From 94749fa62e95407fc82d9875caf5434a97d4620f Mon Sep 17 00:00:00 2001 From: =?utf8?q?Gerg=C5=91=20Tisza?= Date: Wed, 14 Jun 2017 23:01:31 +0200 Subject: [PATCH] Fix enhanced RC data attribute sanitizing We push 'class' in the attribute array so the hook can manipulate it, so it needs to be added to the attribute whitelist as well. Broken in I6dd006d0b1b0fd35c0020f0f9eea9113eca30b35. Bug: T167922 Bug: T167535 Change-Id: Ic24400382a9dcbb990e12dfddae4ab7db14553cc --- includes/changes/EnhancedChangesList.php | 4 +++- tests/phpunit/includes/changes/EnhancedChangesListTest.php | 2 +- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/includes/changes/EnhancedChangesList.php b/includes/changes/EnhancedChangesList.php index 03f63f673f..d977457fcc 100644 --- a/includes/changes/EnhancedChangesList.php +++ b/includes/changes/EnhancedChangesList.php @@ -686,7 +686,9 @@ class EnhancedChangesList extends ChangesList { } $attribs = $data['attribs']; unset( $data['attribs'] ); - $attribs = wfArrayFilterByKey( $attribs, [ Sanitizer::class, 'isReservedDataAttribute' ] ); + $attribs = wfArrayFilterByKey( $attribs, function( $key ) { + return $key === 'class' || Sanitizer::isReservedDataAttribute( $key ); + } ); $line = Html::openElement( 'table', $attribs ) . Html::openElement( 'tr' ); $line .= ''; diff --git a/tests/phpunit/includes/changes/EnhancedChangesListTest.php b/tests/phpunit/includes/changes/EnhancedChangesListTest.php index 029d1fe386..28818d9b47 100644 --- a/tests/phpunit/includes/changes/EnhancedChangesListTest.php +++ b/tests/phpunit/includes/changes/EnhancedChangesListTest.php @@ -99,7 +99,7 @@ class EnhancedChangesListTest extends MediaWikiLangTestCase { $enhancedChangesList->recentChangesLine( $recentChange, false ); $html = $enhancedChangesList->endRecentChangesList(); - $this->assertContains( 'data-mw-revid="5"', $html ); + $this->assertRegExp( '/data-mw-revid="5" class="[^"]*mw-enhanced-rc[^"]*"/', $html ); $recentChange2 = $this->getEditChange( '20131103092253' ); $enhancedChangesList->recentChangesLine( $recentChange2, false ); -- 2.20.1