(bug 8556) When using $wgRawHtml, don't show scary session_failure/possible attack
[lhc/web/wiklou.git] / includes / EditPage.php
index 48dd317..44cba7f 100644 (file)
@@ -57,6 +57,7 @@ class EditPage {
        var $isCssJsSubpage = false;
        var $isCssSubpage = false;
        var $isJsSubpage = false;
+       var $isWrongCaseCssJsPage = false;
        var $isNew = false; // new page or new section
        var $deletedSinceEdit;
        var $formtype;
@@ -74,7 +75,12 @@ class EditPage {
        var $autoSumm = '';
        var $hookError = '';
        #var $mPreviewTemplates;
+
+       /**
+        * @var ParserOutput
+        */
        var $mParserOutput;
+
        var $mBaseRevision = false;
        var $mShowSummaryField = true;
 
@@ -95,6 +101,7 @@ class EditPage {
        public $editFormTextBottom;
        public $editFormTextAfterContent;
        public $previewTextAfterContent;
+       public $mPreloadText;
 
        /* $didSave should be set to true whenever an article was succesfully altered. */
        public $didSave = false;
@@ -104,7 +111,7 @@ class EditPage {
 
        /**
         * @todo document
-        * @param $article
+        * @param $article Article
         */
        function __construct( $article ) {
                $this->mArticle =& $article;
@@ -123,6 +130,9 @@ class EditPage {
                $this->mPreloadText = "";
        }
 
+       /**
+        * @return Article
+        */
        function getArticle() {
                return $this->mArticle;
        }
@@ -154,6 +164,8 @@ class EditPage {
 
        /**
         * Fetch initial editing page content.
+        *
+        * @param $def_text string
         * @returns mixed string on success, $def_text for invalid sections
         * @private
         */
@@ -232,7 +244,7 @@ class EditPage {
                                        // was created, or we may simply have got bogus input.
                                        $this->editFormPageTop .= $wgOut->parse( '<div class="error mw-undo-norev">' . wfMsgNoTrans( 'undo-norev' ) . '</div>' );
                                }
-                       } else if ( $section != '' ) {
+                       } elseif ( $section != '' ) {
                                if ( $section == 'new' ) {
                                        $text = $this->getPreloadedText( $preload );
                                } else {
@@ -246,7 +258,11 @@ class EditPage {
                return $text;
        }
 
-       /** Use this method before edit() to preload some text into the edit box */
+       /**
+        * Use this method before edit() to preload some text into the edit box
+        *
+        * @param $text string
+        */
        public function setPreloadedText( $text ) {
                $this->mPreloadText = $text;
        }
@@ -287,7 +303,7 @@ class EditPage {
                return '';
        }
 
-       /*
+       /**
         * Check if a page was deleted while the user was editing it, before submit.
         * Note that we rely on the logging table, which hasn't been always there,
         * but that doesn't matter, because this only applies to brand new
@@ -316,6 +332,8 @@ class EditPage {
        /**
         * Checks whether the user entered a skin name in uppercase,
         * e.g. "User:Example/Monobook.css" instead of "monobook.css"
+        *
+        * @return bool
         */
        protected function isWrongCaseCssJsPage() {
                if( $this->mTitle->isCssJsSubpage() ) {
@@ -393,9 +411,9 @@ class EditPage {
                } else {
                        if ( $this->save ) {
                                $this->formtype = 'save';
-                       } else if ( $this->preview ) {
+                       } elseif ( $this->preview ) {
                                $this->formtype = 'preview';
-                       } else if ( $this->diff ) {
+                       } elseif ( $this->diff ) {
                                $this->formtype = 'diff';
                        } else { # First time through
                                $this->firsttime = true;
@@ -481,6 +499,9 @@ class EditPage {
                wfProfileOut( __METHOD__ );
        }
 
