Escaping fixes
[lhc/web/wiklou.git] / includes / specials / SpecialContributions.php
index aa4187c..fed8d13 100644 (file)
@@ -35,16 +35,16 @@ class SpecialContributions extends SpecialPage {
                }
 
                if( !strlen( $target ) ) {
-                       $wgOut->addHTML( $this->getForm( '' ) );
+                       $wgOut->addHTML( $this->getForm() );
                        return;
                }
 
-               $this->opts['limit'] = $wgRequest->getInt( 'limit', 50 );
+               $this->opts['limit'] = $wgRequest->getInt( 'limit', $wgUser->getOption('rclimit') );
                $this->opts['target'] = $target;
 
                $nt = Title::makeTitleSafe( NS_USER, $target );
                if( !$nt ) {
-                       $wgOut->addHTML( $this->getForm( '' ) );
+                       $wgOut->addHTML( $this->getForm() );
                        return;
                }
                $id = User::idFromName( $nt->getText() );
@@ -52,7 +52,7 @@ class SpecialContributions extends SpecialPage {
                if( $target != 'newbies' ) {
                        $target = $nt->getText();
                        $wgOut->setSubtitle( $this->contributionsSub( $nt, $id ) );
-                       $wgOut->setHTMLTitle( wfMsg( 'pagetitle', wfMsg( 'contributions-title', $target ) ) );
+                       $wgOut->setHTMLTitle( wfMsg( 'pagetitle', wfMsgExt( 'contributions-title', array( 'parsemag' ),$target ) ) );
                } else {
                        $wgOut->setSubtitle( wfMsgHtml( 'sp-contributions-newbies-sub') );
                        $wgOut->setHTMLTitle( wfMsg( 'pagetitle', wfMsg( 'sp-contributions-newbies-title' ) ) );
@@ -64,7 +64,7 @@ class SpecialContributions extends SpecialPage {
                        $this->opts['namespace'] = '';
                }
 
-               $this->opts['tagfilter'] = $wgRequest->getVal( 'tagfilter' );
+               $this->opts['tagfilter'] = (string) $wgRequest->getVal( 'tagfilter' );
        
                // Allows reverts to have the bot flag in recent changes. It is just here to
                // be passed in the form at the top of the page 
@@ -74,27 +74,12 @@ class SpecialContributions extends SpecialPage {
 
                $skip = $wgRequest->getText( 'offset' ) || $wgRequest->getText( 'dir' ) == 'prev';
                # Offset overrides year/month selection
-               if( ( $month = $wgRequest->getIntOrNull( 'month' ) ) !== null && $month !== -1 ) {
-                       $this->opts['month'] = intval( $month );
-               } else {
-                       $this->opts['month'] = '';
-               }
-               if( ( $year = $wgRequest->getIntOrNull( 'year' ) ) !== null ) {
-                       $this->opts['year'] = intval( $year );
-               } else if( $this->opts['month'] ) {
-                       $thisMonth = intval( gmdate( 'n' ) );
-                       $thisYear = intval( gmdate( 'Y' ) );
-                       if( intval( $this->opts['month'] ) > $thisMonth ) {
-                               $thisYear--;
-                       }
-                       $this->opts['year'] = $thisYear;
-               } else {
-                       $this->opts['year'] = '';
-               }
-
                if( $skip ) {
                        $this->opts['year'] = '';
                        $this->opts['month'] = '';
+               } else {
+                       $this->opts['year'] = $wgRequest->getIntOrNull( 'year' );
+                       $this->opts['month'] = $wgRequest->getIntOrNull( 'month' );
                }
                
                // Add RSS/atom links
@@ -106,11 +91,11 @@ class SpecialContributions extends SpecialPage {
 
                wfRunHooks( 'SpecialContributionsBeforeMainOutput', $id );
 
-               $wgOut->addHTML( $this->getForm( $this->opts ) );
+               $wgOut->addHTML( $this->getForm() );
 
                $pager = new ContribsPager( $target, $this->opts['namespace'], $this->opts['year'], $this->opts['month'] );
                if( !$pager->getNumRows() ) {
-                       $wgOut->addWikiMsg( 'nocontribs' );
+                       $wgOut->addWikiMsg( 'nocontribs', $target );
                        return;
                }
 
