Merge "Avoid cached lag logging spam from changes list pages"

diff --git a/includes/Linker.php b/includes/Linker.php
index 049fb07..2c7f44c 100644 (file)
--- a/includes/Linker.php
+++ b/includes/Linker.php
@@ -112,7 +112,7 @@ class Linker {
                if ( $html !== null ) {
                        $text = new HtmlArmor( $html );
                } else {
-                       $text = $html; // null
+                       $text = null;
                }
 
                if ( in_array( 'known', $options, true ) ) {
@@ -823,13 +823,20 @@ class Linker {
 
        /**
         * Make an external link
+        *
         * @since 1.16.3. $title added in 1.21
         * @param string $url URL to link to
+        * @param-taint $url escapes_html
         * @param string $text Text of link
+        * @param-taint $text escapes_html
         * @param bool $escape Do we escape the link text?
+        * @param-taint $escape none
         * @param string $linktype Type of external link. Gets added to the classes
+        * @param-taint $linktype escapes_html
         * @param array $attribs Array of extra attributes to <a>
+        * @param-taint $attribs escapes_html
         * @param Title|null $title Title object used for title specific link attributes
+        * @param-taint $title none
         * @return string
         */
        public static function makeExternalLink( $url, $text, $escape = true,

diff --git a/includes/OutputPage.php b/includes/OutputPage.php
index 461df94..0695443 100644 (file)
--- a/includes/OutputPage.php
+++ b/includes/OutputPage.php
@@ -953,6 +953,8 @@ class OutputPage extends ContextSource {
         * good tags like \<i\> will be dropped entirely.
         *
         * @param string|Message $name
+        * @param-taint $name tainted
+        * Phan-taint-check gets very confused by $name being either a string or a Message
         */
        public function setPageTitle( $name ) {
                if ( $name instanceof Message ) {
@@ -966,7 +968,7 @@ class OutputPage extends ContextSource {
 
                # change "<i>foo&amp;bar</i>" to "foo&bar"
                $this->setHTMLTitle(
-                       $this->msg( 'pagetitle' )->rawParams( Sanitizer::stripAllTags( $nameWithTags ) )
+                       $this->msg( 'pagetitle' )->plaintextParams( Sanitizer::stripAllTags( $nameWithTags ) )
                                ->inContentLanguage()
                );
        }

diff --git a/includes/api/ApiFormatPhp.php b/includes/api/ApiFormatPhp.php
index 45bdb6d..616b341 100644 (file)
--- a/includes/api/ApiFormatPhp.php
+++ b/includes/api/ApiFormatPhp.php
@@ -30,6 +30,9 @@ class ApiFormatPhp extends ApiFormatBase {
                return 'application/vnd.php.serialized';
        }
 
+       /**
+        * @suppress SecurityCheck-XSS Output type is not text/html
+        */
        public function execute() {
                $params = $this->extractRequestParams();
 

diff --git a/includes/export/WikiExporter.php b/includes/export/WikiExporter.php
index e6b9719..88282bd 100644 (file)
--- a/includes/export/WikiExporter.php
+++ b/includes/export/WikiExporter.php
@@ -233,10 +233,10 @@ class WikiExporter {
                foreach ( $res as $row ) {
                        $this->author_list .= "<contributor>" .
                                "<username>" .
-                               htmlentities( $row->rev_user_text ) .
+                               htmlspecialchars( $row->rev_user_text ) .
                                "</username>" .
                                "<id>" .
-                               $row->rev_user .
+                               ( (int)$row->rev_user ) .
                                "</id>" .
                                "</contributor>";
                }