+       /**
+        * @return array
+        */
        protected function getEditPermissionErrors() {
                global $wgUser;
                $permErrors = $this->mTitle->getUserPermissionsErrors( 'edit', $wgUser );
@@ -532,7 +553,7 @@ class EditPage {
                } elseif ( $wgRequest->getVal( 'preview' ) == 'no' ) {
                        // Explicit override from request
                        return false;
-               } elseif ( $this->section == 'new' ) { 
+               } elseif ( $this->section == 'new' ) {
                        // Nothing *to* preview for new sections
                        return false;
                } elseif ( ( $wgRequest->getVal( 'preload' ) !== null || $this->mTitle->exists() ) && $wgUser->getOption( 'previewonfirst' ) ) {
@@ -574,7 +595,7 @@ class EditPage {
 
        /**
         * @todo document
-        * @param $request
+        * @param $request WebRequest
         */
        function importFormData( &$request ) {
                global $wgLang, $wgUser;
@@ -641,7 +662,7 @@ class EditPage {
                                        # The unmarked state will be assumed to be a save,
                                        # if the form seems otherwise complete.
                                        wfDebug( __METHOD__ . ": Passed token check.\n" );
-                               } else if ( $this->diff ) {
+                               } elseif ( $this->diff ) {
                                        # Failed token check, but only requested "Show Changes".
                                        wfDebug( __METHOD__ . ": Failed token check; Show Changes requested.\n" );
                                } else {
@@ -771,8 +792,8 @@ class EditPage {
                        $ip = User::isIP( $username );
                        if ( !$user->isLoggedIn() && !$ip ) { # User does not exist
                                $wgOut->wrapWikiMsg( "<div class=\"mw-userpage-userdoesnotexist error\">\n$1\n</div>",
-                                       array( 'userpage-userdoesnotexist', $username ) );
-                       } else if ( $user->isBlocked() ) { # Show log extract if the user is currently blocked
+                                       array( 'userpage-userdoesnotexist', wfEscapeWikiText( $username ) ) );
+                       } elseif ( $user->isBlocked() ) { # Show log extract if the user is currently blocked
                                LogEventsList::showLogExtract(
                                        $wgOut,
                                        'block',
@@ -831,7 +852,11 @@ class EditPage {
 
        /**
         * Attempt submission (no UI)
-        * @return one of the constants describing the result
+        *
+        * @param $result
+        * @param $bot bool
+        *
+        * @return int one of the constants describing the result
         */
        function internalAttemptSave( &$result, $bot = false ) {
                global $wgFilterCallback, $wgUser, $wgParser;
@@ -978,7 +1003,7 @@ class EditPage {
                        }
 
                        $text = $this->textbox1;
-                       if ( $this->section == 'new' && $this->summary != '' ) { 
+                       if ( $this->section == 'new' && $this->summary != '' ) {
                                $text = wfMsgForContent( 'newsectionheaderdefaultlevel', $this->summary ) . "\n\n" . $text;
                        }
 
@@ -1028,7 +1053,7 @@ class EditPage {
                                wfDebug( __METHOD__ . ": activating conflict; section replace failed.\n" );
                                $this->isConflict = true;
                                $text = $this->textbox1; // do not try to merge here!
-                       } else if ( $this->isConflict ) {
+                       } elseif ( $this->isConflict ) {
                                # Attempt merge
                                if ( $this->mergeChangesInto( $text ) ) {
                                        // Successful merge! Maybe we should tell the user the good news?
@@ -1060,7 +1085,7 @@ class EditPage {
                        }
 
                        # Handle the user preference to force summaries here, but not for null edits
-                       if ( $this->section != 'new' && !$this->allowBlankSummary && 0 != strcmp( $oldtext, $text ) 
+                       if ( $this->section != 'new' && !$this->allowBlankSummary && 0 != strcmp( $oldtext, $text )
                                && !Title::newFromRedirect( $text ) ) # check if it's not a redirect
                        {
                                if ( md5( $this->summary ) == $this->autoSumm ) {
@@ -1071,7 +1096,7 @@ class EditPage {
                        }
 
