleallowed = array_unique( array_merge( $htmlsingle, $tabletags ) ); |
| 412 | 417 | $htmlelementsStatic = array_unique( array_merge( $htmlsingle, $htmlpairsStatic, $htmlnest ) ); |
| 413 | 418 | |
| — | — | @@ -797,6 +802,23 @@ |
| 798 | 803 | } |
| 799 | 804 | } |
| 800 | 805 | |
| | 806 | + if ( $attribute === 'href' || $attribute === 'src' ) { |
| | 807 | + if ( !preg_match( $hrefExp, $value ) ) { |
| | 808 | + continue; //drop any href or src attributes not using an allowed protocol. |
| | 809 | + //NOTE: this also drops all relative URLs |
| | 810 | + } |
| | 811 | + } |
| | 812 | + |
| | 813 | + //RDFa properties allow URIs. check them |
| | 814 | + if ( $attribute === 'rel' || $attribute === 'rev' || |
| | 815 | + $attribute === 'about' || $attribute === 'property' || $attribute === 'resource' || |
| | 816 | + $attribute === 'datatype' || $attribute === 'typeof' ) { |
| | 817 | + //Paranoia. Allow "simple" values but suppress javascript |
| | 818 | + if ( preg_match( '/(^|\s)javascript\s*:/i', $value ) ) { |
| | 819 | + continue; |
| | 820 | + } |
| | 821 | + } |
| | 822 | + |
| 801 | 823 | // If this attribute was previously set, override it. |
| 802 | 824 | // Output should only have one attribute of each name. |
| 803 | 825 | $out[$attribute] = $value; |
| — | — | @@ -1572,7 +1594,7 @@ |
| 1573 | 1595 | 'td' => array_merge( $common, $tablecell, $tablealign ), |
| 1574 | 1596 | 'th' => array_merge( $common, $tablecell, $tablealign ), |
| 1575 | 1597 | |
| 1576 | | - # 12.2 # NOTE: <a> is not allowed directly, but the attrib whitelist is used from the Parser object |
| | 1598 | + # 12.2 |
| 1577 | 1599 | 'a' => array_merge( $common, array( 'href', 'rel', 'rev' ) ), # rel/rev esp. for RDFa |
| 1578 | 1600 | |
| 1579 | 1601 | # 13.2 |
| Index: trunk/phase3/includes/DefaultSettings.php |
| — | — | @@ -2242,11 +2242,13 @@ |
| 2243 | 2243 | |
| 2244 | 2244 | /** |
| 2245 | 2245 | * Enabled HTML5 microdata attributes for use in wikitext, if $wgHtml5 is also true. |
| | 2246 | + * See also $wgAllowATag. |
| 2246 | 2247 | */ |
| 2247 | 2248 | $wgAllowMicrodataAttributes = false; |
| 2248 | 2249 | |
| 2249 | 2250 | /** |
| 2250 | 2251 | * Cleanup as much presentational html like valign -> css vertical-align as we can |
| | 2252 | + * See also $wgAllowATag. |
| 2251 | 2253 | */ |
| 2252 | 2254 | $wgCleanupPresentationalAttributes = true; |
| 2253 | 2255 | |
| — | — | @@ -2979,6 +2981,14 @@ |
| 2980 | 2982 | $wgAllowImageTag = false; |
| 2981 | 2983 | |
| 2982 | 2984 | /** |
| | 2985 | + * Allow <a> tags for specifying external links, so it becomes possible to |
| | 2986 | + * provide ref and rel attributes. This allows for microdata/microformats/RDFa |
| | 2987 | + * annotations to be embedded on wiki pages. See also $wgAllowRdfaAttributes |
| | 2988 | + * and $wgAllowMicrodataAttributes. |
| | 2989 | + */ |
| | 2990 | +$wgAllowATag = false; |
| | 2991 | + |
| | 2992 | +/** |
| 2983 | 2993 | * $wgUseTidy: use tidy to make sure HTML output is sane. |
| 2984 | 2994 | * Tidy is a free tool that fixes broken HTML. |
| 2985 | 2995 | * See http://www.w3.org/People/Raggett/tidy/ |