@@ -163,12 +148,12 @@ class SpecialContributions extends SpecialPage {
                if( 0 == $id ) {
                        $user = $nt->getText();
                } else {
-                       $user = $sk->makeLinkObj( $nt, htmlspecialchars( $nt->getText() ) );
+                       $user = $sk->link( $nt, htmlspecialchars( $nt->getText() ) );
                }
                $talk = $nt->getTalkPage();
                if( $talk ) {
                        # Talk page link
-                       $tools[] = $sk->makeLinkObj( $talk, wfMsgHtml( 'talkpagelinktext' ) );
+                       $tools[] = $sk->link( $talk, wfMsgHtml( 'sp-contributions-talk' ) );
                        if( ( $id != 0 && $wgSysopUserBans ) || ( $id == 0 && IP::isIPAddress( $nt->getText() ) ) ) {
                                # Block link
                                if( $wgUser->isAllowed( 'block' ) )
@@ -179,18 +164,27 @@ class SpecialContributions extends SpecialPage {
                                        wfMsgHtml( 'sp-contributions-blocklog' ), 'type=block&page=' . $nt->getPrefixedUrl() );
                        }
                        # Other logs link
-                       $tools[] = $sk->makeKnownLinkObj( SpecialPage::getTitleFor( 'Log' ), wfMsgHtml( 'log' ), 
-                               'user=' . $nt->getPartialUrl()  );
+                       $tools[] = $sk->makeKnownLinkObj( SpecialPage::getTitleFor( 'Log' ), wfMsg( 'sp-contributions-logs' ), 
+                               'user=' . $nt->getPartialUrl() );
 
                        # Add link to deleted user contributions for priviledged users
                        if( $wgUser->isAllowed( 'deletedhistory' ) ) {
-                                       $tools[] = $sk->makeKnownLinkObj( SpecialPage::getTitleFor( 'DeletedContributions', 
-                                       $nt->getDBkey() ), wfMsgHtml( 'deletedcontributions' ) );
+                               $tools[] = $sk->makeKnownLinkObj( SpecialPage::getTitleFor( 'DeletedContributions', 
+                                       $nt->getDBkey() ), wfMsgHtml( 'sp-contributions-deleted' ) );
                        }
-       
+
+                       # Add a link to change user rights for privileged users
+                       $userrightsPage = new UserrightsPage();
+                       if( 0 !== $id && $userrightsPage->userCanChangeRights( User::newFromId( $id ) ) ) {
+                               $tools[] = $sk->makeKnownLinkObj(
+                                       SpecialPage::getTitleFor( 'Userrights', $nt->getDBkey() ),
+                                       wfMsgHtml( 'sp-contributions-userrights' )
+                               );
+                       }
+
                        wfRunHooks( 'ContributionsToolLinks', array( $id, $nt, &$tools ) );
        
-                       $links = implode( ' | ', $tools );
+                       $links = $wgLang->pipeList( $tools );
                }
        
                // Old message 'contribsub' had one parameter, but that doesn't work for
@@ -209,9 +203,9 @@ class SpecialContributions extends SpecialPage {
         * @param $this->opts Array: the options to be included.
         */
        protected function getForm() {
-               global $wgScript, $wgTitle;
+               global $wgScript;
        
-               $this->opts['title'] = $wgTitle->getPrefixedText();
+               $this->opts['title'] = SpecialPage::getTitleFor( 'Contributions' )->getPrefixedText();
                if( !isset( $this->opts['target'] ) ) {
                        $this->opts['target'] = '';
                } else {
@@ -233,46 +227,42 @@ class SpecialContributions extends SpecialPage {
                if( !isset( $this->opts['month'] ) ) {
                        $this->opts['month'] = '';
                }
-
-               if( !isset( $this->opts['tagfilter'] ) ) {
-                       $this->opts['tagfilter'] = '';
-               }
        
                if( $this->opts['contribs'] == 'newbie' ) {
                        $this->opts['target'] = '';
                }
+
+               if( !isset( $this->opts['tagfilter'] ) ) {
+                       $this->opts['tagfilter'] = '';
+               }
        
