| Index: trunk/phase3/includes/parser/CoreParserFunctions.php |
| — | — | @@ -236,13 +236,25 @@ |
| 237 | 237 | * @param string $text Desired title text |
| 238 | 238 | * @return string |
| 239 | 239 | */ |
| 240 | | - static function displaytitle( $parser, $displayTitle = '' ) { |
| | 240 | + static function displaytitle( $parser, $text = '' ) { |
| | 241 | + global $wgRestrictDisplayTitle; |
| | 242 | + |
| | 243 | + #list of disallowed tags for DISPLAYTITLE |
| | 244 | + #these will be escaped even though they are allowed in normal wiki text |
| | 245 | + $bad = array( 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'div', 'blockquote', 'ol', 'ul', 'li', |
| | 246 | + 'table', 'tr', 'th', 'td', 'dl', 'dd', 'caption', 'p', 'ruby', 'rb', 'rt', 'rp' ); |
| | 247 | + |
| 241 | 248 | #only requested titles that normalize to the actual title are allowed through |
| 242 | 249 | #mimic the escaping process that occurs in OutputPage::setPageTitle |
| 243 | | - $title = Title::newFromText( Sanitizer::stripAllTags( Sanitizer::normalizeCharReferences( Sanitizer::removeHTMLtags( $displayTitle ) ) ) ); |
| | 250 | + $text = Sanitizer::normalizeCharReferences( Sanitizer::removeHTMLtags( $text, null, array(), array(), $bad ) ); |
| | 251 | + $title = Title::newFromText( Sanitizer::stripAllTags( $text ) ); |
| 244 | 252 | |
| 245 | | - if ( $title instanceof Title && $title->getFragment() == '' && $title->equals( $parser->mTitle ) ) { |
| 246 | | - $parser->mOutput->setDisplayTitle( $displayTitle ); |
| | 253 | + if( !$wgRestrictDisplayTitle ) { |
| | 254 | + $parser->mOutput->setDisplayTitle( $text ); |
| | 255 | + } else { |
| | 256 | + if ( $title instanceof Title && $title->getFragment() == '' && $title->equals( $parser->mTitle ) ) { |
| | 257 | + $parser->mOutput->setDisplayTitle( $text ); |
| | 258 | + } |
| 247 | 259 | } |
| 248 | 260 | |
| 249 | 261 | return ''; |
| Index: trunk/phase3/includes/Sanitizer.php |
| — | — | @@ -338,9 +338,11 @@ |
| 339 | 339 | * @param string $text |
| 340 | 340 | * @param callback $processCallback to do any variable or parameter replacements in HTML attribute values |
| 341 | 341 | * @param array $args for the processing callback |
| | 342 | + * @param array $extratags for any extra tags to include |
| | 343 | + * @param array $removetags for any tags (default or extra) to exclude |
| 342 | 344 | * @return string |
| 343 | 345 | */ |
| 344 | | - static function removeHTMLtags( $text, $processCallback = null, $args = array(), $extratags = array() ) { |
| | 346 | + static function removeHTMLtags( $text, $processCallback = null, $args = array(), $extratags = array(), $removetags = array() ) { |
| 345 | 347 | global $wgUseTidy; |
| 346 | 348 | |
| 347 | 349 | static $htmlpairs, $htmlsingle, $htmlsingleonly, $htmlnest, $tabletags, |
| — | — | @@ -377,8 +379,10 @@ |
| 378 | 380 | 'li', |
| 379 | 381 | ); |
| 380 | 382 | |
| 381 | | - $htmlsingleallowed = array_merge( $htmlsingle, $tabletags ); |
| 382 | | - $htmlelements = array_merge( $htmlsingle, $htmlpairs, $htmlnest ); |
| | 383 | + $htmlsingleallowed = array_unique( array_merge( $htmlsingle, $tabletags ) ); |
| | 384 | + # Only allow elements that aren't specified in $removetags |
| | 385 | + # Doing it here since this is the top-level check |
| | 386 | + $htmlelements = array_diff( array_unique( array_merge( $htmlsingle, $htmlpairs, $htmlnest ) ), $removetags ); |
| 383 | 387 | |
| 384 | 388 | # Convert them all to hashtables for faster lookup |
| 385 | 389 | $vars = array( 'htmlpairs', 'htmlsingle', 'htmlsingleonly', 'htmlnest', 'tabletags', |
| Index: trunk/phase3/includes/DefaultSettings.php |
| — | — | @@ -3463,6 +3463,11 @@ |
| 3464 | 3464 | $wgAllowDisplayTitle = true; |
| 3465 | 3465 | |
| 3466 | 3466 | /** |
| | 3467 | + * for consistency, restrict DISPLAYTITLE to titles that normalize to the same canonical DB key |
| | 3468 | + */ |
| | 3469 | +$wgRestrictDisplayTitle = true; |
| | 3470 | + |
| | 3471 | +/** |
| 3467 | 3472 | * Array of usernames which may not be registered or logged in from |
| 3468 | 3473 | * Maintenance scripts can still use these |
| 3469 | 3474 | */ |
| Index: trunk/phase3/RELEASE-NOTES |
| — | — | @@ -26,15 +26,12 @@ |
| 27 | 27 | * Added $wgNoFollowDomainExceptions to allow exempting particular domain names |
| 28 | 28 | from rel="nofollow" on external links |
| 29 | 29 | * (bug 12970) Brought back $wgUseImageResize. |
| 30 | | -* Added $wgRedirectOnLogin to allow specifying a page to redirect users to upon |
| 31 | | - logging in (for example, "Main Page") |
| | 30 | +* Added $wgRedirectOnLogin to allow specifying a specifc page to redirect users |
| | 31 | + to upon logging in (ex: "Main Page") |
| 32 | 32 | * Add $wgExportFromNamespaces for enabling/disabling the "export all from |
| 33 | 33 | namespace" option (disabled by default) |
| 34 | 34 | * (bug 18222) $wgMinimalPasswordLength default is now 1 |
| 35 | 35 | * $wgSessionHandler can be used to configure session.save_handler |
| 36 | | -* Removed $wgRestrictDisplayTitle, in effect permanently setting it to true. |
| 37 | | - Without this variable, the DISPLAYTITLE magic word will only accept titles |
| 38 | | - that are equivalent to the actual page title. |
| 39 | 36 | |
| 40 | 37 | === New features in 1.15 === |
| 41 | 38 | |