Merge "(bug 37587) Enforce language codes to be html safe"

[lhc/web/wiklou.git] / languages / Language.php

diff --git a/languages/Language.php b/languages/Language.php
index 656f5d0..430209d 100644 (file)
--- a/languages/Language.php
+++ b/languages/Language.php
@@ -1,6 +1,21 @@
 <?php
 /**
- * Internationalisation code
+ * Internationalisation code.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+ * http://www.gnu.org/copyleft/gpl.html
  *
  * @file
  * @ingroup Language
@@ -231,7 +246,11 @@ class Language {
         */
        public static function isValidCode( $code ) {
                return
-                       strcspn( $code, ":/\\\000" ) === strlen( $code )
+                       // People think language codes are html safe, so enforce it.
+                       // Ideally we should only allow a-zA-Z0-9-
+                       // but, .+ and other chars are often used for {{int:}} hacks
+                       // see bugs 37564, 37587, 36938
+                       strcspn( $code, ":/\\\000&<>'\"" ) === strlen( $code )
                        && !preg_match( Title::getTitleInvalidRegex(), $code );
        }
 
@@ -241,6 +260,7 @@ class Language {
         *
         * @param $code string
         *
+        * @throws MWException
         * @since 1.18
         * @return bool
         */
@@ -3672,6 +3692,9 @@ class Language {
        /**
         * Get the RFC 3066 code for this language object
         *
+        * NOTE: The return value of this function is NOT HTML-safe and must be escaped with
+        * htmlspecialchars() or similar
+        *
         * @return string
         */
        public function getCode() {
@@ -3681,6 +3704,10 @@ class Language {
        /**
         * Get the code in Bcp47 format which we can use
         * inside of html lang="" tags.
+        *
+        * NOTE: The return value of this function is NOT HTML-safe and must be escaped with
+        * htmlspecialchars() or similar.
+        *
         * @since 1.19
         * @return string
         */
@@ -3884,7 +3911,7 @@ class Language {
        /**
         * Decode an expiry (block, protection, etc) which has come from the DB
         *
-        * @FIXME: why are we returnings DBMS-dependent strings???
+        * @todo FIXME: why are we returnings DBMS-dependent strings???
         *
         * @param $expiry String: Database expiry String
         * @param $format Bool|Int true to process using language functions, or TS_ constant
@@ -4093,7 +4120,7 @@ class Language {
         * @param $title Title object to link
         * @param $offset Integer offset parameter
         * @param $limit Integer limit parameter
-        * @param $query String optional URL query parameter string
+        * @param $query array|String optional URL query parameter string
         * @param $atend Bool optional param for specified if this is the last page
         * @return String
         */