* Fix link in image alt text, using replaceLinkHolders with the global parser. This...

* Use the common attribute normalization code in the alt text de-tagification.

diff --git a/includes/Linker.php b/includes/Linker.php
index 25fad56..ee36c91 100644 (file)
--- a/includes/Linker.php
+++ b/includes/Linker.php
@@ -519,9 +519,13 @@ class Linker {
                        if ( '' == $manual_thumb ) $url = $img->createThumb( $width );
                }
 
-               $alt = preg_replace( '/<[^>]*>/', '', $alt );
-               $alt = preg_replace('/&(?!:amp;|#[Xx][0-9A-fa-f]+;|#[0-9]+;|[a-zA-Z0-9]+;)/', '&amp;', $alt);
-               $alt = str_replace( array('<', '>', '"'), array('&lt;', '&gt;', '&quot;'), $alt );
+               # FIXME: This is a gross hack using a global.
+               # Replace link color holders in the caption text so the
+               # text portion can be placed int the alt/title attributes.
+               global $wgParser;
+               $wgParser->replaceLinkHolders( $alt );
+               
+               $alt = Sanitizer::stripAllTags( $alt );
 
                $u = $nt->escapeLocalURL();
                if ( $url == '' ) {

diff --git a/includes/Sanitizer.php b/includes/Sanitizer.php
index 2729efc..fec5d72 100644 (file)
--- a/includes/Sanitizer.php
+++ b/includes/Sanitizer.php
@@ -795,6 +795,31 @@ class Sanitizer {
                        );
                return $whitelist;
        }
+       
+       /**
+        * Take a fragment of (potentially invalid) HTML and return
+        * a version with any tags removed, encoded suitably for literal
+        * inclusion in an attribute value.
+        *
+        * @param string $text HTML fragment
+        * @return string
+        */
+       function stripAllTags( $text ) {
+               # Actual <tags>
+               $text = preg_replace( '/<[^>]*>/', '', $text );
+               
+               # Normalize &entities and whitespace
+               $text = Sanitizer::normalizeAttributeValue( $text );
+               
+               # Will be placed into "double-quoted" attributes,
+               # make sure remaining bits are safe.
+               $text = str_replace(
+                       array('<', '>', '"'),
+                       array('&lt;', '&gt;', '&quot;'),
+                       $text );
+               
+               return $text;
+       }
 
 }