X-Git-Url: http://git.cyclocoop.org/?a=blobdiff_plain;f=includes%2FHtml.php;h=aa51243d75ebe1236f7356f479c8f705960f096a;hb=aa9bbc47c3b043479aba45ab8e76b663826b780f;hp=dba4c67a72a00e5753c7adf6e6af4b2ea5d1a69d;hpb=b79bc0a2740b991525aae355ed216e0b9dc3aa86;p=lhc%2Fweb%2Fwiklou.git

diff --git a/includes/Html.php b/includes/Html.php
index dba4c67a72..aa51243d75 100644
--- a/includes/Html.php
+++ b/includes/Html.php
@@ -213,7 +213,7 @@ class Html {
 			// Silly XML.
 			return substr( $start, 0, -1 ) . '/>';
 		} else {
-			return "$start$contents" . self::closeElement( $element );
+			return $start . $contents . self::closeElement( $element );
 		}
 	}
 
@@ -255,6 +255,12 @@ class Html {
 		// consistency and better compression.
 		$element = strtolower( $element );
 
+		// Some people were abusing this by passing things like
+		// 'h1 id="foo" to $element, which we don't want.
+		if ( strpos( $element, ' ' ) !== false ) {
+			wfWarn( __METHOD__ . " given element name with space '$element'" );
+		}
+
 		// Remove invalid input types
 		if ( $element == 'input' ) {
 			$validTypes = [
@@ -552,10 +558,13 @@ class Html {
 	}
 
 	/**
-	 * Output a "<script>" tag with the given contents.
+	 * Output an HTML script tag with the given contents.
 	 *
-	 * @todo do some useful escaping as well, like if $contents contains
-	 * literal "</script>" or (for XML) literal "]]>".
+	 * It is unsupported for the contents to contain the sequence `<script` or `</script`
+	 * (case-insensitive). This ensures the script can be terminated easily and consistently.
+	 * It is the responsibility of the caller to avoid such character sequence by escaping
+	 * or avoiding it. If found at run-time, the contents are replaced with a comment, and
+	 * a warning is logged server-side.
 	 *
 	 * @param string $contents JavaScript
 	 * @param string|null $nonce Nonce for CSP header, from OutputPage::getCSPNonce()
@@ -565,14 +574,13 @@ class Html {
 		$attrs = [];
 		if ( $nonce !== null ) {
 			$attrs['nonce'] = $nonce;
-		} else {
-			if ( ContentSecurityPolicy::isNonceRequired( RequestContext::getMain()->getConfig() ) ) {
-				wfWarn( "no nonce set on script. CSP will break it" );
-			}
+		} elseif ( ContentSecurityPolicy::isNonceRequired( RequestContext::getMain()->getConfig() ) ) {
+			wfWarn( "no nonce set on script. CSP will break it" );
 		}
 
-		if ( preg_match( '/[<&]/', $contents ) ) {
-			$contents = "/*<![CDATA[*/$contents/*]]>*/";
+		if ( preg_match( '/<\/?script/i', $contents ) ) {
+			wfLogWarning( __METHOD__ . ': Illegal character sequence found in inline script.' );
+			$contents = '/* ERROR: Invalid script */';
 		}
 
 		return self::rawElement( 'script', $attrs, $contents );
@@ -590,10 +598,8 @@ class Html {
 		$attrs = [ 'src' => $url ];
 		if ( $nonce !== null ) {
 			$attrs['nonce'] = $nonce;
-		} else {
-			if ( ContentSecurityPolicy::isNonceRequired( RequestContext::getMain()->getConfig() ) ) {
-				wfWarn( "no nonce set on script. CSP will break it" );
-			}
+		} elseif ( ContentSecurityPolicy::isNonceRequired( RequestContext::getMain()->getConfig() ) ) {
+			wfWarn( "no nonce set on script. CSP will break it" );
 		}
 
 		return self::element( 'script', $attrs );
@@ -836,9 +842,14 @@ class Html {
 			// Value is provided by user, the name shown is localized for the user.
 			$options[$params['all']] = wfMessage( 'namespacesall' )->text();
 		}
-		// Add all namespaces as options (in the content language)
-		$options +=
-			MediaWikiServices::getInstance()->getContentLanguage()->getFormattedNamespaces();
+		if ( $params['in-user-lang'] ?? false ) {
+			global $wgLang;
+			$lang = $wgLang;
+		} else {
+			$lang = MediaWikiServices::getInstance()->getContentLanguage();
+		}
+		// Add all namespaces as options
+		$options += $lang->getFormattedNamespaces();
 
 		$optionsOut = [];
 		// Filter out namespaces below 0 and massage labels
@@ -851,8 +862,7 @@ class Html {
 				// main we don't use "" but the user message describing it (e.g. "(Main)" or "(Article)")
 				$nsName = wfMessage( 'blanknamespace' )->text();
 			} elseif ( is_int( $nsId ) ) {
-				$nsName = MediaWikiServices::getInstance()->getContentLanguage()->
-					convertNamespace( $nsId );
+				$nsName = $lang->convertNamespace( $nsId );
 			}
 			$optionsOut[$nsId] = $nsName;
 		}
@@ -959,7 +969,7 @@ class Html {
 		if ( $isXHTML ) { // XHTML5
 			// XML MIME-typed markup should have an xml header.
 			// However a DOCTYPE is not needed.
-			$ret .= "<?xml version=\"1.0\" encoding=\"UTF-8\" ?" . ">\n";
+			$ret .= "<?xml version=\"1.0\" encoding=\"UTF-8\" ?>\n";
 
 			// Add the standard xmlns
 			$attribs['xmlns'] = 'http://www.w3.org/1999/xhtml';
@@ -969,7 +979,6 @@ class Html {
 				$attribs["xmlns:$tag"] = $ns;
 			}
 		} else { // HTML5
-			// DOCTYPE
 			$ret .= "<!DOCTYPE html>\n";
 		}