r45181 MediaWiki - Code Review archive

Repository:MediaWiki
Revision:r45180‎ | r45181 | r45182 >
Date:12:22, 30 December 2008
Author:aaron
Status:reverted (Comments)
Tags:
Comment:
(Bug 12998) Weaken DISPLAYTITLE restictions (patch by rememberthedot@gmail.com)
Modified paths:
  • /trunk/phase3/includes/EditPage.php (modified) (history)
  • /trunk/phase3/includes/OutputPage.php (modified) (history)
  • /trunk/phase3/includes/Skin.php (modified) (history)
  • /trunk/phase3/includes/parser/CoreParserFunctions.php (modified) (history)
  • /trunk/phase3/includes/parser/ParserOutput.php (modified) (history)
  • /trunk/phase3/skins/Modern.php (modified) (history)
  • /trunk/phase3/skins/MonoBook.php (modified) (history)

Diff [purge]

Index: trunk/phase3/skins/MonoBook.php
@@ -115,7 +115,7 @@
116116 <div id="content">
117117 <a name="top" id="top"></a>
118118 <?php if($this->data['sitenotice']) { ?><div id="siteNotice"><?php $this->html('sitenotice') ?></div><?php } ?>
119 - <h1 class="firstHeading"><?php $this->data['displaytitle']!=""?$this->html('title'):$this->text('title') ?></h1>
 119+ <h1 class="firstHeading"><?php $this->html('title'); ?></h1>
120120 <div id="bodyContent">
121121 <h3 id="siteSub"><?php $this->msg('tagline') ?></h3>
122122 <div id="contentSub"><?php $this->html('subtitle') ?></div>
@@ -371,3 +371,4 @@
372372 } // end of class
373373
374374
 375+
Index: trunk/phase3/skins/Modern.php
@@ -102,7 +102,7 @@
103103 class="mediawiki <?php $this->text('dir') ?> <?php $this->text('pageclass') ?> <?php $this->text('skinnameclass') ?>">
104104
105105 <!-- heading -->
106 - <div id="mw_header"><h1 id="firstHeading"><?php $this->data['displaytitle']!=""?$this->html('title'):$this->text('title') ?></h1></div>
 106+ <div id="mw_header"><h1 id="firstHeading"><?php $this->html('title') ?></h1></div>
107107
108108 <div id="mw_main">
109109 <div id="mw_contentwrapper">
Index: trunk/phase3/includes/parser/ParserOutput.php
@@ -29,7 +29,8 @@
3030 /**
3131 * Overridden title for display
3232 */
33 - private $displayTitle = false;
 33+ private $displayTitle = false; #for use in the <title> tag
 34+ private $displayTitleH1 = false; #for use in the <h1> tag, may contain further HTML tags
3435
3536 function ParserOutput( $text = '', $languageLinks = array(), $categoryLinks = array(),
3637 $containsOldMagic = false, $titletext = '' )
@@ -145,6 +146,15 @@
146147 }
147148
148149 /**
 150+ * Get the title to be used for display
 151+ *
 152+ * @return string
 153+ */
 154+ public function getDisplayTitle() {
 155+ return $this->displayTitle;
 156+ }
 157+
 158+ /**
149159 * Override the title to be used for display
150160 * -- this is assumed to have been validated
151161 * (check equal normalisation, etc.)
@@ -154,15 +164,14 @@
155165 public function setDisplayTitle( $text ) {
156166 $this->displayTitle = $text;
157167 }
158 -
159 - /**
160 - * Get the title to be used for display
161 - *
162 - * @return string
163 - */
164 - public function getDisplayTitle() {
165 - return $this->displayTitle;
 168+
 169+ public function getDisplayTitleH1() {
 170+ return $this->displayTitleH1;
166171 }
 172+
 173+ public function setDisplayTitleH1( $html ) {
 174+ $this->displayTitleH1 = $html;
 175+ }
167176
168177 /**
169178 * Fairly generic flag setter thingy.
Index: trunk/phase3/includes/parser/CoreParserFunctions.php
@@ -168,17 +168,24 @@
169169 * @param string $text Desired title text
170170 * @return string
171171 */
172 - static function displaytitle( $parser, $text = '' ) {
 172+ static function displaytitle( $parser, $displayTitleH1 = '' ) {
173173 global $wgRestrictDisplayTitle;
174 - $text = trim( Sanitizer::decodeCharReferences( $text ) );
175 -
 174+
 175+ $titleHTML = Sanitizer::removeHTMLtags( $displayTitleH1 ); #escape the bad tags
 176+ $titleText = trim( Sanitizer::stripAllTags( $titleHTML ) ); #remove the good tags, leaving the bad tags escaped, and trim it to make sure it comes out pretty
 177+
176178 if ( !$wgRestrictDisplayTitle ) {
177 - $parser->mOutput->setDisplayTitle( $text );
 179+ $parser->mOutput->setDisplayTitleH1( $titleHTML );