                $f = Xml::openElement( 'form', array( 'method' => 'get', 'action' => $wgScript ) );
-       
+               # Add hidden params for tracking
                foreach ( $this->opts as $name => $value ) {
                        if( in_array( $name, array( 'namespace', 'target', 'contribs', 'year', 'month' ) ) ) {
                                continue;
                        }
                        $f .= "\t" . Xml::hidden( $name, $value ) . "\n";
                }
+
+               $tagFilter = ChangeTags::buildTagFilterSelector( $this->opts['tagfilter'] );
        
                $f .= '<fieldset>' .
                        Xml::element( 'legend', array(), wfMsg( 'sp-contributions-search' ) ) .
                        Xml::radioLabel( wfMsgExt( 'sp-contributions-newbies', array( 'parseinline' ) ), 
                                'contribs', 'newbie' , 'newbie', $this->opts['contribs'] == 'newbie' ? true : false ) . '<br />' .
-                       Xml::radioLabel( wfMsgExt( 'sp-contributions-username', array( 'parseinline' ) ), 
+                       Xml::radioLabel( wfMsgExt( 'sp-contributions-username', array( 'parsemag' ) ), 
                                'contribs' , 'user', 'user', $this->opts['contribs'] == 'user' ? true : false ) . ' ' .
                        Xml::input( 'target', 20, $this->opts['target']) . ' '.
                        '<span style="white-space: nowrap">' .
                        Xml::label( wfMsg( 'namespace' ), 'namespace' ) . ' ' .
                        Xml::namespaceSelector( $this->opts['namespace'], '' ) .
                        '</span>' .
-                       Xml::tags( 'p', null, implode( '&nbsp;', ChangeTags::buildTagFilterSelector( $this->opts['tagfilter'] ) ) ) .
+                       ( $tagFilter ? Xml::tags( 'p', null, implode( '&nbsp;', $tagFilter ) ) : '' ) .
                        Xml::openElement( 'p' ) .
                        '<span style="white-space: nowrap">' .
-                       Xml::label( wfMsg( 'year' ), 'year' ) . ' '.
-                       Xml::input( 'year', 4, $this->opts['year'], array('id' => 'year', 'maxlength' => 4) ) .
-                       '</span>' .
-                       ' '.
-                       '<span style="white-space: nowrap">' .
-                       Xml::label( wfMsg( 'month' ), 'month' ) . ' '.
-                       Xml::monthSelector( $this->opts['month'], -1 ) . ' '.
-                       '</span>' .
+                       Xml::dateMenu( $this->opts['year'], $this->opts['month'] ) .
+                       '</span>' . ' ' .
                        Xml::submitButton( wfMsg( 'sp-contributions-submit' ) ) .
                        Xml::closeElement( 'p' );
        
@@ -285,7 +275,7 @@ class SpecialContributions extends SpecialPage {
                return $f;
        }
        
-               /**
+       /**
         * Output a subscription feed listing recent edits to this page.
         * @param string $type
         */
@@ -307,7 +297,8 @@ class SpecialContributions extends SpecialPage {
                $feed = new $wgFeedClasses[$type](
                        $this->feedTitle(),
                        wfMsgExt( 'tagline', 'parsemag' ),
-                       $this->getTitle()->getFullUrl() );
+                       $this->getTitle()->getFullUrl() . "/" . urlencode($this->opts['target'])
+               );
                        
                // Already valid title
                $nt = Title::makeTitleSafe( NS_USER, $this->opts['target'] );
@@ -399,9 +390,14 @@ class ContribsPager extends ReverseChronologicalPager {
        }
 
        function getQueryInfo() {
+               global $wgUser;
                list( $tables, $index, $userCond, $join_cond ) = $this->getUserCond();
                
                $conds = array_merge( $userCond, $this->getNamespaceCond() );
+               // Paranoia: avoid brute force searches (bug 17342)
+               if( !$wgUser->isAllowed( 'suppressrevision' ) ) {
+                       $conds[] = 'rev_deleted & ' . Revision::DELETED_USER . ' = 0';
+               }
                $join_cond['page'] = array( 'INNER JOIN', 'page_id=rev_page' );
                
                $queryInfo = array(
@@ -416,7 +412,12 @@ class ContribsPager extends ReverseChronologicalPager {
                        'join_conds' => $join_cond
                );
                
