| Index: trunk/phase3/includes/GlobalFunctions.php |
| — | — | @@ -676,9 +676,7 @@ |
| 677 | 677 | if ( in_array('escape', $options) ) { |
| 678 | 678 | $string = htmlspecialchars ( $string ); |
| 679 | 679 | } elseif ( in_array( 'escapenoentities', $options ) ) { |
| 680 | | - $string = htmlspecialchars( $string ); |
| 681 | | - $string = str_replace( '&', '&', $string ); |
| 682 | | - $string = Sanitizer::normalizeCharReferences( $string ); |
| | 680 | + $string = Sanitizer::escapeHtmlAllowEntities( $string ); |
| 683 | 681 | } |
| 684 | 682 | |
| 685 | 683 | if( in_array('replaceafter', $options) ) { |
| Index: trunk/phase3/includes/Linker.php |
| — | — | @@ -1160,7 +1160,8 @@ |
| 1161 | 1161 | |
| 1162 | 1162 | # Sanitize text a bit: |
| 1163 | 1163 | $comment = str_replace( "\n", " ", $comment ); |
| 1164 | | - $comment = htmlspecialchars( $comment ); |
| | 1164 | + # Allow HTML entities (for bug 13815) |
| | 1165 | + $comment = Sanitizer::escapeHtmlAllowEntities( $comment ); |
| 1165 | 1166 | |
| 1166 | 1167 | # Render autocomments and make links: |
| 1167 | 1168 | $comment = $this->formatAutoComments( $comment, $title, $local ); |
| Index: trunk/phase3/includes/Sanitizer.php |
| — | — | @@ -822,6 +822,22 @@ |
| 823 | 823 | } |
| 824 | 824 | |
| 825 | 825 | /** |
| | 826 | + * Given HTML input, escape with htmlspecialchars but un-escape entites. |
| | 827 | + * This allows (generally harmless) entities like to survive. |
| | 828 | + * |
| | 829 | + * @param string $html String to escape |
| | 830 | + * @return string Escaped input |
| | 831 | + */ |
| | 832 | + static function escapeHtmlAllowEntities( $html ) { |
| | 833 | + # It seems wise to escape ' as well as ", as a matter of course. Can't |
| | 834 | + # hurt. |
| | 835 | + $html = htmlspecialchars( $html, ENT_QUOTES ); |
| | 836 | + $html = str_replace( '&', '&', $html ); |
| | 837 | + $html = Sanitizer::normalizeCharReferences( $html ); |
| | 838 | + return $html; |
| | 839 | + } |
| | 840 | + |
| | 841 | + /** |
| 826 | 842 | * Regex replace callback for armoring links against further processing. |
| 827 | 843 | * @param array $matches |
| 828 | 844 | * @return string |
| Index: trunk/phase3/includes/Title.php |
| — | — | @@ -2758,7 +2758,9 @@ |
| 2759 | 2759 | $fname = 'MovePageForm::moveToNewTitle'; |
| 2760 | 2760 | $comment = wfMsgForContent( '1movedto2', $this->getPrefixedText(), $nt->getPrefixedText() ); |
| 2761 | 2761 | if ( $reason ) { |
| 2762 | | - $comment .= ": $reason"; |
| | 2762 | + $comment .= wfMsgExt( 'colon-separator', |
| | 2763 | + array( 'escapenoentities', 'content' ) ); |
| | 2764 | + $comment .= $reason; |
| 2763 | 2765 | } |
| 2764 | 2766 | |
| 2765 | 2767 | $newid = $nt->getArticleID(); |
| Index: trunk/phase3/RELEASE-NOTES |
| — | — | @@ -94,6 +94,9 @@ |
| 95 | 95 | background colours based on classes "odd" and "even". |
| 96 | 96 | * (bug 14187) In Special:Userlogin the buttons "Log in" and "E-mail new |
| 97 | 97 | password" now have classes "mw-loginbutton" and "mw-mailmypasswordbutton". |
| | 98 | +* HTML entities like now work (are not escaped) in edit summaries. |
| | 99 | +* (bug 13815) In the comment for page moves, use the colon-separator message |
| | 100 | + instead of a hardcoded colon. |
| 98 | 101 | |
| 99 | 102 | === Bug fixes in 1.14 === |
| 100 | 103 | |