From 5ad630fca0dae71baa7e48fd9ea16cc6a5466012 Mon Sep 17 00:00:00 2001
From: Brion Vibber <brion@users.mediawiki.org>
Date: Wed, 15 Oct 2008 21:20:13 +0000
Subject: [PATCH] Fix for r41837 -- apply HTML stripping to explicit alt text
 as well as implicit. Added parser test cases to confirm.

---
 includes/parser/Parser.php  | 39 +++++++++++++++++++++----------------
 maintenance/parserTests.txt | 18 +++++++++++++++++
 2 files changed, 40 insertions(+), 17 deletions(-)

diff --git a/includes/parser/Parser.php b/includes/parser/Parser.php
index 0021e98416..7b2f2317d9 100644
--- a/includes/parser/Parser.php
+++ b/includes/parser/Parser.php
@@ -4362,6 +4362,7 @@ class Parser
 							// manualthumb? downstream behavior seems odd with
 							// missing manual thumbs.
 							$validated = true;
+							$value = $this->stripAltText( $value, $holders );
 							break;
 						case 'link':
 							$chars = self::EXT_LINK_URL_CLASS;
@@ -4412,22 +4413,7 @@ class Parser
 
 		$params['frame']['caption'] = $caption;
 
-		# Strip bad stuff out of the title (tooltip).  We can't just use
-		# replaceLinkHoldersText() here, because if this function is called
-		# from replaceInternalLinks2(), mLinkHolders won't be up-to-date.
-		if ( $holders ) {
-			$tooltip = $holders->replaceText( $caption );
-		} else {
-			$tooltip = $this->replaceLinkHoldersText( $caption );
-		}
-
-		# make sure there are no placeholders in thumbnail attributes
-		# that are later expanded to html- so expand them now and
-		# remove the tags
-		$tooltip = $this->mStripState->unstripBoth( $tooltip );
-		$tooltip = Sanitizer::stripAllTags( $tooltip );
-
-		$params['frame']['title'] = $tooltip;
+		$params['frame']['title'] = $this->stripAltText( $caption, $holders );
 
 		# In the old days, [[Image:Foo|text...]] would set alt text.  Later it
 		# came to also set the caption, ordinary text after the image -- which
@@ -4449,7 +4435,7 @@ class Parser
 		&& !isset( $params['frame']['framed'] )
 		&& !isset( $params['frame']['thumbnail'] )
 		&& !isset( $params['frame']['manualthumb'] ) ) {
-			$params['frame']['alt'] = $tooltip;
+			$params['frame']['alt'] = $params['frame']['title'];
 		}
 
 		wfRunHooks( 'ParserMakeImageParams', array( $title, $file, &$params ) );
@@ -4464,6 +4450,25 @@ class Parser
 
 		return $ret;
 	}
+	
+	protected function stripAltText( $caption, $holders ) {
+		# Strip bad stuff out of the title (tooltip).  We can't just use
+		# replaceLinkHoldersText() here, because if this function is called
+		# from replaceInternalLinks2(), mLinkHolders won't be up-to-date.
+		if ( $holders ) {
+			$tooltip = $holders->replaceText( $caption );
+		} else {
+			$tooltip = $this->replaceLinkHoldersText( $caption );
+		}
+
+		# make sure there are no placeholders in thumbnail attributes
+		# that are later expanded to html- so expand them now and
+		# remove the tags
+		$tooltip = $this->mStripState->unstripBoth( $tooltip );
+		$tooltip = Sanitizer::stripAllTags( $tooltip );
+		
+		return $tooltip;
+	}
 
 	/**
 	 * Set a flag in the output object indicating that the content is dynamic and
diff --git a/maintenance/parserTests.txt b/maintenance/parserTests.txt
index 0990f39c72..34666b9667 100644
--- a/maintenance/parserTests.txt
+++ b/maintenance/parserTests.txt
@@ -3141,6 +3141,24 @@ Image with frame and link and explicit alt
 
 !! end
 
+!! test
+Image with wiki markup in implicit alt
+!! input
+[[Image:Foobar.jpg|testing '''bold''' in alt]]
+!! result
+<p><a href="/wiki/Image:Foobar.jpg" class="image" title="testing bold in alt"><img alt="testing bold in alt" src="http://example.com/images/3/3a/Foobar.jpg" width="1941" height="220" border="0" /></a>
+</p>
+!! end
+
+!! test
+Image with wiki markup in explicit alt
+!! input
+[[Image:Foobar.jpg|alt=testing '''bold''' in alt]]
+!! result
+<p><a href="/wiki/Image:Foobar.jpg" class="image" title="Foobar.jpg"><img alt="testing bold in alt" src="http://example.com/images/3/3a/Foobar.jpg" width="1941" height="220" border="0" /></a>
+</p>
+!! end
+
 !! test
 Link to image page- image page normally doesn't exists, hence edit link
 Add test with existing image page
-- 
2.20.1