                        # And a similar thing for new sections
-                       if ( $this->section == 'new' && !$this->allowBlankSummary ) { 
+                       if ( $this->section == 'new' && !$this->allowBlankSummary ) {
                                if ( trim( $this->summary ) == '' ) {
                                        $this->missingSummary = true;
                                        wfProfileOut( __METHOD__ );
@@ -1082,7 +1107,7 @@ class EditPage {
                        # All's well
                        wfProfileIn( __METHOD__ . '-sectionanchor' );
                        $sectionanchor = '';
-                       if ( $this->section == 'new' ) { 
+                       if ( $this->section == 'new' ) {
                                if ( $this->textbox1 == '' ) {
                                        $this->missingComment = true;
                                        wfProfileOut( __METHOD__ . '-sectionanchor' );
@@ -1103,7 +1128,7 @@ class EditPage {
                                $hasmatch = preg_match( "/^ *([=]{1,6})(.*?)(\\1) *\\n/i", $this->textbox1, $matches );
                                # we can't deal with anchors, includes, html etc in the header for now,
                                # headline would need to be parsed to improve this
-                               if ( $hasmatch and strlen( $matches[2] ) > 0 ) {
+                               if ( $hasmatch && strlen( $matches[2] ) > 0 ) {
                                        $sectionanchor = $wgParser->guessLegacySectionNameFromWikiText( $matches[2] );
                                }
                        }
@@ -1151,13 +1176,14 @@ class EditPage {
         * Commit the change of watch status
         */
        protected function commitWatch() {
+               global $wgUser;
                if ( $this->watchthis xor $this->mTitle->userIsWatching() ) {
                        $dbw = wfGetDB( DB_MASTER );
                        $dbw->begin();
                        if ( $this->watchthis ) {
-                               Action::factory( 'watch', $this->mArticle )->execute();
+                               WatchAction::doWatch( $this->mTitle, $wgUser );
                        } else {
-                               Action::factory( 'unwatch', $this->mArticle )->execute();
+                               WatchAction::doUnwatch( $this->mTitle, $wgUser );
                        }
                        $dbw->commit();
                }
@@ -1167,6 +1193,11 @@ class EditPage {
         * Check if no edits were made by other users since
         * the time a user started editing the page. Limit to
         * 50 revisions for the sake of performance.
+        *
+        * @param $id int
+        * @param $edittime string
+        *
+        * @return bool
         */
        protected function userWasLastToEdit( $id, $edittime ) {
                if( !$id ) return false;
@@ -1189,7 +1220,10 @@ class EditPage {
 
        /**
         * Check given input text against $wgSpamRegex, and return the text of the first match.
-        * @return mixed -- matching string or false
+        *
+        * @param $text string
+        *
+        * @return string|false matching string or false
         */
        public static function matchSpamRegex( $text ) {
                global $wgSpamRegex;
@@ -1200,7 +1234,10 @@ class EditPage {
 
        /**
         * Check given input text against $wgSpamRegex, and return the text of the first match.
-        * @return mixed -- matching string or false
+        *
+        * @parma $text string
+        *
+        * @return string|false  matching string or false
         */
        public static function matchSummarySpamRegex( $text ) {
                global $wgSummarySpamRegex;
@@ -1208,6 +1245,11 @@ class EditPage {
                return self::matchSpamRegexInternal( $text, $regexes );
        }
 
+       /**
+        * @param $text string
+        * @param $regexes array
+        * @return bool|string
+        */
        protected static function matchSpamRegexInternal( $text, $regexes ) {
                foreach( $regexes as $regex ) {
                        $matches = array();
@@ -1221,7 +1263,7 @@ class EditPage {
        /**
         * Initialise form fields in the object
         * Called on the first invocation, e.g. when a user clicks an edit link
-        * @returns bool -- if the requested section is valid
+        * @return bool -- if the requested section is valid
         */
        function initialiseForm() {
                global $wgUser;
@@ -1239,8 +1281,12 @@ class EditPage {
                        # Already watched
                        $this->watchthis = true;
                }
-               if ( $wgUser->getOption( 'minordefault' ) && !$this->isNew ) $this->minoredit = true;
-               if ( $this->textbox1 === false ) return false;
+               if ( $wgUser->getOption( 'minordefault' ) && !$this->isNew ) {
+                       $this->minoredit = true;
+               }
+               if ( $this->textbox1 === false ) {
+                       return false;
+               }
                wfProxyCheck();
                return true;
        }
@@ -1389,7 +1435,7 @@ HTML
                }
 