-               ChangeTags::modifyDisplayQuery( $queryInfo['tables'], $queryInfo['fields'], $queryInfo['conds'], $queryInfo['join_conds'], $this->tagFilter );
+               ChangeTags::modifyDisplayQuery( $queryInfo['tables'],
+                                                                               $queryInfo['fields'],
+                                                                               $queryInfo['conds'],
+                                                                               $queryInfo['join_conds'],
+                                                                               $queryInfo['options'],
+                                                                               $this->tagFilter );
                
                wfRunHooks( 'ContribsPager::getQueryInfo', array( &$this, &$queryInfo ) );
                return $queryInfo;
@@ -472,7 +473,7 @@ class ContribsPager extends ReverseChronologicalPager {
         * @todo This would probably look a lot nicer in a table.
         */
        function formatRow( $row ) {
-               global $wgLang, $wgUser, $wgContLang;
+               global $wgUser, $wgLang, $wgContLang;
                wfProfileIn( __METHOD__ );
 
                $sk = $this->getSkin();
@@ -481,11 +482,16 @@ class ContribsPager extends ReverseChronologicalPager {
 
                $page = Title::newFromRow( $row );
                $page->resetArticleId( $row->rev_page ); // use process cache
-               $link = $sk->makeLinkObj( $page, $page->getPrefixedText(), $page->isRedirect() ? 'redirect=no' : '' );
+               $link = $sk->link(
+                       $page,
+                       $page->getPrefixedText(),
+                       array(),
+                       $page->isRedirect() ? array( 'redirect' => 'no' ) : array()
+               );
                # Mark current revisions
                $difftext = $topmarktext = '';
                if( $row->rev_id == $row->page_latest ) {
-                       $topmarktext .= '<strong>' . $this->messages['uctop'] . '</strong>';
+                       $topmarktext .= '<span class="mw-uctop">' . $this->messages['uctop'] . '</span>';
                        if( !$row->page_is_new ) {
                                $difftext .= '(' . $sk->makeKnownLinkObj( $page, $this->messages['diff'], 'diff=0' ) . ')';
                                # Add rollback link
@@ -507,7 +513,7 @@ class ContribsPager extends ReverseChronologicalPager {
 
                $comment = $wgContLang->getDirMark() . $sk->revComment( $rev, false, true );
                $date = $wgLang->timeanddate( wfTimestamp( TS_MW, $row->rev_timestamp ), true );
-               $d = $sk->makeKnownLinkObj( $page, $date, 'oldid='.intval($row->rev_id) );
+               $d = $sk->makeKnownLinkObj( $page, htmlspecialchars($date), 'oldid='.intval($row->rev_id) );
 
                if( $this->target == 'newbies' ) {
                        $userlink = ' . . ' . $sk->userLink( $row->rev_user, $row->rev_user_text );
@@ -531,8 +537,23 @@ class ContribsPager extends ReverseChronologicalPager {
                } else {
                        $mflag = '';
                }
+               
+               if( $wgUser->isAllowed( 'deleterevision' ) ) {
+                       // If revision was hidden from sysops
+                       if( !$rev->userCan( Revision::DELETED_RESTRICTED ) ) {
+                               $del = Xml::tags( 'span', array( 'class'=>'mw-revdelundel-link' ),
+                                       '(' . $this->message['rev-delundel'] . ')' ) . ' ';
+                       // Otherwise, show the link...
+                       } else {
+                               $query = array( 'target' => $page->getPrefixedDbkey(), 'oldid' => $rev->getId() );
+                               $del = $this->mSkin->revDeleteLink( $query,
+                                       $rev->isDeleted( Revision::DELETED_RESTRICTED ) ) . ' ';
+                       }
+               } else {
+                       $del = '';
+               }
 
-               $ret = "{$d} {$histlink} {$difftext} {$nflag}{$mflag} {$link}{$userlink} {$comment} {$topmarktext}";
+               $ret = "{$del}{$d} {$histlink} {$difftext} {$nflag}{$mflag} {$link}{$userlink} {$comment} {$topmarktext}";
                if( $rev->isDeleted( Revision::DELETED_TEXT ) ) {
                        $ret .= ' ' . wfMsgHtml( 'deletedrev' );
                }