Merge "Strengthened validation for HashRing a bit."

diff --git a/RELEASE-NOTES-1.22 b/RELEASE-NOTES-1.22
index ad12bf9..569a2b9 100644 (file)
--- a/RELEASE-NOTES-1.22
+++ b/RELEASE-NOTES-1.22
@@ -16,6 +16,8 @@ production.
   Special:UserLogin/signup is activated.
 * $wgVectorUseIconWatch is now enabled by default.
 * $wgCascadingRestrictionLevels was added.
+* ftps, ssh, sftp, xmpp, sip, sips, tel, sms, bitcoin, magnet, urn, and geo
+  have been whitelisted inside of $wgUrlProtocols.
 
 === New features in 1.22 ===
 * (bug 44525) mediawiki.jqueryMsg can now parse (whitelisted) HTML elements and attributes.

diff --git a/includes/DefaultSettings.php b/includes/DefaultSettings.php
index 46ca7ed..bcc4ae4 100644 (file)
--- a/includes/DefaultSettings.php
+++ b/includes/DefaultSettings.php
@@ -3377,17 +3377,29 @@ $wgUrlProtocols = array(
        'http://',
        'https://',
        'ftp://',
+       'ftps://', // If we allow ftp:// we should allow the secure version.
+       'ssh://',
+       'sftp://', // SFTP > FTP
        'irc://',
        'ircs://', // @bug 28503
+       'xmpp:', // Another open communication protocol
+       'sip:',
+       'sips:',
        'gopher://',
        'telnet://', // Well if we're going to support the above.. -ævar
        'nntp://', // @bug 3808 RFC 1738
        'worldwind://',
        'mailto:',
+       'tel:', // If we can make emails linkable, why not phone numbers?
+       'sms:', // Likewise this is standardized too
        'news:',
        'svn://',
        'git://',
        'mms://',
+       'bitcoin:', // Even registerProtocolHandler whitelists this along with mailto:
+       'magnet:', // No reason to reject torrents over magnet: when they're allowed over http://
+       'urn:', // Allow URNs to be used in Microdata/RDFa <link ... href="urn:...">s
+       'geo:', // geo: urls define locations, they're useful in Microdata/RDFa and when mentioning coordinates.
        '//', // for protocol-relative URLs
 );
 

diff --git a/includes/OutputPage.php b/includes/OutputPage.php
index 746cd0e..bb4604f 100644 (file)
--- a/includes/OutputPage.php
+++ b/includes/OutputPage.php
@@ -1296,7 +1296,6 @@ class OutputPage extends ContextSource {
         * Return whether user JavaScript is allowed for this page
         * @deprecated since 1.18 Load modules with ResourceLoader, and origin and
         *     trustworthiness is identified and enforced automagically.
-        *     Will be removed in 1.20.
         * @return Boolean
         */
        public function isUserJsAllowed() {

diff --git a/includes/Preferences.php b/includes/Preferences.php
index 972e2c6..bb386f2 100644 (file)
--- a/includes/Preferences.php
+++ b/includes/Preferences.php
@@ -1476,7 +1476,7 @@ class Preferences {
        }
 
        /**
-        * @deprecated in 1.19; will be removed in 1.20.
+        * @deprecated in 1.19
         * @param $user User
         * @return array
         */

diff --git a/includes/Title.php b/includes/Title.php
index 70e8cd4..c97056f 100644 (file)
--- a/includes/Title.php
+++ b/includes/Title.php
@@ -2242,7 +2242,7 @@ class Title {
         * Protect css subpages of user pages: can $wgUser edit
         * this page?
         *
-        * @deprecated in 1.19; will be removed in 1.20. Use getUserPermissionsErrors() instead.
+        * @deprecated in 1.19; use getUserPermissionsErrors() instead.
         * @return Bool
         */
        public function userCanEditCssSubpage() {
@@ -2256,7 +2256,7 @@ class Title {
         * Protect js subpages of user pages: can $wgUser edit
         * this page?
         *
-        * @deprecated in 1.19; will be removed in 1.20. Use getUserPermissionsErrors() instead.
+        * @deprecated in 1.19; use getUserPermissionsErrors() instead.
         * @return Bool
         */
        public function userCanEditJsSubpage() {
@@ -2349,7 +2349,7 @@ class Title {
        /**
         * Update the title protection status
         *
-        * @deprecated in 1.19; will be removed in 1.20. Use WikiPage::doUpdateRestrictions() instead.
+        * @deprecated in 1.19; use WikiPage::doUpdateRestrictions() instead.
         * @param $create_perm String Permission required for creation
         * @param string $reason Reason for protection
         * @param string $expiry Expiry timestamp

