* validateIntOrNull() returns null for empty input
[lhc/web/wiklou.git] / includes / SpecialPreferences.php
index a796527..be6d7fb 100644 (file)
@@ -1,8 +1,8 @@
 <?php
 /**
  * Hold things related to displaying and saving user preferences.
- * @package MediaWiki
- * @subpackage SpecialPage
+ * @file
+ * @ingroup SpecialPage
  */
 
 /**
@@ -18,15 +18,14 @@ function wfSpecialPreferences() {
 /**
  * Preferences form handling
  * This object will show the preferences form and can save it as well.
- * @package MediaWiki
- * @subpackage SpecialPage
+ * @ingroup SpecialPage
  */
 class PreferencesForm {
        var $mQuickbar, $mOldpass, $mNewpass, $mRetypePass, $mStubs;
        var $mRows, $mCols, $mSkin, $mMath, $mDate, $mUserEmail, $mEmailFlag, $mNick;
        var $mUserLanguage, $mUserVariant;
-       var $mSearch, $mRecent, $mHourDiff, $mSearchLines, $mSearchChars, $mAction;
-       var $mReset, $mPosted, $mToggles, $mSearchNs, $mRealName, $mImageSize;
+       var $mSearch, $mRecent, $mRecentDays, $mHourDiff, $mSearchLines, $mSearchChars, $mAction;
+       var $mReset, $mPosted, $mToggles, $mUseAjaxSearch, $mSearchNs, $mRealName, $mImageSize;
        var $mUnderline, $mWatchlistEdits;
 
        /**
@@ -54,6 +53,7 @@ class PreferencesForm {
                $this->mUserVariant = $request->getVal( 'wpUserVariant' );
                $this->mSearch = $request->getVal( 'wpSearch' );
                $this->mRecent = $request->getVal( 'wpRecent' );
+               $this->mRecentDays = $request->getVal( 'wpRecentDays' );
                $this->mHourDiff = $request->getVal( 'wpHourDiff' );
                $this->mSearchLines = $request->getVal( 'wpSearchLines' );
                $this->mSearchChars = $request->getVal( 'wpSearchChars' );
@@ -66,6 +66,8 @@ class PreferencesForm {
                $this->mSuccess = $request->getCheck( 'success' );
                $this->mWatchlistDays = $request->getVal( 'wpWatchlistDays' );
                $this->mWatchlistEdits = $request->getVal( 'wpWatchlistEdits' );
+               $this->mUseAjaxSearch = $request->getCheck( 'wpUseAjaxSearch' );
+               $this->mDisableMWSuggest = $request->getCheck( 'wpDisableMWSuggest' );
 
                $this->mSaveprefs = $request->getCheck( 'wpSaveprefs' ) &&
                        $this->mPosted &&
@@ -98,6 +100,8 @@ class PreferencesForm {
                if ( !preg_match( '/^[a-z\-]*$/', $this->mUserLanguage ) ) {
                        $this->mUserLanguage = 'nolanguage';
                }
+
+               wfRunHooks( 'InitPreferencesForm', array( $this, $request ) );
        }
 
        function execute() {
@@ -147,7 +151,7 @@ class PreferencesForm {
        function validateIntOrNull( &$val, $min=0, $max=0x7fffffff ) {
                $val = trim($val);
                if($val === '') {
-                       return $val;
+                       return null;
                } else {
                        return $this->validateInt( $val, $min, $max );
                }
@@ -160,7 +164,7 @@ class PreferencesForm {
                global $wgLang, $wgContLang;
                if ( $val !== false && (
                        in_array( $val, (array)$wgLang->getDatePreferences() ) ||
-                       in_array( $val, (array)$wgContLang->getDatePreferences() ) ) ) 
+                       in_array( $val, (array)$wgContLang->getDatePreferences() ) ) )
                {
                        return $val;
                } else {
@@ -170,7 +174,7 @@ class PreferencesForm {
 
