Return to LESS multiple value escape mechanism to prevent invalid output
[lhc/web/wiklou.git] / includes / EditPage.php
index 90db70f..4599564 100644 (file)
@@ -476,7 +476,15 @@ class EditPage {
                $this->mArticle = $article;
                $this->page = $article->getPage(); // model object
                $this->mTitle = $article->getTitle();
-               $this->context = $article->getContext();
+
+               // Make sure the local context is in sync with other member variables.
+               // Particularly make sure everything is using the same WikiPage instance.
+               // This should probably be the case in Article as well, but it's
+               // particularly important for EditPage, to make use of the in-place caching
+               // facility in WikiPage::prepareContentForEdit.
+               $this->context = new DerivativeContext( $article->getContext() );
+               $this->context->setWikiPage( $this->page );
+               $this->context->setTitle( $this->mTitle );
 
                $this->contentModel = $this->mTitle->getContentModel();
 
@@ -619,14 +627,23 @@ class EditPage {
                if ( $permErrors ) {
                        wfDebug( __METHOD__ . ": User can't edit\n" );
 
-                       // track block with a cookie if it doesn't exists already
-                       $this->context->getUser()->trackBlockWithCookie();
+                       if ( $this->context->getUser()->getBlock() ) {
+                               // track block with a cookie if it doesn't exists already
+                               $this->context->getUser()->trackBlockWithCookie();
 
-                       // Auto-block user's IP if the account was "hard" blocked
-                       if ( !wfReadOnly() ) {
-                               DeferredUpdates::addCallableUpdate( function () {
-                                       $this->context->getUser()->spreadAnyEditBlock();
-                               } );
+                               // Auto-block user's IP if the account was "hard" blocked
+                               if ( !wfReadOnly() ) {
+                                       DeferredUpdates::addCallableUpdate( function () {
+                                               $this->context->getUser()->spreadAnyEditBlock();
+                                       } );
+                               }
+
+                               $config = $this->context->getConfig();
+                               if ( $config->get( 'EnableBlockNoticeStats' ) ) {
+                                       $wiki = $config->get( 'DBname' );
+                                       $statsd = MediaWikiServices::getInstance()->getStatsdDataFactory();
+                                       $statsd->increment( 'BlockNotices.' . $wiki . '.WikitextEditor.shown' );
+                               }
                        }
                        $this->displayPermissionsError( $permErrors );
 
@@ -672,7 +689,7 @@ class EditPage {
                # that edit() already checked just in case someone tries to sneak
                # in the back door with a hand-edited submission URL.
 
-               if ( 'save' == $this->formtype ) {
+               if ( $this->formtype == 'save' ) {
                        $resultDetails = null;
                        $status = $this->attemptSave( $resultDetails );
                        if ( !$this->handleStatus( $status, $resultDetails ) ) {
@@ -682,7 +699,7 @@ class EditPage {
 
                # First time through: get contents, set time for conflict
                # checking, etc.
-               if ( 'initial' == $this->formtype || $this->firsttime ) {
+               if ( $this->formtype == 'initial' || $this->firsttime ) {
                        if ( $this->initialiseForm() === false ) {
                                $out = $this->context->getOutput();
                                if ( $out->getRedirect() === '' ) { // mcrundo hack redirects, don't override it
@@ -1302,8 +1319,12 @@ class EditPage {
                                        // Messages: undo-success, undo-failure, undo-main-slot-only, undo-norev,
                                        // undo-nochange.
                                        $class = ( $undoMsg == 'success' ? '' : 'error ' ) . "mw-undo-{$undoMsg}";
-                                       $this->editFormPageTop .= $out->parse( "<div class=\"{$class}\">" .
-                                               $this->context->msg( 'undo-' . $undoMsg )->plain() . '</div>', true, /* interface */true );
+                                       $this->editFormPageTop .= Html::rawElement(
+                                               'div', [ 'class' => $class ],
+                                               $out->parseAsInterface(
+                                                       $this->context->msg( 'undo-' . $undoMsg )->plain()
+                                               )
+                                       );
                                }
 
                                if ( $content === false ) {
@@ -1948,7 +1969,7 @@ ERROR;
                        return $status;
                }
 
-               if ( $user->isBlockedFrom( $this->mTitle, false ) ) {
+               if ( $user->isBlockedFrom( $this->mTitle ) ) {
                        // Auto-block user's IP if the account was "hard" blocked
                        if ( !wfReadOnly() ) {
                                $user->spreadAnyEditBlock();
@@ -2479,13 +2500,6 @@ ERROR;
                $out->addModuleStyles( 'mediawiki.editfont.styles' );
 
