Added check for newlines in redirects as a paranoia guard against header injection...
[lhc/web/wiklou.git] / includes / OutputPage.php
index 98977e4..2816a34 100644 (file)
@@ -1,19 +1,16 @@
 <?php
 if ( ! defined( 'MEDIAWIKI' ) )
-       die( -1 );
+       die( 1 );
 /**
  * @package MediaWiki
  */
 
-if ( $wgUseTeX )
-       require_once 'Math.php';
-
 /**
  * @todo document
  * @package MediaWiki
  */
 class OutputPage {
-       var $mHeaders, $mMetatags, $mKeywords;
+       var $mMetatags, $mKeywords;
        var $mLinktags, $mPagetitle, $mBodytext, $mDebugtext;
        var $mHTMLtitle, $mRobotpolicy, $mIsarticle, $mPrintable;
        var $mSubtitle, $mRedirect, $mStatusCode;
@@ -31,14 +28,14 @@ class OutputPage {
        var $mArticleBodyOnly = false;
        
        var $mNewSectionLink = false;
+       var $mNoGallery = false;
 
        /**
         * Constructor
         * Initialise private variables
         */
        function OutputPage() {
-               $this->mHeaders = $this->mMetatags =
-               $this->mKeywords = $this->mLinktags = array();
+               $this->mMetatags = $this->mKeywords = $this->mLinktags = array();
                $this->mHTMLtitle = $this->mPagetitle = $this->mBodytext =
                $this->mRedirect = $this->mLastModified =
                $this->mSubtitle = $this->mDebugtext = $this->mRobotpolicy =
@@ -56,9 +53,13 @@ class OutputPage {
                $this->mRevisionId = null;
                $this->mNewSectionLink = false;
        }
+       
+       function redirect( $url, $responsecode = '302' ) { 
+               # Strip newlines as a paranoia check for header injection in PHP<5.1.2
+               $this->mRedirect = str_replace( "\n", '', $url );
+               $this->mRedirectCode = $responsecode;
+       }
 
-       function addHeader( $name, $val ) { array_push( $this->mHeaders, $name.': '.$val ); }
-       function redirect( $url, $responsecode = '302' ) { $this->mRedirect = $url; $this->mRedirectCode = $responsecode; }
        function setStatusCode( $statusCode ) { $this->mStatusCode = $statusCode; }
 
        # To add an http-equiv meta tag, precede the name with "http:"
@@ -330,11 +331,10 @@ class OutputPage {
 
                $this->addParserOutputNoText( $parserOutput );
                $text = $parserOutput->getText();
+               $this->mNoGallery = $parserOutput->getNoGallery();
                wfRunHooks( 'OutputPageBeforeHTML',array( &$this, &$text ) );
                $parserOutput->setText( $text );
-               $this->addHTML( '<div id="realContent"' . contentdir() . '>');
                $this->addHTML( $parserOutput->getText() );
-               $this->addHTML( '</div><!-- realContent -->');
        }
 
        /**
@@ -385,11 +385,10 @@ class OutputPage {
                        $this->addCategoryLinks( $parserOutput->getCategories() );
                        $this->addKeywords( $parserOutput );
                        $this->mNewSectionLink = $parserOutput->getNewSection();
+                       $this->mNoGallery = $parserOutput->getNoGallery();
                        $text = $parserOutput->getText();
                        wfRunHooks( 'OutputPageBeforeHTML', array( &$this, &$text ) );
-                       $this->addHTML( '<div id="realContent"' . contentdir() . '>');
                        $this->addHTML( $text );
-                       $this->addHTML( '</div><!-- realContent -->');
                        $t = $parserOutput->getTitleText();
                        if( !empty( $t ) ) {
                                $this->setPageTitle( $t );
@@ -673,7 +672,7 @@ class OutputPage {
        /**
         * Note: these arguments are keys into wfMsg(), not text!
         */
-       function errorpage( $title, $msg ) {
+       function showErrorPage( $title, $msg ) {
                global $wgTitle;
 