        /**
         * Used to validate the user inputed timezone before saving it as
-        * 'timeciorrection', will return '00:00' if fed bogus data.
+        * 'timecorrection', will return '00:00' if fed bogus data.
         * Note: It's not a 100% correct implementation timezone-wise, it will
         * accept stuff like '14:30',
         * @access private
@@ -206,30 +210,35 @@ class PreferencesForm {
        function savePreferences() {
                global $wgUser, $wgOut, $wgParser;
                global $wgEnableUserEmail, $wgEnableEmail;
-               global $wgEmailAuthentication;
-               global $wgAuth;
+               global $wgEmailAuthentication, $wgRCMaxAge;
+               global $wgAuth, $wgEmailConfirmToEdit;
 
 
                if ( '' != $this->mNewpass && $wgAuth->allowPasswordChange() ) {
                        if ( $this->mNewpass != $this->mRetypePass ) {
+                               wfRunHooks( 'PrefsPasswordAudit', array( $wgUser, $this->mNewpass, 'badretype' ) );
                                $this->mainPrefsForm( 'error', wfMsg( 'badretype' ) );
                                return;
                        }
 
                        if (!$wgUser->checkPassword( $this->mOldpass )) {
+                               wfRunHooks( 'PrefsPasswordAudit', array( $wgUser, $this->mNewpass, 'wrongpassword' ) );
                                $this->mainPrefsForm( 'error', wfMsg( 'wrongpassword' ) );
                                return;
                        }
-                       
+
                        try {
                                $wgUser->setPassword( $this->mNewpass );
+                               wfRunHooks( 'PrefsPasswordAudit', array( $wgUser, $this->mNewpass, 'success' ) );
                                $this->mNewpass = $this->mOldpass = $this->mRetypePass = '';
                        } catch( PasswordError $e ) {
+                               wfRunHooks( 'PrefsPasswordAudit', array( $wgUser, $this->mNewpass, 'error' ) );
                                $this->mainPrefsForm( 'error', $e->getMessage() );
                                return;
                        }
                }
                $wgUser->setRealName( $this->mRealName );
+               $oldOptions = $wgUser->mOptions;
 
                if( $wgUser->getOption( 'language' ) !== $this->mUserLanguage ) {
                        $needRedirect = true;
@@ -238,11 +247,18 @@ class PreferencesForm {
                }
 
                # Validate the signature and clean it up as needed
-               if( $this->mToggles['fancysig'] ) {
-                       if( Parser::validateSig( $this->mNick ) !== false ) {
+               global $wgMaxSigChars;
+               if( mb_strlen( $this->mNick ) > $wgMaxSigChars ) {
+                       global $wgLang;
+                       $this->mainPrefsForm( 'error',
+                               wfMsg( 'badsiglength', $wgLang->formatNum( $wgMaxSigChars ) ) );
+                       return;
+               } elseif( $this->mToggles['fancysig'] ) {
+                       if( $wgParser->validateSig( $this->mNick ) !== false ) {
                                $this->mNick = $wgParser->cleanSig( $this->mNick );
                        } else {
                                $this->mainPrefsForm( 'error', wfMsg( 'badsig' ) );
+                               return;
                        }
                } else {
                        // When no fancy sig used, make sure ~{3,5} get removed.
@@ -263,6 +279,7 @@ class PreferencesForm {
                $wgUser->setOption( 'contextlines', $this->validateIntOrNull( $this->mSearchLines ) );
                $wgUser->setOption( 'contextchars', $this->validateIntOrNull( $this->mSearchChars ) );
                $wgUser->setOption( 'rclimit', $this->validateIntOrNull( $this->mRecent ) );
+               $wgUser->setOption( 'rcdays', $this->validateInt($this->mRecentDays, 1, ceil($wgRCMaxAge / (3600*24))));
                $wgUser->setOption( 'wllimit', $this->validateIntOrNull( $this->mWatchlistEdits, 0, 1000 ) );
                $wgUser->setOption( 'rows', $this->validateInt( $this->mRows, 4, 1000 ) );
                $wgUser->setOption( 'cols', $this->validateInt( $this->mCols, 4, 1000 ) );
@@ -272,6 +289,8 @@ class PreferencesForm {
                $wgUser->setOption( 'thumbsize', $this->mThumbSize );
                $wgUser->setOption( 'underline', $this->validateInt($this->mUnderline, 0, 2) );
                $wgUser->setOption( 'watchlistdays', $this->validateFloat( $this->mWatchlistDays, 0, 7 ) );
+               $wgUser->setOption( 'ajaxsearch', $this->mUseAjaxSearch );
+               $wgUser->setOption( 'disablesuggest', $this->mDisableMWSuggest );
 
