r111125 MediaWiki - Code Review archive

Repository:MediaWiki
Revision:r111124‎ | r111125 | r111126 >
Date:23:42, 9 February 2012
Author:werdna
Status:ok (Comments)
Tags:
Comment:
jquery.localize(): Allow "raw" parameter to disable escaping.
Modified paths:
  • /branches/ArticleCreationWorkflow/phase3/resources/jquery/jquery.localize.js (modified) (history)

Diff [purge]

Index: branches/ArticleCreationWorkflow/phase3/resources/jquery/jquery.localize.js
@@ -45,8 +45,15 @@
4646 .find( 'msg,html\\:msg' )
4747 .each( function() {
4848 var $el = $(this);
 49+ var msgText = msg( $el.attr( 'key' ) );
 50+
 51+ if ( $el.attr('raw') ) {
 52+ $el.html(msgText);
 53+ } else {
 54+ $el.text(msgText);
 55+ }
 56+
4957 $el
50 - .text( msg( $el.attr( 'key' ) ) )
5158 .replaceWith( $el.html() );
5259 } )
5360 .end()

Comments

#Comment by Raindrift (talk | contribs)   23:58, 9 February 2012

Andrew and I discussed how this creates a possible XSS vector, wherein the message is replaced with a malicious one through the MediaWiki namespace. However, it seems we've collectively decided to trust the MW namespace, so that makes this okay.

Status & tagging log