r70044 MediaWiki - Code Review archive

Repository:MediaWiki
Revision:r70043‎ | r70044 | r70045 >
Date:21:01, 27 July 2010
Author:platonides
Status:deferred
Tags:
Comment:
Fix escaping issues.
Modified paths:
  • /trunk/extensions/Woopra/Woopra.php (modified) (history)

Diff [purge]

Index: trunk/extensions/Woopra/Woopra.php
@@ -21,26 +21,31 @@
2222 $wgExtensionCredits['other'][] = array(
2323 'path' => __FILE__,
2424 'name' => 'Woopra Live Stats Tracking',
25 - 'author' => array( 'Shane'),
26 - 'version' => '1.0.0',
 25+ 'author' => array( 'Shane' ),
 26+ 'version' => '1.1.0',
2727 'url' => 'http://www.mediawiki.org/wiki/Extension:Woopra',
2828 'descriptionmsg' => 'woopra-desc',
2929 );
3030
3131 $wgHooks['BeforePageDisplay'][] = 'fnWoopraJavascript';
32 -
 32+
 33+$wgWoopraSitekey = false;
 34+
3335 function fnWoopraJavascript($out)
3436 {
3537 global $wgUser, $wgWoopraSitekey;
3638
 39+ if ( $wgWoopraSitekey === false )
 40+ return true;
 41+
3742 $html = "<script type=\"text/javascript\">\r\n";
38 - $html .= "woopra_id = '" . $wgWoopraSitekey . "';\r\n";
 43+ $html .= "woopra_id = '" . Xml::escapeJsString( $wgWoopraSitekey ) . "';\r\n";
3944
4045 if (!$wgUser->isAnon())
4146 {
4247 $html .= "var woopra_array = new Array();\r\n";
43 - $html .= "woopra_array['name'] = '" . $wgUser->getRealName() . "';\r\n";
44 - $html .= "woopra_array['Email'] = '" . $wgUser->getEmail() . "';\r\n";
 48+ $html .= "woopra_array['name'] = '" . Xml::escapeJsString( $wgUser->getRealName() ) . "';\r\n";
 49+ $html .= "woopra_array['Email'] = '" . Xml::escapeJsString( $wgUser->getEmail() ) . "';\r\n";
4550 // Add custom tracking code here!
4651 }
4752 $html .= "</script>\r\n";

Status & tagging log