                # Set search namespace options
                foreach( $this->mSearchNs as $i => $value ) {
@@ -286,12 +305,6 @@ class PreferencesForm {
                foreach ( $this->mToggles as $tname => $tvalue ) {
                        $wgUser->setOption( $tname, $tvalue );
                }
-               if (!$wgAuth->updateExternalDB($wgUser)) {
-                       $this->mainPrefsForm( wfMsg( 'externaldberror' ) );
-                       return;
-               }
-               $wgUser->setCookies();
-               $wgUser->saveSettings();
 
                $error = false;
                if( $wgEnableEmail ) {
@@ -300,9 +313,10 @@ class PreferencesForm {
                        if( ($newadr != '') && ($newadr != $oldadr) ) {
                                # the user has supplied a new email address on the login page
                                if( $wgUser->isValidEmailAddr( $newadr ) ) {
-                                       $wgUser->mEmail = $newadr; # new behaviour: set this new emailaddr from login-page into user database record
-                                       $wgUser->mEmailAuthenticated = null; # but flag as "dirty" = unauthenticated
-                                       $wgUser->saveSettings();
+                                       # new behaviour: set this new emailaddr from login-page into user database record
+                                       $wgUser->setEmail( $newadr );
+                                       # but flag as "dirty" = unauthenticated
+                                       $wgUser->invalidateEmail();
                                        if ($wgEmailAuthentication) {
                                                # Mail a temporary password to the dirty address.
                                                # User can come back through the confirmation URL to re-enable email.
@@ -317,19 +331,38 @@ class PreferencesForm {
                                        $error = wfMsg( 'invalidemailaddress' );
                                }
                        } else {
+                               if( $wgEmailConfirmToEdit && empty( $newadr ) ) {
+                                       $this->mainPrefsForm( 'error', wfMsg( 'noemailtitle' ) );
+                                       return;
+                               }
                                $wgUser->setEmail( $this->mUserEmail );
-                               $wgUser->setCookies();
-                               $wgUser->saveSettings();
                        }
+                       if( $oldadr != $newadr ) {
+                               wfRunHooks( 'PrefsEmailAudit', array( $wgUser, $oldadr, $newadr ) );
+                       }
+               }
+
+               if( !$wgAuth->updateExternalDB( $wgUser ) ){
+                       $this->mainPrefsForm( 'error', wfMsg( 'externaldberror' ) );
+                       return;
+               }
+
+               $msg = '';
+               if ( !wfRunHooks( 'SavePreferences', array( $this, $wgUser, &$msg, $oldOptions ) ) ) {
+                       $this->mainPrefsForm( 'error', $msg );
+                       return;
                }
 
+               $wgUser->setCookies();
+               $wgUser->saveSettings();
+
                if( $needRedirect && $error === false ) {
-                       $title =& SpecialPage::getTitleFor( "Preferences" );
-                       $wgOut->redirect($title->getFullURL('success'));
+                       $title = SpecialPage::getTitleFor( 'Preferences' );
+                       $wgOut->redirect( $title->getFullURL( 'success' ) );
                        return;
                }
 
-               $wgOut->setParserOptions( ParserOptions::newFromUser( $wgUser ) );
+               $wgOut->parserOptions( ParserOptions::newFromUser( $wgUser ) );
                $this->mainPrefsForm( $error === false ? 'success' : 'error', $error);
        }
 
