Whitelist additional WAI-ARIA attributes, and all role values
authorMatt Fitzpatrick <mattfitzpat@sbcglobal.net>
Mon, 18 Jan 2016 01:19:26 +0000 (17:19 -0800)
committerTim Starling <tstarling@wikimedia.org>
Thu, 28 Jan 2016 00:29:40 +0000 (00:29 +0000)
commit13978635694119e0a75b61ae7020a247fb4c12d8
tree19fbc72c5ce6e1519d92be035e4bdac9674142ba
parent7c4bd85d2152fd9fa975ea0fb5ffb1a0b804f99b
Whitelist additional WAI-ARIA attributes, and all role values

Adds the attributes aria-describedby, aria-flowto, aria-label,
aria-labelledby, and aria-owns to the attribute whitelist for all
elements.

Adds Sanitizer::escapeIdReferenceList() to escape attributes
containing space delimited HTML id lists, in the same manner as
Sanitizer::escapeId().

Removes the role="presentation" restriction. Allows all values for
the role attribute.

Bug: T26659
Change-Id: I3a29d727c61f46ac115ca2e50fcb14deeea34418
RELEASE-NOTES-1.27
includes/Sanitizer.php
tests/phpunit/includes/SanitizerTest.php