 180+ $parser->mOutput->setDisplayTitle( $titleText );
178181 } else {
179 - $title = Title::newFromText( $text );
180 - if( $title instanceof Title && $title->getFragment() == '' && $title->equals( $parser->mTitle ) )
181 - $parser->mOutput->setDisplayTitle( $text );
 182+ # Only requested titles that normalize to the actual title are allowed through
 183+ $title = Title::newFromText( $titleText );
 184+ if ( $title != null && $title->getFragment() == '' && $title->equals( $parser->mTitle ) ) {
 185+ $parser->mOutput->setDisplayTitleH1( $titleHTML );
 186+ $parser->mOutput->setDisplayTitle( $titleText ); #put the stripped contents of <h1> into <title>
 187+ }
182188 }
 189+
183190 return '';
184191 }
185192
Index: trunk/phase3/includes/EditPage.php
@@ -1085,12 +1085,14 @@
10861086 } else {
10871087 # Use the title defined by DISPLAYTITLE magic word when present
10881088 if ( isset( $this->mParserOutput )
1089 - && ( $dt = $this->mParserOutput->getDisplayTitle() ) !== false ) {
1090 - $title = $dt;
 1089+ && ( $displayTitle = $this->mParserOutput->getDisplayTitle() ) !== false )
 1090+ {
 1091+ $wgOut->setPageTitle( wfMsg( 'editing', $this->mParserOutput->getDisplayTitleH1() ) );
 1092+ # Override the HTML that setPageTitle slated for inclusion in the <title>
 1093+ $wgOut->setHTMLTitle( wfMsg( 'pagetitle', wfMsg( 'editing', $displayTitle ) ) );
10911094 } else {
1092 - $title = $wgTitle->getPrefixedText();
 1095+ $wgOut->setPageTitle( wfMsg( 'editing', $wgTitle->getPrefixedText() ) );
10931096 }
1094 - $wgOut->setPageTitle( wfMsg( 'editing', $title ) );
10951097 }
10961098 }
10971099
Index: trunk/phase3/includes/OutputPage.php
@@ -309,7 +309,10 @@
310310 }
311311 }
312312
313 - public function setHTMLTitle( $name ) {$this->mHTMLtitle = $name; }
 313+ # "HTML title" means <title>
 314+ public function setHTMLTitle( $name ) { $this->mHTMLtitle = $name; }
 315+
 316+ # "Page title" means <h1>
314317 public function setPageTitle( $name ) {
315318 global $action, $wgContLang;
316319 $name = $wgContLang->convert($name, true);
@@ -320,7 +323,7 @@
321324 $name .= ' - '.$taction;
322325 }
323326 }
324 -
 327+
325328 $this->setHTMLTitle( wfMsg( 'pagetitle', $name ) );
326329 }
327330 public function getHTMLTitle() { return $this->mHTMLtitle; }
@@ -539,8 +542,10 @@
540543 }
541544 }
542545 // Display title
543 - if( ( $dt = $parserOutput->getDisplayTitle() ) !== false )
544 - $this->setPageTitle( $dt );
 546+ if( ( $displayTitleText = $parserOutput->getDisplayTitle() ) !== false ) {
 547+ $this->setPageTitle( $parserOutput->getDisplayTitleH1() );
 548+ $this->setHTMLTitle( wfMsg( 'pagetitle', $displayTitleText ) ); #override the HTML that setPageTitle slated for inclusion in the <title>
 549+ }
545550
546551 // Hooks registered in the object
547552 global $wgParserOutputHooks;
Index: trunk/phase3/includes/Skin.php
@@ -1018,7 +1018,7 @@
10191019
10201020 function pageTitle() {
10211021 global $wgOut;
1022 - $s = '<h1 class="pagetitle">' . htmlspecialchars( $wgOut->getPageTitle() ) . '</h1>';
 1022+ $s = '<h1 class="pagetitle">' . $wgOut->getPageTitle() . '</h1>';
10231023 return $s;
10241024 }
10251025

Follow-up revisions

RevisionCommit summaryAuthorDate
r45226Pull back r45181 "(Bug 12998) Weaken DISPLAYTITLE restictions (patch by remem...brion16:49, 31 December 2008
r49330(bug 12998) Allow <sup>, <sub>, etc. in DISPLAYTITLErememberthedot05:15, 9 April 2009

Past revisions this follows-up on

RevisionCommit summaryAuthorDate
r44271(bug 12998) Weaken DISPLAYTITLE restictions (patch by 'rememberthedot@gmail.c...aaron18:00, 6 December 2008
r44432Revert r44271 "(bug 12998) Weaken DISPLAYTITLE restictions (patch by 'remembe...brion23:21, 10 December 2008

Comments

#Comment by IAlex (talk | contribs)   13:40, 30 December 2008

This completely changed the behaviour of OutputPage::setPageTitle() which previously escaped its content but now allows arbitrary HTML content. One problem is that any page containing a "&" in its title produces invalid XHTML.

#Comment by Brion VIBBER (talk | contribs)   16:50, 31 December 2008

Rolled back for now in r45226 pending resolution.

Status & tagging log