@@ -365,9 +398,12 @@ class PreferencesForm {
                $this->mImageSize = $wgUser->getOption( 'imagesize' );
                $this->mThumbSize = $wgUser->getOption( 'thumbsize' );
                $this->mRecent = $wgUser->getOption( 'rclimit' );
+               $this->mRecentDays = $wgUser->getOption( 'rcdays' );
                $this->mWatchlistEdits = $wgUser->getOption( 'wllimit' );
                $this->mUnderline = $wgUser->getOption( 'underline' );
                $this->mWatchlistDays = $wgUser->getOption( 'watchlistdays' );
+               $this->mUseAjaxSearch = $wgUser->getBoolOption( 'ajaxsearch' );
+               $this->mDisableMWSuggest = $wgUser->getBoolOption( 'disablesuggest' );
 
                $togs = User::getToggles();
                foreach ( $togs as $tname ) {
@@ -380,6 +416,8 @@ class PreferencesForm {
                                $this->mSearchNs[$i] = $wgUser->getOption( 'searchNs'.$i );
                        }
                }
+
+               wfRunHooks( 'ResetPreferences', array( $this, $wgUser ) );
        }
 
        /**
@@ -437,7 +475,39 @@ class PreferencesForm {
        }
 
        function addRow($td1, $td2) {
-               return "<tr><td align='right'>$td1</td><td align='left'>$td2</td></tr>";
+               return "<tr><td class='mw-label'>$td1</td><td class='mw-input'>$td2</td></tr>";
+       }
+
+       /**
+        * Helper function for user information panel
+        * @param $td1 label for an item
+        * @param $td2 item or null
+        * @param $td3 optional help or null
+        * @return xhtml block
+        */
+       function tableRow( $td1, $td2 = null, $td3 = null ) {
+               global $wgContLang;
+
+               $align['align'] = $wgContLang->isRtl() ? 'right' : 'left';
+
+               if ( is_null( $td3 ) ) {
+                       $td3 = '';
+               } else {
+                       $td3 = Xml::tags( 'tr', null,
+                               Xml::tags( 'td', array( 'colspan' => '2' ), $td3 )
+                       );
+               }
+
+               if ( is_null( $td2 ) ) {
+                       $td1 = Xml::tags( 'td', $align + array( 'colspan' => '2' ), $td1 );
+                       $td2 = '';
+               } else {
+                       $td1 = Xml::tags( 'td', $align, $td1 );
+                       $td2 = Xml::tags( 'td', $align, $td2 );
+               }
+
+               return Xml::tags( 'tr', null, $td1 . $td2 ). $td3 . "\n";
+
        }
 
        /**
@@ -451,17 +521,21 @@ class PreferencesForm {
                global $wgRCShowWatchingUsers, $wgEnotifRevealEditorAddress;
                global $wgEnableEmail, $wgEnableUserEmail, $wgEmailAuthentication;
                global $wgContLanguageCode, $wgDefaultSkin, $wgSkipSkins, $wgAuth;
+               global $wgEmailConfirmToEdit, $wgAjaxSearch, $wgEnableMWSuggest;
 
                $wgOut->setPageTitle( wfMsg( 'preferences' ) );
                $wgOut->setArticleRelated( false );
                $wgOut->setRobotpolicy( 'noindex,nofollow' );
+               $wgOut->addScriptFile( 'prefs.js' );
+
+               $wgOut->disallowUserJs();  # Prevent hijacked user scripts from sniffing passwords etc.
 
                if ( $this->mSuccess || 'success' == $status ) {
-                       $wgOut->addWikitext( '<div class="successbox"><strong>'. wfMsg( 'savedprefs' ) . '</strong></div>' );
+                       $wgOut->wrapWikiMsg( '<div class="successbox"><strong>$1</strong></div>', 'savedprefs' );
                } else  if ( 'error' == $status ) {
-                       $wgOut->addWikitext( '<div class="errorbox"><strong>' . $message  . '</strong></div>' );
+                       $wgOut->addWikiText( '<div class="errorbox"><strong>' . $message  . '</strong></div>' );
                } else if ( '' != $status ) {
-                       $wgOut->addWikitext( $message . "\n----" );
+                       $wgOut->addWikiText( $message . "\n----" );
                }
 