                $this->mDebugtext .= 'Original title: ' .
@@ -688,11 +687,13 @@ class OutputPage {
                $this->mBodytext = '';
                $this->addWikiText( wfMsg( $msg ) );
                $this->returnToMain( false );
-
-               $this->output();
-               wfErrorExit();
        }
 
+       /** @obsolete */
+       function errorpage( $title, $msg ) {
+               throw new ErrorPageError( $title, $msg );
+       }
+               
        /**
         * Display an error page indicating that a given version of MediaWiki is
         * required to use it
@@ -786,34 +787,9 @@ class OutputPage {
                $this->returnToMain();
        }
 
+       /** @obsolete */
        function databaseError( $fname, $sql, $error, $errno ) {
-               global $wgUser, $wgCommandLineMode, $wgShowSQLErrors;
-
-               $this->setPageTitle( wfMsgNoDB( 'databaseerror' ) );
-               $this->setRobotpolicy( 'noindex,nofollow' );
-               $this->setArticleRelated( false );
-               $this->enableClientCache( false );
-               $this->mRedirect = '';
-
-               if( !$wgShowSQLErrors ) {
-                       $sql = wfMsg( 'sqlhidden' );
-               }
-
-               if ( $wgCommandLineMode ) {
-                       $msg = wfMsgNoDB( 'dberrortextcl', htmlspecialchars( $sql ),
-                                               htmlspecialchars( $fname ), $errno, htmlspecialchars( $error ) );
-               } else {
-                       $msg = wfMsgNoDB( 'dberrortext', htmlspecialchars( $sql ),
-                                               htmlspecialchars( $fname ), $errno, htmlspecialchars( $error ) );
-               }
-
-               if ( $wgCommandLineMode || !is_object( $wgUser )) {
-                       print $msg."\n";
-                       wfErrorExit();
-               }
-               $this->mBodytext = $msg;
-               $this->output();
-               wfErrorExit();
+               throw new MWException( "OutputPage::databaseError is obsolete\n" );
        }
 
        function readOnlyPage( $source = null, $protected = false ) {
@@ -864,36 +840,63 @@ class OutputPage {
                $this->returnToMain( false );
        }
 
-       function fatalError( $message ) {
+       /** @obsolete */
+       function fatalError( $message ) { 
+               throw new FatalError( $message ); 
+       }
+       
+       /** @obsolete */
+       function unexpectedValueError( $name, $val ) {
+               throw new FatalError( wfMsg( 'unexpected', $name, $val ) );
+       }
+
+       /** @obsolete */
+       function fileCopyError( $old, $new ) {
+               throw new FatalError( wfMsg( 'filecopyerror', $old, $new ) );
+       }
+
+       /** @obsolete */
+       function fileRenameError( $old, $new ) {
+               throw new FatalError( wfMsg( 'filerenameerror', $old, $new ) );
+       }
+
+       /** @obsolete */
+       function fileDeleteError( $name ) {
+               throw new FatalError( wfMsg( 'filedeleteerror', $name ) );
+       }
+
+       /** @obsolete */
+       function fileNotFoundError( $name ) {
+               throw new FatalError( wfMsg( 'filenotfound', $name ) );
+       }
+
+       function showFatalError( $message ) {
                $this->setPageTitle( wfMsg( "internalerror" ) );
                $this->setRobotpolicy( "noindex,nofollow" );
                $this->setArticleRelated( false );
                $this->enableClientCache( false );
                $this->mRedirect = '';
-
                $this->mBodytext = $message;
-               $this->output();
-               wfErrorExit();
        }
 
-       function unexpectedValueError( $name, $val ) {
-               $this->fatalError( wfMsg( 'unexpected', $name, $val ) );
+       function showUnexpectedValueError( $name, $val ) {
+               $this->showFatalError( wfMsg( 'unexpected', $name, $val ) );
        }
 