                $wgOut->addHTML( $this->editFormTextBeforeContent );
-               
+
                $wgOut->addHTML( $toolbar );
 
                if ( $this->isConflict ) {
@@ -1490,7 +1536,7 @@ HTML
 
                                if ( !$this->mArticle->mRevision->userCan( Revision::DELETED_TEXT ) ) {
                                        $wgOut->wrapWikiMsg( "<div class='mw-warning plainlinks'>\n$1\n</div>\n", 'rev-deleted-text-permission' );
-                               } else if ( $this->mArticle->mRevision->isDeleted( Revision::DELETED_TEXT ) ) {
+                               } elseif ( $this->mArticle->mRevision->isDeleted( Revision::DELETED_TEXT ) ) {
                                        $wgOut->wrapWikiMsg( "<div class='mw-warning plainlinks'>\n$1\n</div>\n", 'rev-deleted-text-view' );
                                }
 
@@ -1580,10 +1626,10 @@ HTML
         * inferred by the id given to the input. You can remove them both by
         * passing array( 'id' => false ) to $userInputAttrs.
         *
-        * @param $summary The value of the summary input
-        * @param $labelText The html to place inside the label
-        * @param $inputAttrs An array of attrs to use on the input
-        * @param $spanLabelAttrs An array of attrs to use on the span inside the label
+        * @param $summary string The value of the summary input
+        * @param $labelText string The html to place inside the label
+        * @param $inputAttrs array of attrs to use on the input
+        * @param $spanLabelAttrs array of attrs to use on the span inside the label
         *
         * @return array An array in the format array( $label, $input )
         */
@@ -1626,11 +1672,13 @@ HTML
                # Add a class if 'missingsummary' is triggered to allow styling of the summary line
                $summaryClass = $this->missingSummary ? 'mw-summarymissed' : 'mw-summary';
                if ( $isSubjectPreview ) {
-                       if ( $this->nosummary )
+                       if ( $this->nosummary ) {
                                return;
+                       }
                } else {
-                       if ( !$this->mShowSummaryField )
+                       if ( !$this->mShowSummaryField ) {
                                return;
+                       }
                }
                $summary = $wgContLang->recodeForEdit( $summary );
                $labelText = wfMsgExt( $isSubjectPreview ? 'subject' : 'summary', 'parseinline' );
@@ -1767,6 +1815,13 @@ HTML
                        'style' => '' // avoid php notices when appending preferences (appending allows customAttribs['style'] to still work
                );
 
+               global $wgBetterDirectionality;
+               if( $wgBetterDirectionality ) {
+                       $pageLang = $this->mTitle->getPageLanguage();
+                       $attribs['lang'] = $pageLang->getCode();
+                       $attribs['dir'] = $pageLang->getDir();
+               }
+
                $wgOut->addHTML( Html::textarea( $name, $wikitext, $attribs ) );
        }
 
@@ -1882,7 +1937,7 @@ HTML
                $wgOut->addHTML( "</div><!-- editButtons -->\n</div><!-- editOptions -->\n" );
        }
 
-       /*
+       /**
         * Show an edit conflict. textbox1 is already shown in showEditForm().
         * If you want to use another entry point to this function, be careful.
         */
@@ -1949,7 +2004,7 @@ HTML
                        } else {
                                $note = wfMsg( 'session_fail_preview' );
                        }
-               } else if ( $this->incompleteForm ) {
+               } elseif ( $this->incompleteForm ) {
                        $note = wfMsg( 'edit_form_incomplete' );
                } else {
                        $note = wfMsg( 'previewnote' );
@@ -1964,8 +2019,14 @@ HTML
                if ( $wgRawHtml && !$this->mTokenOk ) {
                        // Could be an offsite preview attempt. This is very unsafe if
                        // HTML is enabled, as it could be an attack.
-                       $parsedNote = $wgOut->parse( "<div class='previewnote'>" .
-                               wfMsg( 'session_fail_preview_html' ) . "</div>" );
+                       $parsedNote = '';
+                       if ( $this->textbox1 !== '' ) {
+                               // Do not put big scary notice, if previewing the empty
+                               // string, which happens when you initially edit
+                               // a category page, due to automatic preview-on-open.
+                               $parsedNote = $wgOut->parse( "<div class='previewnote'>" .
+                                       wfMsg( 'session_fail_preview_html' ) . "</div>" );
+                       }
                        wfProfileOut( __METHOD__ );
                        return $parsedNote;
                }
@@ -2010,13 +2071,11 @@ HTML
 