                $qbs = $wgLang->getQuickbarSettings();
@@ -483,12 +557,7 @@ class PreferencesForm {
                $this->mUsedToggles[ 'ccmeonemails' ] = true;
                $this->mUsedToggles[ 'uselivepreview' ] = true;
 
-               # Enotif
-               # <FIXME>
-               $this->mUserEmail = htmlspecialchars( $this->mUserEmail );
-               $this->mRealName = htmlspecialchars( $this->mRealName );
-               $rawNick = $this->mNick;
-               $this->mNick = htmlspecialchars( $this->mNick );
+
                if ( !$this->mEmailFlag ) { $emfc = 'checked="checked"'; }
                else { $emfc = ''; }
 
@@ -502,7 +571,7 @@ class PreferencesForm {
                                $skin = $wgUser->getSkin();
                                $emailauthenticated = wfMsg('emailnotauthenticated').'<br />' .
                                        $skin->makeKnownLinkObj( SpecialPage::getTitleFor( 'Confirmemail' ),
-                                               wfMsg( 'emailconfirmlink' ) );
+                                               wfMsg( 'emailconfirmlink' ) ) . '<br />';
                        }
                } else {
                        $emailauthenticated = '';
@@ -510,7 +579,7 @@ class PreferencesForm {
                }
 
                if ($this->mUserEmail == '') {
-                       $emailauthenticated = wfMsg( 'noemailprefs' );
+                       $emailauthenticated = wfMsg( 'noemailprefs' ) . '<br />';
                }
 
                $ps = $this->namespacesCheckboxes();
@@ -526,93 +595,85 @@ class PreferencesForm {
                $wgOut->addHTML( "<div id='preferences'>" );
 
                # User data
-               #
-
-               $wgOut->addHTML( "<fieldset>\n<legend>" . wfMsg('prefs-personal') . "</legend>\n<table>\n");
 
                $wgOut->addHTML(
-                       $this->addRow(
-                               wfMsg( 'username'),
-                               $wgUser->getName()
-                       )
+                       Xml::openElement( 'fieldset ' ) .
+                       Xml::element( 'legend', null, wfMsg('prefs-personal') ) .
+                       Xml::openElement( 'table' ) .
+                       $this->tableRow( Xml::element( 'h2', null, wfMsg( 'prefs-personal' ) ) )
                );
 
-               $wgOut->addHTML(
-                       $this->addRow(
-                               wfMsg( 'uid' ),
-                               $wgUser->getID()
-                       )
-               );
+               $userInformationHtml =
+                       $this->tableRow( wfMsgHtml( 'username' ), htmlspecialchars( $wgUser->getName() ) ) .
+                       $this->tableRow( wfMsgHtml( 'uid' ), htmlspecialchars( $wgUser->getID() ) ) .
+                       $this->tableRow(
+                               wfMsgHtml( 'prefs-edits' ),
+                               $wgLang->formatNum( User::edits( $wgUser->getId() ) )
+                       );
 
+               if( wfRunHooks( 'PreferencesUserInformationPanel', array( $this, &$userInformationHtml ) ) ) {
+                       $wgOut->addHtml( $userInformationHtml );
+               }
 
