From: Aaron Schulz <aaron@users.mediawiki.org>
Date: Tue, 30 Dec 2008 12:22:15 +0000 (+0000)
Subject: (Bug 12998) Weaken DISPLAYTITLE restictions (patch by rememberthedot@gmail.com)
X-Git-Tag: 1.31.0-rc.0~43701
X-Git-Url: http://git.cyclocoop.org/data/Fool?a=commitdiff_plain;h=d0aeaa55ff1a1fa0aaa554f5b98c5f9c075878f3;p=lhc%2Fweb%2Fwiklou.git

(Bug 12998) Weaken DISPLAYTITLE restictions (patch by rememberthedot@gmail.com)
---

diff --git a/includes/EditPage.php b/includes/EditPage.php
index 1259eecae1..ed1806ff0f 100644
--- a/includes/EditPage.php
+++ b/includes/EditPage.php
@@ -1085,12 +1085,14 @@ class EditPage {
 		} else {
 			# Use the title defined by DISPLAYTITLE magic word when present
 			if ( isset( $this->mParserOutput )
-			 && ( $dt = $this->mParserOutput->getDisplayTitle() ) !== false ) {
-				$title = $dt;
+				&& ( $displayTitle = $this->mParserOutput->getDisplayTitle() ) !== false )
+			{
+				$wgOut->setPageTitle( wfMsg( 'editing', $this->mParserOutput->getDisplayTitleH1() ) );
+				# Override the HTML that setPageTitle slated for inclusion in the <title>
+				$wgOut->setHTMLTitle( wfMsg( 'pagetitle', wfMsg( 'editing', $displayTitle ) ) );
 			} else {
-				$title = $wgTitle->getPrefixedText();
+				$wgOut->setPageTitle( wfMsg( 'editing', $wgTitle->getPrefixedText() ) );
 			}
-			$wgOut->setPageTitle( wfMsg( 'editing', $title ) );
 		}
 	}
 
diff --git a/includes/OutputPage.php b/includes/OutputPage.php
index ab974785db..bdc8a944c5 100644
--- a/includes/OutputPage.php
+++ b/includes/OutputPage.php
@@ -309,7 +309,10 @@ class OutputPage {
 		}
 	}
 
-	public function setHTMLTitle( $name ) {$this->mHTMLtitle = $name; }
+	# "HTML title" means <title>
+	public function setHTMLTitle( $name ) { $this->mHTMLtitle = $name; }
+	
+	# "Page title" means <h1>
 	public function setPageTitle( $name ) {
 		global $action, $wgContLang;
 		$name = $wgContLang->convert($name, true);
@@ -320,7 +323,7 @@ class OutputPage {
 				$name .= ' - '.$taction;
 			}
 		}
-
+		
 		$this->setHTMLTitle( wfMsg( 'pagetitle', $name ) );
 	}
 	public function getHTMLTitle() { return $this->mHTMLtitle; }
@@ -539,8 +542,10 @@ class OutputPage {
 			}
 		}
 		// Display title
-		if( ( $dt = $parserOutput->getDisplayTitle() ) !== false )
-			$this->setPageTitle( $dt );
+		if( ( $displayTitleText = $parserOutput->getDisplayTitle() ) !== false ) {
+			$this->setPageTitle( $parserOutput->getDisplayTitleH1() );
+			$this->setHTMLTitle( wfMsg( 'pagetitle', $displayTitleText ) ); #override the HTML that setPageTitle slated for inclusion in the <title>
+		}
 
 		// Hooks registered in the object
 		global $wgParserOutputHooks;
diff --git a/includes/Skin.php b/includes/Skin.php
index 0c221febc2..425aa83ca8 100644
--- a/includes/Skin.php
+++ b/includes/Skin.php
@@ -1018,7 +1018,7 @@ END;
 
 	function pageTitle() {
 		global $wgOut;
-		$s = '<h1 class="pagetitle">' . htmlspecialchars( $wgOut->getPageTitle() ) . '</h1>';
+		$s = '<h1 class="pagetitle">' . $wgOut->getPageTitle() . '</h1>';
 		return $s;
 	}
 