-       function fileCopyError( $old, $new ) {
-               $this->fatalError( wfMsg( 'filecopyerror', $old, $new ) );
+       function showFileCopyError( $old, $new ) {
+               $this->showFatalError( wfMsg( 'filecopyerror', $old, $new ) );
        }
 
-       function fileRenameError( $old, $new ) {
-               $this->fatalError( wfMsg( 'filerenameerror', $old, $new ) );
+       function showFileRenameError( $old, $new ) {
+               $this->showFatalError( wfMsg( 'filerenameerror', $old, $new ) );
        }
 
-       function fileDeleteError( $name ) {
-               $this->fatalError( wfMsg( 'filedeleteerror', $name ) );
+       function showFileDeleteError( $name ) {
+               $this->showFatalError( wfMsg( 'filedeleteerror', $name ) );
        }
 
-       function fileNotFoundError( $name ) {
-               $this->fatalError( wfMsg( 'filenotfound', $name ) );
+       function showFileNotFoundError( $name ) {
+               $this->showFatalError( wfMsg( 'filenotfound', $name ) );
        }
 
        /**
@@ -903,21 +906,26 @@ class OutputPage {
         */
        function returnToMain( $auto = true, $returnto = NULL ) {
                global $wgUser, $wgOut, $wgRequest;
-
+               
                if ( $returnto == NULL ) {
                        $returnto = $wgRequest->getText( 'returnto' );
                }
-               $returnto = htmlspecialchars( $returnto );
-
-               $sk = $wgUser->getSkin();
-               if ( '' == $returnto ) {
+               
+               if ( '' === $returnto ) {
                        $returnto = wfMsgForContent( 'mainpage' );
                }
-               $link = $sk->makeLinkObj( Title::newFromText( $returnto ), '' );
+
+               if ( is_object( $returnto ) ) {
+                       $titleObj = $returnto;
+               } else {
+                       $titleObj = Title::newFromText( $returnto );
+               }
+
+               $sk = $wgUser->getSkin();
+               $link = $sk->makeLinkObj( $titleObj, '' );
 
                $r = wfMsg( 'returnto', $link );
                if ( $auto ) {
-                       $titleObj = Title::newFromText( $returnto );
                        $wgOut->addMeta( 'http:Refresh', '10;url=' . $titleObj->escapeFullURL() );
                }
                $wgOut->addHTML( "\n<p>$r</p>\n" );
@@ -952,7 +960,6 @@ class OutputPage {
        function headElement() {
                global $wgDocType, $wgDTD, $wgContLanguageCode, $wgOutputEncoding, $wgMimeType;
                global $wgUser, $wgContLang, $wgUseTrackbacks, $wgTitle;
-               global $wgLang, $wgLanguageCode;
 
                if( $wgMimeType == 'text/xml' || $wgMimeType == 'application/xhtml+xml' || $wgMimeType == 'application/xml' ) {
                        $ret = "<?xml version=\"1.0\" encoding=\"$wgOutputEncoding\" ?>\n";
@@ -966,8 +973,8 @@ class OutputPage {
                        $this->setHTMLTitle(  wfMsg( 'pagetitle', $this->getPageTitle() ));
                }
 
-               $rtl = $wgLang->isRTL() ? " dir='RTL'" : '';
-               $ret .= "<html xmlns=\"http://www.w3.org/1999/xhtml\" xml:lang=\"$wgLanguageCode\" lang=\"$wgLanguageCode\" $rtl>\n";
+               $rtl = $wgContLang->isRTL() ? " dir='RTL'" : '';
+               $ret .= "<html xmlns=\"http://www.w3.org/1999/xhtml\" xml:lang=\"$wgContLanguageCode\" lang=\"$wgContLanguageCode\" $rtl>\n";
                $ret .= "<head>\n<title>" . htmlspecialchars( $this->getHTMLTitle() ) . "</title>\n";
                array_push( $this->mMetatags, array( "http:Content-type", "$wgMimeType; charset={$wgOutputEncoding}" ) );