-               if ($wgAllowRealName) {
+               if ( $wgAllowRealName ) {
                        $wgOut->addHTML(
-                               $this->addRow(
-                                       '<label for="wpRealName">' . wfMsg('yourrealname') . '</label>',
-                                       "<input type='text' name='wpRealName' id='wpRealName' value=\"{$this->mRealName}\" size='25' />"
+                               $this->tableRow(
+                                       Xml::label( wfMsg('yourrealname'), 'wpRealName' ),
+                                       Xml::input( 'wpRealName', 25, $this->mRealName, array( 'id' => 'wpRealName' ) ),
+                                       Xml::tags('div', array( 'class' => 'prefsectiontip' ),
+                                               wfMsgExt( 'prefs-help-realname', 'parseinline' )
+                                       )
                                )
                        );
                }
-               if ($wgEnableEmail) {
+               if ( $wgEnableEmail ) {
                        $wgOut->addHTML(
-                               $this->addRow(
-                                       '<label for="wpUserEmail">' . wfMsg( 'youremail' ) . '</label>',
-                                       "<input type='text' name='wpUserEmail' id='wpUserEmail' value=\"{$this->mUserEmail}\" size='25' />"
+                               $this->tableRow(
+                                       Xml::label( wfMsg('youremail'), 'wpUserEmail' ),
+                                       Xml::input( 'wpUserEmail', 25, $this->mUserEmail, array( 'id' => 'wpUserEmail' ) ),
+                                       Xml::tags('div', array( 'class' => 'prefsectiontip' ),
+                                               wfMsgExt( $wgEmailConfirmToEdit ? 'prefs-help-email-required' : 'prefs-help-email', 'parseinline' )
+                                       )
                                )
                        );
                }
 
-               global $wgParser;
-               if( !empty( $this->mToggles['fancysig'] ) &&
-                       false === $wgParser->validateSig( $rawNick ) ) {
-                       $invalidSig = $this->addRow(
+               global $wgParser, $wgMaxSigChars;
+               if( mb_strlen( $this->mNick ) > $wgMaxSigChars ) {
+                       $invalidSig = $this->tableRow(
                                '&nbsp;',
-                               '<span class="error">' . wfMsgHtml( 'badsig' ) . '<span>'
+                               Xml::element( 'span', array( 'class' => 'error' ),
+                                       wfMsg( 'badsiglength', $wgLang->formatNum( $wgMaxSigChars ) ) )
+                       );
+               } elseif( !empty( $this->mToggles['fancysig'] ) &&
+                       false === $wgParser->validateSig( $this->mNick ) ) {
+                       $invalidSig = $this->tableRow(
+                               '&nbsp;',
+                               Xml::element( 'span', array( 'class' => 'error' ), wfMsg( 'badsig' ) )
                        );
                } else {
                        $invalidSig = '';
                }
 
                $wgOut->addHTML(
-                       $this->addRow(
-                               '<label for="wpNick">' . wfMsg( 'yournick' ) . '</label>',
-                               "<input type='text' name='wpNick' id='wpNick' value=\"{$this->mNick}\" size='25' />"
+                       $this->tableRow(
+                               Xml::label( wfMsg( 'yournick' ), 'wpNick' ),
+                               Xml::input( 'wpNick', 25, $this->mNick,
+                                       array(
+                                               'id' => 'wpNick',
+                                               // Note: $wgMaxSigChars is enforced in Unicode characters,
+                                               // both on the backend and now in the browser.
+                                               // Badly-behaved requests may still try to submit
+                                               // an overlong string, however.
+                                               'maxlength' => $wgMaxSigChars ) )
                        ) .
                        $invalidSig .
-                       # FIXME: The <input> part should be where the &nbsp; is, getToggle() needs
-                       # to be changed to out return its output in two parts. -รฆvar
-                       $this->addRow(
-                               '&nbsp;',
-                               $this->getToggle( 'fancysig' )
-                       )
+                       $this->tableRow( '&nbsp;', $this->getToggle( 'fancysig' ) )
                );
 