                                wfRunHooks( 'EditPageGetPreviewText', array( $this, &$toparse ) );
 
-                               // Parse mediawiki messages with correct target language
+                               // In which language to parse the page
+                               // (Should this still be only for MediaWiki pages, or for all pages?)
                                if ( $this->mTitle->getNamespace() == NS_MEDIAWIKI ) {
-                                       list( /* $unused */, $lang ) = MessageCache::singleton()->figureMessage( $this->mTitle->getText() );
-                                       $obj = wfGetLangObj( $lang );
-                                       $parserOptions->setTargetLanguage( $obj );
+                                       $parserOptions->setTargetLanguage( $this->mTitle->getPageLanguage() );
                                }
-
                                $parserOptions->setTidy( true );
                                $parserOptions->enableLimitReport();
                                $parserOutput = $wgParser->parse( $this->mArticle->preSaveTransform( $toparse ),
@@ -2042,14 +2101,26 @@ HTML
                        '<h2 id="mw-previewheader">' . htmlspecialchars( wfMsg( 'preview' ) ) . "</h2>" .
                        $wgOut->parse( $note ) . $conflict . "</div>\n";
 
+               global $wgBetterDirectionality;
+               if( $wgBetterDirectionality ) {
+                       $pageLang = $this->mTitle->getPageLanguage();
+                       $attribs = array( 'lang' => $pageLang->getCode(), 'dir' => $pageLang->getDir(),
+                               'class' => 'mw-content-'.$pageLang->getDir() );
+                       $previewHTML = Html::rawElement( 'div', $attribs, $previewHTML );
+               }
                wfProfileOut( __METHOD__ );
                return $previewhead . $previewHTML . $this->previewTextAfterContent;
        }
 
+       /**
+        * @return Array
+        */
        function getTemplates() {
                if ( $this->preview || $this->section != '' ) {
                        $templates = array();
-                       if ( !isset( $this->mParserOutput ) ) return $templates;
+                       if ( !isset( $this->mParserOutput ) ) {
+                               return $templates;
+                       }
                        foreach( $this->mParserOutput->getTemplates() as $ns => $template) {
                                foreach( array_keys( $template ) as $dbk ) {
                                        $templates[] = Title::makeTitle($ns, $dbk);
@@ -2185,6 +2256,10 @@ HTML
        /**
         * @private
         * @todo document
+        *
+        * @parma $editText string
+        *
+        * @return bool
         */
        function mergeChangesInto( &$editText ){
                wfProfileIn( __METHOD__ );
@@ -2553,7 +2628,9 @@ HTML
                echo $s;
        }
 
-
+       /**
+        * @return string
+        */
        public function getCancelLink() {
                global $wgUser;
 
@@ -2617,6 +2694,11 @@ HTML
                        : $text;
        }
 
+       /**
+        * @param $request WebRequest
+        * @param $text string
+        * @return string
+        */
        function safeUnicodeText( $request, $text ) {
                $text = rtrim( $text );
                return $request->getBool( 'safemode' )
@@ -2809,7 +2891,7 @@ HTML
 
                        case self::AS_NO_CREATE_PERMISSION:
                                $this->noCreatePermission();
-                               return;
+                               return false;
 
                        case self::AS_BLANK_ARTICLE:
                                $wgOut->redirect( $this->getContextTitle()->getFullURL() );
@@ -2821,6 +2903,9 @@ HTML
                }
        }
 
+       /**
+        * @return Revision
+        */
        function getBaseRevision() {
                if ( !$this->mBaseRevision ) {
                        $db = wfGetDB( DB_MASTER );