| Index: trunk/extensions/Translate/specials/SpecialAggregateGroups.php |
| — | — | @@ -40,7 +40,7 @@ |
| 41 | 41 | $out->permissionRequired( 'translate-manage' ); |
| 42 | 42 | return; |
| 43 | 43 | } |
| 44 | | - |
| | 44 | + |
| 45 | 45 | $groups = MessageGroups::getAllGroups(); |
| 46 | 46 | $aggregates = array(); |
| 47 | 47 | $pages = array(); |
| — | — | @@ -106,7 +106,7 @@ |
| 107 | 107 | wfMsg( 'tpt-aggregategroup-add-new' ) . |
| 108 | 108 | "</a>" ); |
| 109 | 109 | $newGroupNameLabel = wfMsg( 'tpt-aggregategroup-new-name' ); |
| 110 | | - $newGroupName = Html::element( 'input', array( 'class' => 'tp-aggregategroup-add-name' ) ); |
| | 110 | + $newGroupName = Html::element( 'input', array( 'class' => 'tp-aggregategroup-add-name', 'maxlength' => '200' ) ); |
| 111 | 111 | $newGroupDescriptionLabel = wfMsg( 'tpt-aggregategroup-new-description' ); |
| 112 | 112 | $newGroupDescription = Html::element( 'input', |
| 113 | 113 | array( 'class' => 'tp-aggregategroup-add-description' ) |
| — | — | @@ -125,7 +125,7 @@ |
| 126 | 126 | protected function listSubgroups( AggregateMessageGroup $parent ) { |
| 127 | 127 | $out = $this->getOutput(); |
| 128 | 128 | $sanid = Sanitizer::escapeId( $parent->getId() ); |
| 129 | | - |
| | 129 | + |
| 130 | 130 | $id = $this->htmlIdForGroup( $parent, 'mw-tpa-grouplist-' ); |
| 131 | 131 | $out->addHtml( Html::openElement( 'ol', array( 'id' => $id ) ) ); |
| 132 | 132 | |
| — | — | @@ -154,7 +154,7 @@ |
| 155 | 155 | if ( isset( $subgroups[$groupId] ) ) continue; |
| 156 | 156 | $select->addOption( $group->getLabel(), $groupId ); |
| 157 | 157 | } |
| 158 | | - |
| | 158 | + |
| 159 | 159 | return $select; |
| 160 | 160 | } |
| 161 | 161 | |
| Index: trunk/extensions/Translate/api/ApiAggregateGroups.php |
| — | — | @@ -43,7 +43,11 @@ |
| 44 | 44 | if ( $subgroups ) { |
| 45 | 45 | $subgroups = array_map( 'trim', explode( ',', $subgroups ) ); |
| 46 | 46 | } else { |
| 47 | | - // For newly created groups the subgroups value might be empty |
| | 47 | + // For newly created groups the subgroups value might be empty, |
| | 48 | + // but check that. |
| | 49 | + if ( !TranslateMetadata::get( $aggregateGroup, 'name' ) ) { |
| | 50 | + $this->dieUsage( 'Invalid Aggregate message group', 'invalidaggregategroup' ); |
| | 51 | + } ; |
| 48 | 52 | $subgroups = array(); |
| 49 | 53 | } |
| 50 | 54 | $group = MessageGroups::getGroup( $groupId ); |
| — | — | @@ -51,8 +55,9 @@ |
| 52 | 56 | $this->dieUsage( 'Group does not exist or invalid', 'invalidgroup' ); |
| 53 | 57 | } |
| 54 | 58 | |
| 55 | | - // @FIXME: handle pages with a comma in their name |
| 56 | | - |
| | 59 | + if ( !self::isValid( $aggregateGroup ) ) { |
| | 60 | + $this->dieUsage( 'Invalid Aggregate message group', 'invalidaggregategroup' ); |
| | 61 | + } |
| 57 | 62 | // Add or remove from the list |
| 58 | 63 | if ( $action === 'associate' ) { |
| 59 | 64 | $subgroups[] = $groupId; |
| — | — | @@ -77,7 +82,9 @@ |
| 78 | 83 | if ( TranslateMetadata::get( $aggregateGroup, 'subgroups' ) ) { |
| 79 | 84 | $this->dieUsage( 'Aggregate message group already exists', 'duplicateaggregategroup' ); |
| 80 | 85 | } |
| 81 | | - // @FIXME: check that the group id is valid (like, no commas) |
| | 86 | + if ( !self::isValid ( $aggregateGroup ) ) { |
| | 87 | + $this->dieUsage( 'Invalid Aggregate message group name', 'invalidaggregategroup' ); |
| | 88 | + } |
| 82 | 89 | TranslateMetadata::set( $aggregateGroup, 'subgroups', '' ) ; |
| 83 | 90 | $name = trim( $params['groupname'] ); |
| 84 | 91 | $desc = trim( $params['groupdescription'] ); |
| — | — | @@ -99,6 +106,13 @@ |
| 100 | 107 | MessageGroups::clearCache(); |
| 101 | 108 | } |
| 102 | 109 | |
| | 110 | + protected function isValid( $aggregateGroup ) { |
| | 111 | + if ( !$aggregateGroup || preg_match( '/[\x00-\x1f\x22\x23\x2c\x2e\x3c\x3e\x5b\x5d\x7b\x7c\x7d\x7f\s]+/i', $aggregateGroup ) ) { |
| | 112 | + return false; |
| | 113 | + } |
| | 114 | + return true; |
| | 115 | + } |
| | 116 | + |
| 103 | 117 | public function isWriteMode() { |
| 104 | 118 | return true; |
| 105 | 119 | } |