                $user = $this->context->getUser();
-               if ( $user->getOption( 'showtoolbar' ) ) {
-                       // The addition of default buttons is handled by getEditToolbar() which
-                       // has its own dependency on this module. The call here ensures the module
-                       // is loaded in time (it has position "top") for other modules to register
-                       // buttons (e.g. extensions, gadgets, user scripts).
-                       $out->addModules( 'mediawiki.toolbar' );
-               }
 
                if ( $user->getOption( 'uselivepreview' ) ) {
                        $out->addModules( 'mediawiki.action.edit.preview' );
@@ -2597,8 +2611,13 @@ ERROR;
                        if ( !( $user && $user->isLoggedIn() ) && !$ip ) { # User does not exist
                                $out->wrapWikiMsg( "<div class=\"mw-userpage-userdoesnotexist error\">\n$1\n</div>",
                                        [ 'userpage-userdoesnotexist', wfEscapeWikiText( $username ) ] );
-                       } elseif ( !is_null( $block ) && $block->getType() != Block::TYPE_AUTO ) {
-                               # Show log extract if the user is currently blocked
+                       } elseif (
+                               !is_null( $block ) &&
+                               $block->getType() != Block::TYPE_AUTO &&
+                               ( $block->isSitewide() || $user->isBlockedFrom( $this->mTitle ) )
+                       ) {
+                               // Show log extract if the user is sitewide blocked or is partially
+                               // blocked and not allowed to edit their user page or user talk page
                                LogEventsList::showLogExtract(
                                        $out,
                                        'block',
@@ -2788,13 +2807,8 @@ ERROR;
 
                $out->addHTML( $this->editFormTextTop );
 
-               $showToolbar = true;
                if ( $this->wasDeletedSinceLastEdit() ) {
-                       if ( $this->formtype == 'save' ) {
-                               // Hide the toolbar and edit area, user can click preview to get it back
-                               // Add an confirmation checkbox and explanation.
-                               $showToolbar = false;
-                       } else {
+                       if ( $this->formtype !== 'save' ) {
                                $out->wrapWikiMsg( "<div class='error mw-deleted-while-editing'>\n$1\n</div>",
                                        'deletedwhileediting' );
                        }
@@ -2849,7 +2863,7 @@ ERROR;
                // Put these up at the top to ensure they aren't lost on early form submission
                $this->showFormBeforeText();
 
-               if ( $this->wasDeletedSinceLastEdit() && 'save' == $this->formtype ) {
+               if ( $this->wasDeletedSinceLastEdit() && $this->formtype == 'save' ) {
                        $username = $this->lastDelete->user_name;
                        $comment = CommentStore::getStore()
                                ->getComment( 'log_comment', $this->lastDelete )->text;
@@ -2932,7 +2946,7 @@ ERROR;
                        $out->addHTML( $editConflictHelper->getEditFormHtmlBeforeContent() );
                }
 
-               if ( !$this->mTitle->isUserConfigPage() && $showToolbar && $user->getOption( 'showtoolbar' ) ) {
+               if ( !$this->mTitle->isUserConfigPage() ) {
                        $out->addHTML( self::getEditToolbar( $this->mTitle ) );
                }
 
@@ -3131,7 +3145,10 @@ ERROR;
 
