reverting r109723 because of slush.

diff --git a/RELEASE-NOTES-1.19 b/RELEASE-NOTES-1.19
index b7d1164..0150d35 100644 (file)
--- a/RELEASE-NOTES-1.19
+++ b/RELEASE-NOTES-1.19
@@ -26,9 +26,6 @@ production.
 * (bug 32239) Removed wgEnableTooltipsAndAccesskeys.
 * Removed $wgVectorShowVariantName.
 * Removed $wgExtensionAliasesFiles. Use wgExtensionMessagesFiles.
-* Introduced $wgAllowATag to allow <a> tags to be used for external links,
-  so rel and ref attributes can be used with microdata resp RDFa.
-  Defaults is false.
 
 === New features in 1.19 ===
 * (bug 19838) Possibility to get all interwiki prefixes if the interwiki

diff --git a/includes/DefaultSettings.php b/includes/DefaultSettings.php
index 088a5f9..3b38281 100644 (file)
--- a/includes/DefaultSettings.php
+++ b/includes/DefaultSettings.php
@@ -2238,13 +2238,11 @@ $wgAllowRdfaAttributes = false;
 
 /**
  * Enabled HTML5 microdata attributes for use in wikitext, if $wgHtml5 is also true.
- * See also $wgAllowATag.
  */
 $wgAllowMicrodataAttributes = false;
 
 /**
  * Cleanup as much presentational html like valign -> css vertical-align as we can
- * See also $wgAllowATag.
  */
 $wgCleanupPresentationalAttributes = true;
 
@@ -2976,14 +2974,6 @@ $wgEnableImageWhitelist = true;
  */
 $wgAllowImageTag = false;
 
-/**
- * Allow <a> tags for specifying external links, so it becomes possible to
- * provide ref and rel attributes. This allows for microdata/microformats/RDFa
- * annotations to be embedded on wiki pages. See also $wgAllowRdfaAttributes
- * and $wgAllowMicrodataAttributes.
- */
-$wgAllowATag = false;
-
 /**
  * $wgUseTidy: use tidy to make sure HTML output is sane.
  * Tidy is a free tool that fixes broken HTML.

diff --git a/includes/Sanitizer.php b/includes/Sanitizer.php
index 3f7175a..196abd9 100644 (file)
--- a/includes/Sanitizer.php
+++ b/includes/Sanitizer.php
@@ -407,11 +407,6 @@ class Sanitizer {
                                $htmlsingleonly[] = 'img';
                        }
 
-                       global $wgAllowATag;
-                       if ( $wgAllowATag ) {
-                               $htmlpairsStatic[] = 'a';
-                       }
-
                        $htmlsingleallowed = array_unique( array_merge( $htmlsingle, $tabletags ) );
                        $htmlelementsStatic = array_unique( array_merge( $htmlsingle, $htmlpairsStatic, $htmlnest ) );
 
@@ -802,23 +797,6 @@ class Sanitizer {
                                }
                        }
 
-                       if ( $attribute === 'href' || $attribute === 'src' ) {
-                               if ( !preg_match( $hrefExp, $value ) ) {
-                                       continue; //drop any href or src attributes not using an allowed protocol.
-                                                 //NOTE: this also drops all relative URLs
-                               }
-                       }
-
-                       //RDFa properties allow URIs. check them
-                       if ( $attribute === 'rel' || $attribute === 'rev' || 
-                               $attribute === 'about' || $attribute === 'property' || $attribute === 'resource' ||
-                               $attribute === 'datatype' || $attribute === 'typeof' ) {  
-                               //Paranoia. Allow "simple" values but suppress javascript
-                               if ( preg_match( '/(^|\s)javascript\s*:/i', $value ) ) {
-                                       continue; 
-                               }
-                       }
-
                        // If this attribute was previously set, override it.
                        // Output should only have one attribute of each name.
                        $out[$attribute] = $value;
@@ -1594,7 +1572,7 @@ class Sanitizer {
                        'td'         => array_merge( $common, $tablecell, $tablealign ),
                        'th'         => array_merge( $common, $tablecell, $tablealign ),
 
-                       # 12.2 
+                       # 12.2 # NOTE: <a> is not allowed directly, but the attrib whitelist is used from the Parser object
                        'a'          => array_merge( $common, array( 'href', 'rel', 'rev' ) ), # rel/rev esp. for RDFa
 
                        # 13.2