From: Matt Walker <mwalker@wikimedia.org>
Date: Tue, 16 Apr 2013 18:05:50 +0000 (-0700)
Subject: HTMLForm entity labels are now optional and escaped
X-Git-Tag: 1.31.0-rc.0~19804^2
X-Git-Url: https://git.cyclocoop.org/%28%28?a=commitdiff_plain;h=4497500e7bdeb7695dce7918d3437b06bc7d031f;p=lhc%2Fweb%2Fwiklou.git

HTMLForm entity labels are now optional and escaped

Things like checkboxes have no label, yet a label div gets generated
anyway. This is annoying when maybe I don't want that empty div hanging
around (i.e., it looks like it's part of other option groups when I
have left margins on all .mw-input).

This patch will now also escape 'label' fields by default. For the old
functionality you must now explicitly use the 'label-raw' field.

Change-Id: I8f8340911b7495a91c93e7f2eb7c041b2a7f2179
---

diff --git a/includes/HTMLForm.php b/includes/HTMLForm.php
index 1d9a3d0a82..e993e51bdf 100644
--- a/includes/HTMLForm.php
+++ b/includes/HTMLForm.php
@@ -1094,7 +1094,6 @@ class HTMLForm extends ContextSource {
 		$this->mAction = $action;
 		return $this;
 	}
-
 }
 
 /**
@@ -1112,6 +1111,12 @@ abstract class HTMLFormField {
 	protected $mClass = '';
 	protected $mDefault;
 
+	/**
+	 * @var bool If true will generate an empty div element with no label
+	 * @since 1.22
+	 */
+	protected $mShowEmptyLabels = true;
+
 	/**
 	 * @var HTMLForm
 	 */
@@ -1204,6 +1209,8 @@ abstract class HTMLFormField {
 	/**
 	 * Initialise the object
 	 * @param array $params Associative Array. See HTMLForm doc for syntax.
+	 *
+	 * @since 1.22 The 'label' attribute no longer accepts raw HTML, use 'label-raw' instead
 	 * @throws MWException
 	 */
 	function __construct( $params ) {
@@ -1222,7 +1229,14 @@ abstract class HTMLFormField {
 
 			$this->mLabel = wfMessage( $msg, $msgInfo )->parse();
 		} elseif ( isset( $params['label'] ) ) {
-			$this->mLabel = $params['label'];
+			if ( $params['label'] === '&#160;' ) {
+				// Apparently some things set &nbsp directly and in an odd format
+				$this->mLabel = '&#160;';
+			} else {
+				$this->mLabel = htmlspecialchars( $params['label'] );
+			}
+		} elseif ( isset( $params['label-raw'] ) ) {
+			$this->mLabel = $params['label-raw'];
 		}
 
 		$this->mName = "wp{$params['fieldname']}";
@@ -1267,6 +1281,10 @@ abstract class HTMLFormField {
 		if ( isset( $params['flatlist'] ) ) {
 			$this->mClass .= ' mw-htmlform-flatlist';
 		}
+
+		if ( isset( $params['hidelabel'] ) ) {
+			$this->mShowEmptyLabels = false;
+		}
 	}
 
 	/**
@@ -1327,9 +1345,14 @@ abstract class HTMLFormField {
 		$cellAttributes = array();
 		$label = $this->getLabelHtml( $cellAttributes );
 
+		$outerDivClass = array(
+			'mw-input',
+			'mw-htmlform-nolabel' => ( $label === '' )
+		);
+
 		$field = Html::rawElement(
 			'div',
-			array( 'class' => 'mw-input' ) + $cellAttributes,
+			array( 'class' => $outerDivClass ) + $cellAttributes,
 			$inputHtml . "\n$errors"
 		);
 		$html = Html::rawElement( 'div',
@@ -1458,7 +1481,7 @@ abstract class HTMLFormField {
 	}
 
 	function getLabel() {
-		return $this->mLabel;
+		return is_null( $this->mLabel ) ? '' : $this->mLabel;
 	}
 
 	function getLabelHtml( $cellAttributes = array() ) {
@@ -1470,20 +1493,32 @@ abstract class HTMLFormField {
 			$for['for'] = $this->mID;
 		}
 
+		$labelValue = trim( $this->getLabel() );
+		$hasLabel = false;
+		if ( $labelValue !== '&#160;' && $labelValue !== '' ) {
+			$hasLabel = true;
+		}
+
 		$displayFormat = $this->mParent->getDisplayFormat();
-		$labelElement = Html::rawElement( 'label', $for, $this->getLabel() );
+		$html = '';
 
-		if ( $displayFormat == 'table' ) {
-			return Html::rawElement( 'td', array( 'class' => 'mw-label' ) + $cellAttributes,
-				Html::rawElement( 'label', $for, $this->getLabel() )
-			);
-		} elseif ( $displayFormat == 'div' ) {
-			return Html::rawElement( 'div', array( 'class' => 'mw-label' ) + $cellAttributes,
-				Html::rawElement( 'label', $for, $this->getLabel() )
+		if ( $displayFormat === 'table' ) {
+			$html = Html::rawElement( 'td', array( 'class' => 'mw-label' ) + $cellAttributes,
+				Html::rawElement( 'label', $for, $labelValue )
 			);
-		} else {
-			return $labelElement;
+		} elseif ( $hasLabel || $this->mShowEmptyLabels ) {
+			if ( $displayFormat === 'div' ) {
+				$html = Html::rawElement(
+					'div',
+					array( 'class' => 'mw-label' ) + $cellAttributes,
+					Html::rawElement( 'label', $for, $labelValue )
+				);
+			} else {
+				$html = Html::rawElement( 'label', $for, $labelValue );
+			}
 		}
+
+		return $html;
 	}
 
 	function getDefault() {
diff --git a/includes/Preferences.php b/includes/Preferences.php
index 44c87f016c..d1a23444e5 100644
--- a/includes/Preferences.php
+++ b/includes/Preferences.php
@@ -674,7 +674,7 @@ class Preferences {
 			'section' => 'rendering/advancedrendering',
 			'options' => $stubThresholdOptions,
 			'size' => 20,
-			'label' => $context->msg( 'stub-threshold' )->text(), // Raw HTML message. Yay?
+			'label-raw' => $context->msg( 'stub-threshold' )->text(), // Raw HTML message. Yay?
 		);
 
 		if ( $wgAllowUserCssPrefs ) {