r112426 MediaWiki - Code Review archive

Repository:MediaWiki
Revision:r112425‎ | r112426 | r112427 >
Date:12:07, 26 February 2012
Author:siebrand
Status:resolved
Tags:i18nreview 
Comment:
Follow-up r112424: Per IAlex on IRC: Use escape() instead of plain() for improved security.
Modified paths:
  • /trunk/phase3/includes/Linker.php (modified) (history)
  • /trunk/phase3/includes/Pager.php (modified) (history)
  • /trunk/phase3/includes/specials/SpecialContributions.php (modified) (history)

Diff [purge]

Index: trunk/phase3/includes/Linker.php
@@ -1399,7 +1399,7 @@
14001400 return '';
14011401 } else {
14021402 $formatted = self::formatComment( $comment, $title, $local );
1403 - $formatted = wfMessage( 'parentheses' )->rawParams( $formatted )->plain();
 1403+ $formatted = wfMessage( 'parentheses' )->rawParams( $formatted )->escape();
14041404 return " <span class=\"comment\">$formatted</span>";
14051405 }
14061406 }
@@ -1441,7 +1441,7 @@
14421442 } else {
14431443 global $wgLang;
14441444 $stxt = wfMsgExt( 'nbytes', 'parsemag', $wgLang->formatNum( $size ) );
1445 - $stxt = wfMessage( 'parentheses' )->rawParams( $stxt )->plain();
 1445+ $stxt = wfMessage( 'parentheses' )->rawParams( $stxt )->escape();
14461446 }
14471447 $stxt = htmlspecialchars( $stxt );
14481448 return "<span class=\"history-size\">$stxt</span>";
@@ -1870,7 +1870,7 @@
18711871 $html = $delete ? wfMsgHtml( 'rev-delundel' ) : wfMsgHtml( 'rev-showdeleted' );
18721872 $tag = $restricted ? 'strong' : 'span';
18731873 $link = self::link( $sp, $html, array(), $query, array( 'known', 'noclasses' ) );
1874 - return Xml::tags( $tag, array( 'class' => 'mw-revdelundel-link' ), wfMessage( 'parentheses' )->rawParams( $link )->plain() );
 1874+ return Xml::tags( $tag, array( 'class' => 'mw-revdelundel-link' ), wfMessage( 'parentheses' )->rawParams( $link )->escape() );
18751875 }
18761876
18771877 /**
@@ -1883,7 +1883,7 @@
18841884 */
18851885 public static function revDeleteLinkDisabled( $delete = true ) {
18861886 $html = $delete ? wfMsgHtml( 'rev-delundel' ) : wfMsgHtml( 'rev-showdeleted' );
1887 - return Xml::tags( 'span', array( 'class' => 'mw-revdelundel-link' ), wfMessage( 'parentheses' )->rawParams( $html )->plain() );
 1887+ return Xml::tags( 'span', array( 'class' => 'mw-revdelundel-link' ), wfMessage( 'parentheses' )->rawParams( $html )->escape() );
18881888 }
18891889
18901890 /* Deprecated methods */
Index: trunk/phase3/includes/specials/SpecialContributions.php
@@ -254,7 +254,7 @@
255255 // @todo Should this be removed at some point?
256256 $oldMsg = $this->msg( 'contribsub' );
257257 if ( $oldMsg->exists() ) {
258 - $linksWithParentheses = $this->msg( 'parenteses' )->rawParams( $links )->plain();
 258+ $linksWithParentheses = $this->msg( 'parenteses' )->rawParams( $links )->escape();
259259 return $oldMsg->rawParams( "$user $linksWithParentheses" );
260260 } else {
261261 return $this->msg( 'contribsub2' )->rawParams( $user, $links );
@@ -839,7 +839,7 @@
840840 $del .= ' ';
841841 }
842842
843 - $diffHistLinks = $this->msg( 'parentheses' )->rawParams( $difftext . $this->messages['pipe-separator'] . $histlink )->plain();
 843+ $diffHistLinks = $this->msg( 'parentheses' )->rawParams( $difftext . $this->messages['pipe-separator'] . $histlink )->escape();
844844 $ret = "{$del}{$d} {$diffHistLinks}{$chardiff}{$nflag}{$mflag} {$link}{$userlink} {$comment} {$topmarktext}";
845845
846846 # Denote if username is redacted for this edit
Index: trunk/phase3/includes/Pager.php
@@ -771,7 +771,7 @@
772772 $limits = $this->getLanguage()->pipeList( $limitLinks );
773773 $firstLastLinks = wfMessage( 'parentheses' )->rawParams( "{$pagingLinks['first']}" .
774774 wfMsgExt( 'pipe-separator' , 'escapenoentities' ) .
775 - "{$pagingLinks['last']}" )->plain();
 775+ "{$pagingLinks['last']}" )->escape();
776776
777777 $this->mNavigationBar = $firstLastLinks . ' ' .
778778 wfMsgHTML(

Follow-up revisions

RevisionCommit summaryAuthorDate
r112427Wow. Messy. Follow-up r112426, r112424: Fix incorrect calls. Should have been...siebrand12:11, 26 February 2012

Past revisions this follows-up on

RevisionCommit summaryAuthorDate
r112424Follow-up r112410, r112412: Cheaper processing using plain().siebrand11:49, 26 February 2012

Status & tagging log