diff --git a/includes/Xml.php b/includes/Xml.php
index c62cbdf..3eedeb2 100644 (file)
--- a/includes/Xml.php
+++ b/includes/Xml.php
@@ -739,8 +739,8 @@ class Xml {
        /**
         * Generate a form (without the opening form element).
         * Output optionally includes a submit button.
-        * @param array $fields Associative array, key is message corresponding to a description for the field (colon is in the message), value is appropriate input.
-        * @param string $submitLabel A message containing a label for the submit button.
+        * @param array $fields Associative array, key is the name of a message that contains a description for the field, value is an HTML string containing the appropriate input.
+        * @param string $submitLabel The name of a message containing a label for the submit button.
         * @return string HTML form.
         */
        public static function buildForm( $fields, $submitLabel = null ) {
@@ -750,6 +750,11 @@ class Xml {
                foreach ( $fields as $labelmsg => $input ) {
                        $id = "mw-$labelmsg";
                        $form .= Xml::openElement( 'tr', array( 'id' => $id ) );
+
+                       // TODO use a <label> here for accessibility purposes - will need
+                       // to either not use a table to build the form, or find the ID of
+                       // the input somehow.
+
                        $form .= Xml::tags( 'td', array( 'class' => 'mw-label' ), wfMessage( $labelmsg )->parse() );
                        $form .= Xml::openElement( 'td', array( 'class' => 'mw-input' ) ) . $input . Xml::closeElement( 'td' );
                        $form .= Xml::closeElement( 'tr' );

diff --git a/includes/parser/ParserOptions.php b/includes/parser/ParserOptions.php
index 2bd5a5d..b01f162 100644 (file)
--- a/includes/parser/ParserOptions.php
+++ b/includes/parser/ParserOptions.php
@@ -312,7 +312,7 @@ class ParserOptions {
        function setAllowSpecialInclusion( $x )     { return wfSetVar( $this->mAllowSpecialInclusion, $x ); }
        function setTidy( $x )                      { return wfSetVar( $this->mTidy, $x ); }
 
-       /** @deprecated in 1.19; will be removed in 1.20 */
+       /** @deprecated in 1.19 */
        function setSkin( $x )                      { wfDeprecated( __METHOD__, '1.19' ); }
        function setInterfaceMessage( $x )          { return wfSetVar( $this->mInterfaceMessage, $x ); }
        function setTargetLanguage( $x )            { return wfSetVar( $this->mTargetLanguage, $x, true ); }

diff --git a/includes/specials/SpecialAllpages.php b/includes/specials/SpecialAllpages.php
index 98ec4f6..a082049 100644 (file)
--- a/includes/specials/SpecialAllpages.php
+++ b/includes/specials/SpecialAllpages.php
@@ -308,8 +308,10 @@ class SpecialAllpages extends IncludableSpecialPage {
        function showline( $inpoint, $outpoint, $namespace = NS_MAIN, $hideRedirects = false ) {
                // Use content language since page titles are considered to use content language
                global $wgContLang;
-               $inpointf = htmlspecialchars( str_replace( '_', ' ', $inpoint ) );
-               $outpointf = htmlspecialchars( str_replace( '_', ' ', $outpoint ) );
+
+               $inpointf = str_replace( '_', ' ', $inpoint );
+               $outpointf = str_replace( '_', ' ', $outpoint );
+
                // Don't let the length runaway
                $inpointf = $wgContLang->truncate( $inpointf, $this->maxPageLength );
                $outpointf = $wgContLang->truncate( $outpointf, $this->maxPageLength );
@@ -326,12 +328,13 @@ class SpecialAllpages extends IncludableSpecialPage {
                        $queryParams['hideredirects'] = 1;
                }
 
-               $link = htmlspecialchars(
-                       $this->getTitle()->getLocalURL( $queryParams ) );
+               $url = $this->getTitle()->getLocalURL( $queryParams );
+               $inlink = Html::element( 'a', array( 'href' => $url ), $inpointf );
+               $outlink = Html::element( 'a', array( 'href' => $url ), $outpointf );
 
                $out = $this->msg( 'alphaindexline' )->rawParams(
-                       "<a href=\"$link\">$inpointf</a></td><td>",
-                       "</td><td><a href=\"$link\">$outpointf</a>"
+                       "$inlink</td><td>",
+                       "</td><td>$outlink"
                )->escaped();
 
                return '<tr><td class="mw-allpages-alphaindexline">' . $out . '</td></tr>';

diff --git a/tests/qunit/suites/resources/jquery/jquery.tablesorter.test.js b/tests/qunit/suites/resources/jquery/jquery.tablesorter.test.js
index 1a380a5..7c8503b 100644 (file)
--- a/tests/qunit/suites/resources/jquery/jquery.tablesorter.test.js
+++ b/tests/qunit/suites/resources/jquery/jquery.tablesorter.test.js
@@ -5,6 +5,8 @@
                wgMonthNames: ['', 'January', 'February', 'March', 'April', 'May', 'June', 'July', 'August', 'September', 'October', 'November', 'December'],
                wgMonthNamesShort: ['', 'Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun', 'Jul', 'Aug', 'Sep', 'Oct', 'Nov', 'Dec'],
                wgDefaultDateFormat: 'dmy',
+               wgSeparatorTransformTable: ['', ''],
+               wgDigitTransformTable: ['', ''],
                wgContentLanguage: 'en'
        };