diff --git a/includes/page/ImageHistoryList.php b/includes/page/ImageHistoryList.php
index 5313334..e488b6c 100644 (file)
--- a/includes/page/ImageHistoryList.php
+++ b/includes/page/ImageHistoryList.php
@@ -194,16 +194,18 @@ class ImageHistoryList extends ContextSource {
                $row .= "<td $selected style='white-space: nowrap;'>";
                if ( !$file->userCan( File::DELETED_FILE, $user ) ) {
                        # Don't link to unviewable files
-                       $row .= '<span class="history-deleted">'
-                               . $lang->userTimeAndDate( $timestamp, $user ) . '</span>';
+                       $row .= Html::element( 'span', [ 'class' => 'history-deleted' ],
+                               $lang->userTimeAndDate( $timestamp, $user )
+                       );
                } elseif ( $file->isDeleted( File::DELETED_FILE ) ) {
+                       $timeAndDate = htmlspecialchars( $lang->userTimeAndDate( $timestamp, $user ) );
                        if ( $local ) {
                                $this->preventClickjacking();
                                $revdel = SpecialPage::getTitleFor( 'Revisiondelete' );
                                # Make a link to review the image
                                $url = Linker::linkKnown(
                                        $revdel,
-                                       $lang->userTimeAndDate( $timestamp, $user ),
+                                       $timeAndDate,
                                        [],
                                        [
                                                'target' => $this->title->getPrefixedText(),
@@ -212,12 +214,13 @@ class ImageHistoryList extends ContextSource {
                                        ]
                                );
                        } else {
-                               $url = $lang->userTimeAndDate( $timestamp, $user );
+                               $url = $timeAndDate;
                        }
                        $row .= '<span class="history-deleted">' . $url . '</span>';
                } elseif ( !$file->exists() ) {
-                       $row .= '<span class="mw-file-missing">'
-                               . $lang->userTimeAndDate( $timestamp, $user ) . '</span>';
+                       $row .= Html::element( 'span', [ 'class' => 'mw-file-missing' ],
+                               $lang->userTimeAndDate( $timestamp, $user )
+                       );
                } else {
                        $url = $iscur ? $this->current->getUrl() : $this->current->getArchiveUrl( $img );
                        $row .= Xml::element(
@@ -265,9 +268,12 @@ class ImageHistoryList extends ContextSource {
                        $row .= '<td><span class="history-deleted">' .
                                $this->msg( 'rev-deleted-comment' )->escaped() . '</span></td>';
                } else {
-                       $row .=
-                               '<td dir="' . MediaWikiServices::getInstance()->getContentLanguage()->getDir() .
-                               '">' . Linker::formatComment( $description, $this->title ) . '</td>';
+                       $contLang = MediaWikiServices::getInstance()->getContentLanguage();
+                       $row .= Html::rawElement(
+                               'td',
+                               [ 'dir' => $contLang->getDir() ],
+                               Linker::formatComment( $description, $this->title )
+                       );
                }
 
                $rowClass = null;

diff --git a/includes/specials/SpecialRecentchanges.php b/includes/specials/SpecialRecentchanges.php
index 1e016a5..d274c88 100644 (file)
--- a/includes/specials/SpecialRecentchanges.php
+++ b/includes/specials/SpecialRecentchanges.php
@@ -912,7 +912,7 @@ class SpecialRecentChanges extends ChangesListSpecialPage {
                        'span',
                        [ 'class' => 'rclistfrom' ],
                        $this->makeOptionsLink(
-                               $this->msg( 'rclistfrom' )->rawParams( $now, $timenow, $datenow )->parse(),
+                               $this->msg( 'rclistfrom' )->plaintextParams( $now, $timenow, $datenow )->parse(),
                                [ 'from' => $timestamp ],
                                $nondefaults
                        )

diff --git a/includes/specials/SpecialSearch.php b/includes/specials/SpecialSearch.php
index ec6c5b9..e6d0632 100644 (file)
--- a/includes/specials/SpecialSearch.php
+++ b/includes/specials/SpecialSearch.php
@@ -167,21 +167,7 @@ class SpecialSearch extends SpecialPage {
                                $url = str_replace( '$1', urlencode( $term ), $searchForwardUrl );
                                $out->redirect( $url );
                        } else {
-                               $out->addHTML(
-                                       "<fieldset>" .
-                                               "<legend>" .
-                                                       $this->msg( 'search-external' )->escaped() .
-                                               "</legend>" .
-                                               "<p class='mw-searchdisabled'>" .
-                                                       $this->msg( 'searchdisabled' )->escaped() .
-                                               "</p>" .
-                                               $this->msg( 'googlesearch' )->rawParams(
-                                                       htmlspecialchars( $term ),
-                                                       'UTF-8',
-                                                       $this->msg( 'searchbutton' )->escaped()
-                                               )->text() .
-                                       "</fieldset>"
-                               );
+                               $this->showGoogleSearch( $term );
                        }
 
                        return;
@@ -190,6 +176,31 @@ class SpecialSearch extends SpecialPage {
                $this->showResults( $term );
        }
 
+       /**
+        * Output a google search form if search is disabled
+        *
+        * @param string $term Search term
+        * @todo FIXME Maybe we should get rid of this raw html message at some future time
+        * @suppress SecurityCheck-XSS
+        */
+       private function showGoogleSearch( $term ) {
+               $this->getOutput()->addHTML(
+                       "<fieldset>" .
+                               "<legend>" .
+                                       $this->msg( 'search-external' )->escaped() .
+                               "</legend>" .
+                               "<p class='mw-searchdisabled'>" .
+                                       $this->msg( 'searchdisabled' )->escaped() .
+                               "</p>" .
+                               $this->msg( 'googlesearch' )->rawParams(
+                                       htmlspecialchars( $term ),
+                                       'UTF-8',
+                                       $this->msg( 'searchbutton' )->escaped()
+                               )->text() .
+                       "</fieldset>"
+               );
+       }
+
        /**
         * Set up basic search parameters from the request and user settings.
         *