                                        if ( !$revision->isCurrent() ) {
                                                $this->mArticle->setOldSubtitle( $revision->getId() );
-                                               $out->addWikiMsg( 'editingold' );
+                                               $out->wrapWikiMsg(
+                                                       Html::warningBox( "\n$1\n" ),
+                                                       'editingold'
+                                               );
                                                $this->isOldRev = true;
                                        }
                                } elseif ( $this->mTitle->exists() ) {
@@ -3150,16 +3167,22 @@ ERROR;
                        );
                } elseif ( $user->isAnon() ) {
                        if ( $this->formtype != 'preview' ) {
+                               $returntoquery = array_diff_key(
+                                       $this->context->getRequest()->getValues(),
+                                       [ 'title' => true, 'returnto' => true, 'returntoquery' => true ]
+                               );
                                $out->wrapWikiMsg(
                                        "<div id='mw-anon-edit-warning' class='warningbox'>\n$1\n</div>",
                                        [ 'anoneditwarning',
                                                // Log-in link
                                                SpecialPage::getTitleFor( 'Userlogin' )->getFullURL( [
-                                                       'returnto' => $this->getTitle()->getPrefixedDBkey()
+                                                       'returnto' => $this->getTitle()->getPrefixedDBkey(),
+                                                       'returntoquery' => wfArrayToCgi( $returntoquery ),
                                                ] ),
                                                // Sign-up link
                                                SpecialPage::getTitleFor( 'CreateAccount' )->getFullURL( [
-                                                       'returnto' => $this->getTitle()->getPrefixedDBkey()
+                                                       'returnto' => $this->getTitle()->getPrefixedDBkey(),
+                                                       'returntoquery' => wfArrayToCgi( $returntoquery ),
                                                ] )
                                        ]
                                );
@@ -3880,9 +3903,10 @@ ERROR;
                                // Do not put big scary notice, if previewing the empty
                                // string, which happens when you initially edit
                                // a category page, due to automatic preview-on-open.
-                               $parsedNote = $out->parse( "<div class='previewnote'>" .
-                                       $this->context->msg( 'session_fail_preview_html' )->text() . "</div>",
-                                       true, /* interface */true );
+                               $parsedNote = Html::rawElement( 'div', [ 'class' => 'previewnote' ],
+                                       $out->parseAsInterface(
+                                               $this->context->msg( 'session_fail_preview_html' )->plain()
+                                       ) );
                        }
                        $this->incrementEditFailureStats( 'session_loss' );
                        return $parsedNote;
@@ -3957,7 +3981,7 @@ ERROR;
                                #   sitecsspreview, sitejsonpreview, sitejspreview
                                if ( $level && $format ) {
                                        $note = "<div id='mw-{$level}{$format}preview'>" .
-                                               $this->context->msg( "{$level}{$format}preview" )->text() .
+                                               $this->context->msg( "{$level}{$format}preview" )->plain() .
                                                ' ' . $continueEditing . "</div>";
                                }
                        }
@@ -3991,20 +4015,27 @@ ERROR;
                                $this->contentFormat,
                                $ex->getMessage()
                        );
-                       $note .= "\n\n" . $m->parse();
+                       $note .= "\n\n" . $m->plain(); # gets parsed down below
                        $previewHTML = '';
                }
 
                if ( $this->isConflict ) {
-                       $conflict = '<h2 id="mw-previewconflict">'
-                               . $this->context->msg( 'previewconflict' )->escaped() . "</h2>\n";
+                       $conflict = Html::rawElement(
+                               'h2', [ 'id' => 'mw-previewconflict' ],
+                               $this->context->msg( 'previewconflict' )->escaped()
+                       );
                } else {
                        $conflict = '<hr />';
                }
 
-               $previewhead = "<div class='previewnote'>\n" .
-                       '<h2 id="mw-previewheader">' . $this->context->msg( 'preview' )->escaped() . "</h2>" .
-                       $out->parse( $note, true, /* interface */true ) . $conflict . "</div>\n";
+               $previewhead = Html::rawElement(
+                       'div', [ 'class' => 'previewnote' ],
+                       Html::rawElement(
+                               'h2', [ 'id' => 'mw-previewheader' ],
+                               $this->context->msg( 'preview' )->escaped()
+                       ) .
+                       $out->parseAsInterface( $note ) . $conflict
+               );
 
                $pageViewLang = $this->mTitle->getPageViewLanguage();
                $attribs = [ 'lang' => $pageViewLang->getHtmlCode(), 'dir' => $pageViewLang->getDir(),
@@ -4088,145 +4119,20 @@ ERROR;
        }
 