diff --git a/includes/parser/CoreParserFunctions.php b/includes/parser/CoreParserFunctions.php
index a3b5189a31..7a507e7c21 100644
--- a/includes/parser/CoreParserFunctions.php
+++ b/includes/parser/CoreParserFunctions.php
@@ -168,17 +168,24 @@ class CoreParserFunctions {
 	 * @param string $text Desired title text
 	 * @return string
 	 */
-	static function displaytitle( $parser, $text = '' ) {
+	static function displaytitle( $parser, $displayTitleH1 = '' ) {
 		global $wgRestrictDisplayTitle;
-		$text = trim( Sanitizer::decodeCharReferences( $text ) );
-
+		
+		$titleHTML = Sanitizer::removeHTMLtags( $displayTitleH1 ); #escape the bad tags
+		$titleText = trim( Sanitizer::stripAllTags( $titleHTML ) ); #remove the good tags, leaving the bad tags escaped, and trim it to make sure it comes out pretty
+		
 		if ( !$wgRestrictDisplayTitle ) {
-			$parser->mOutput->setDisplayTitle( $text );
+			$parser->mOutput->setDisplayTitleH1( $titleHTML );
+			$parser->mOutput->setDisplayTitle( $titleText );
 		} else {
-			$title = Title::newFromText( $text );
-			if( $title instanceof Title && $title->getFragment() == '' && $title->equals( $parser->mTitle ) )
-				$parser->mOutput->setDisplayTitle( $text );
+			# Only requested titles that normalize to the actual title are allowed through
+			$title = Title::newFromText( $titleText );
+			if ( $title != null && $title->getFragment() == '' && $title->equals( $parser->mTitle ) ) {
+				$parser->mOutput->setDisplayTitleH1( $titleHTML );
+				$parser->mOutput->setDisplayTitle( $titleText ); #put the stripped contents of <h1> into <title>
+			}
 		}
+		
 		return '';
 	}
 
diff --git a/includes/parser/ParserOutput.php b/includes/parser/ParserOutput.php
index 35951387dd..045403dae2 100644
--- a/includes/parser/ParserOutput.php
+++ b/includes/parser/ParserOutput.php
@@ -29,7 +29,8 @@ class ParserOutput
 	/**
 	 * Overridden title for display
 	 */
-	private $displayTitle = false;
+	private $displayTitle = false; #for use in the <title> tag
+	private $displayTitleH1 = false; #for use in the <h1> tag, may contain further HTML tags
 
 	function ParserOutput( $text = '', $languageLinks = array(), $categoryLinks = array(),
 		$containsOldMagic = false, $titletext = '' )
@@ -144,6 +145,15 @@ class ParserOutput
 		}
 	}
 
+	/**
+	 * Get the title to be used for display
+	 *
+	 * @return string
+	 */
+	public function getDisplayTitle() {
+		return $this->displayTitle;
+	}
+	
 	/**
 	 * Override the title to be used for display
 	 * -- this is assumed to have been validated
@@ -154,14 +164,13 @@ class ParserOutput
 	public function setDisplayTitle( $text ) {
 		$this->displayTitle = $text;
 	}
-
-	/**
-	 * Get the title to be used for display
-	 *
-	 * @return string
-	 */
-	public function getDisplayTitle() {
-		return $this->displayTitle;
+	
+	public function getDisplayTitleH1() {
+		return $this->displayTitleH1;
+	}
+	
+	public function setDisplayTitleH1( $html ) {
+		$this->displayTitleH1 = $html;
 	}
 
 	/**
diff --git a/skins/Modern.php b/skins/Modern.php
index cb24bafaef..400d7fe650 100644
--- a/skins/Modern.php
+++ b/skins/Modern.php
@@ -102,7 +102,7 @@ class ModernTemplate extends QuickTemplate {
  class="mediawiki <?php $this->text('dir') ?> <?php $this->text('pageclass') ?> <?php $this->text('skinnameclass') ?>">
 
 	<!-- heading -->
-	<div id="mw_header"><h1 id="firstHeading"><?php $this->data['displaytitle']!=""?$this->html('title'):$this->text('title') ?></h1></div>
+	<div id="mw_header"><h1 id="firstHeading"><?php $this->html('title') ?></h1></div>
 
 	<div id="mw_main">
 	<div id="mw_contentwrapper">
diff --git a/skins/MonoBook.php b/skins/MonoBook.php
index 5d6a5b1a97..987673ac68 100644
--- a/skins/MonoBook.php
+++ b/skins/MonoBook.php
@@ -115,7 +115,7 @@ class MonoBookTemplate extends QuickTemplate {
 	<div id="content">
 		<a name="top" id="top"></a>
 		<?php if($this->data['sitenotice']) { ?><div id="siteNotice"><?php $this->html('sitenotice') ?></div><?php } ?>
-		<h1 class="firstHeading"><?php $this->data['displaytitle']!=""?$this->html('title'):$this->text('title') ?></h1>
+		<h1 class="firstHeading"><?php $this->html('title'); ?></h1>
 		<div id="bodyContent">
 			<h3 id="siteSub"><?php $this->msg('tagline') ?></h3>
 			<div id="contentSub"><?php $this->html('subtitle') ?></div>
@@ -371,3 +371,4 @@ class MonoBookTemplate extends QuickTemplate {
 } // end of class
 
 
+