        /**
-        * Shows a bulletin board style toolbar for common editing functions.
-        * It can be disabled in the user preferences.
+        * Allow extensions to provide a toolbar.
         *
         * @param Title|null $title Title object for the page being edited (optional)
-        * @return string
+        * @return string|null
         */
        public static function getEditToolbar( $title = null ) {
-               global $wgOut, $wgEnableUploads, $wgForeignFileRepos;
-
-               $imagesAvailable = $wgEnableUploads || count( $wgForeignFileRepos );
-               $showSignature = true;
-               if ( $title ) {
-                       $showSignature = MWNamespace::wantSignatures( $title->getNamespace() );
-               }
-
-               $contLang = MediaWikiServices::getInstance()->getContentLanguage();
-
-               /**
-                * $toolarray is an array of arrays each of which includes the
-                * opening tag, the closing tag, optionally a sample text that is
-                * inserted between the two when no selection is highlighted
-                * and.  The tip text is shown when the user moves the mouse
-                * over the button.
-                *
-                * Images are defined in ResourceLoaderEditToolbarModule.
-                */
-               $toolarray = [
-                       [
-                               'id'     => 'mw-editbutton-bold',
-                               'open'   => '\'\'\'',
-                               'close'  => '\'\'\'',
-                               'sample' => wfMessage( 'bold_sample' )->text(),
-                               'tip'    => wfMessage( 'bold_tip' )->text(),
-                       ],
-                       [
-                               'id'     => 'mw-editbutton-italic',
-                               'open'   => '\'\'',
-                               'close'  => '\'\'',
-                               'sample' => wfMessage( 'italic_sample' )->text(),
-                               'tip'    => wfMessage( 'italic_tip' )->text(),
-                       ],
-                       [
-                               'id'     => 'mw-editbutton-link',
-                               'open'   => '[[',
-                               'close'  => ']]',
-                               'sample' => wfMessage( 'link_sample' )->text(),
-                               'tip'    => wfMessage( 'link_tip' )->text(),
-                       ],
-                       [
-                               'id'     => 'mw-editbutton-extlink',
-                               'open'   => '[',
-                               'close'  => ']',
-                               'sample' => wfMessage( 'extlink_sample' )->text(),
-                               'tip'    => wfMessage( 'extlink_tip' )->text(),
-                       ],
-                       [
-                               'id'     => 'mw-editbutton-headline',
-                               'open'   => "\n== ",
-                               'close'  => " ==\n",
-                               'sample' => wfMessage( 'headline_sample' )->text(),
-                               'tip'    => wfMessage( 'headline_tip' )->text(),
-                       ],
-                       $imagesAvailable ? [
-                               'id'     => 'mw-editbutton-image',
-                               'open'   => '[[' . $contLang->getNsText( NS_FILE ) . ':',
-                               'close'  => ']]',
-                               'sample' => wfMessage( 'image_sample' )->text(),
-                               'tip'    => wfMessage( 'image_tip' )->text(),
-                       ] : false,
-                       $imagesAvailable ? [
-                               'id'     => 'mw-editbutton-media',
-                               'open'   => '[[' . $contLang->getNsText( NS_MEDIA ) . ':',
-                               'close'  => ']]',
-                               'sample' => wfMessage( 'media_sample' )->text(),
-                               'tip'    => wfMessage( 'media_tip' )->text(),
-                       ] : false,
-                       [
-                               'id'     => 'mw-editbutton-nowiki',
-                               'open'   => "<nowiki>",
-                               'close'  => "</nowiki>",
-                               'sample' => wfMessage( 'nowiki_sample' )->text(),
-                               'tip'    => wfMessage( 'nowiki_tip' )->text(),
-                       ],
-                       $showSignature ? [
-                               'id'     => 'mw-editbutton-signature',
-                               'open'   => wfMessage( 'sig-text', '~~~~' )->inContentLanguage()->text(),
-                               'close'  => '',
-                               'sample' => '',
-                               'tip'    => wfMessage( 'sig_tip' )->text(),
-                       ] : false,
-                       [
-                               'id'     => 'mw-editbutton-hr',
-                               'open'   => "\n----\n",
-                               'close'  => '',
-                               'sample' => '',
-                               'tip'    => wfMessage( 'hr_tip' )->text(),
-                       ]
-               ];
-
-               $script = '';
-               foreach ( $toolarray as $tool ) {
-                       if ( !$tool ) {
-                               continue;
-                       }
-
-                       $params = [
-                               // Images are defined in ResourceLoaderEditToolbarModule
-                               false,
-                               // Note that we use the tip both for the ALT tag and the TITLE tag of the image.
-                               // Older browsers show a "speedtip" type message only for ALT.
-                               // Ideally these should be different, realistically they
-                               // probably don't need to be.
-                               $tool['tip'],
-                               $tool['open'],
-                               $tool['close'],
-                               $tool['sample'],
-                               $tool['id'],
-                       ];
+               $startingToolbar = '<div id="toolbar"></div>';
+               $toolbar = $startingToolbar;
 
-                       $script .= Xml::encodeJsCall(
-                               'mw.toolbar.addButton',
-                               $params,
-                               ResourceLoader::inDebugMode()
-                       );
-               }
-
-               $toolbar = '<div id="toolbar"></div>';
-
-               if ( Hooks::run( 'EditPageBeforeEditToolbar', [ &$toolbar ] ) ) {
-                       // Only add the old toolbar cruft to the page payload if the toolbar has not
-                       // been over-written by a hook caller
-                       $nonce = $wgOut->getCSPNonce();
-                       $wgOut->addScript( Html::inlineScript(
-                               ResourceLoader::makeInlineCodeWithModule( 'mediawiki.toolbar', $script ),
-                               $nonce
-                       ) );
+               if ( !Hooks::run( 'EditPageBeforeEditToolbar', [ &$toolbar ] ) ) {
+                       return null;
                };
-
-               return $toolbar;
+               // Don't add a pointless `<div>` to the page unless a hook caller populated it
+               return ( $toolbar === $startingToolbar ) ? null : $toolbar;
        }
 
        /**