-               /**
-                * Make sure the site language is in the list; a custom language code
-                * might not have a defined name...
-                */
-               $languages = Language::getLanguageNames( true );
-               if( !array_key_exists( $wgContLanguageCode, $languages ) ) {
-                       $languages[$wgContLanguageCode] = $wgContLanguageCode;
-               }
-               ksort( $languages );
-
-               /**
-                * If a bogus value is set, default to the content language.
-                * Otherwise, no default is selected and the user ends up
-                * with an Afrikaans interface since it's first in the list.
-                */
-               $selectedLang = isset( $languages[$this->mUserLanguage] ) ? $this->mUserLanguage : $wgContLanguageCode;
-               $options = "\n";
-               foreach( $languages as $code => $name ) {
-                       $selected = ($code == $selectedLang);
-                       $options .= Xml::option( "$code - $name", $code, $selected ) . "\n";
-               }
+               list( $lsLabel, $lsSelect) = Xml::languageSelector( $this->mUserLanguage );
                $wgOut->addHTML(
-                       $this->addRow(
-                               '<label for="wpUserLanguage">' . wfMsg('yourlanguage') . '</label>',
-                               "<select name='wpUserLanguage' id='wpUserLanguage'>$options</select>"
-                       )
+                       $this->tableRow( $lsLabel, $lsSelect )
                );
 
                /* see if there are multiple language variants to choose from*/
@@ -620,6 +681,7 @@ class PreferencesForm {
                        $variants = $wgContLang->getVariants();
                        $variantArray = array();
 
+                       $languages = Language::getLanguageNames( true );
                        foreach($variants as $v) {
                                $v = str_replace( '_', '-', strtolower($v));
                                if( array_key_exists( $v, $languages ) ) {
@@ -636,69 +698,76 @@ class PreferencesForm {
 
                        if(count($variantArray) > 1) {
                                $wgOut->addHtml(
-                                       $this->addRow( wfMsg( 'yourvariant' ),
-                                               "<select name='wpUserVariant'>$options</select>" )
+                                       $this->tableRow(
+                                               Xml::label( wfMsg( 'yourvariant' ), 'wpUserVariant' ),
+                                               Xml::tags( 'select',
+                                                       array( 'name' => 'wpUserVariant', 'id' => 'wpUserVariant' ),
+                                                       $options
+                                               )
+                                       )
                                );
                        }
                }
-               $wgOut->addHTML('</table>');
 
                # Password
                if( $wgAuth->allowPasswordChange() ) {
-                       $this->mOldpass = htmlspecialchars( $this->mOldpass );
-                       $this->mNewpass = htmlspecialchars( $this->mNewpass );
-                       $this->mRetypePass = htmlspecialchars( $this->mRetypePass );
-       
-                       $wgOut->addHTML( '<fieldset><legend>' . wfMsg( 'changepassword' ) . '</legend><table>');
                        $wgOut->addHTML(
-                               $this->addRow(
-                                       '<label for="wpOldpass">' . wfMsg( 'oldpassword' ) . '</label>',
-                                       "<input type='password' name='wpOldpass' id='wpOldpass' value=\"{$this->mOldpass}\" size='20' />"
+                               $this->tableRow( Xml::element( 'h2', null, wfMsg( 'changepassword' ) ) ) .
+                               $this->tableRow(
+                                       Xml::label( wfMsg( 'oldpassword' ), 'wpOldpass' ),
+                                       Xml::password( 'wpOldpass', 25, $this->mOldpass, array( 'id' => 'wpOldpass' ) )
                                ) .
-                               $this->addRow(
-                                       '<label for="wpNewpass">' . wfMsg( 'newpassword' ) . '</label>',
-                                       "<input type='password' name='wpNewpass' id='wpNewpass' value=\"{$this->mNewpass}\" size='20' />"
+                               $this->tableRow(
+                                       Xml::label( wfMsg( 'newpassword' ), 'wpNewpass' ),
+                                       Xml::password( 'wpNewpass', 25, $this->mNewpass, array( 'id' => 'wpNewpass' ) )
                                ) .
-                               $this->addRow(
-                                       '<label for="wpRetypePass">' . wfMsg( 'retypenew' ) . '</label>',
-                                       "<input type='password' name='wpRetypePass' id='wpRetypePass' value=\"{$this->mRetypePass}\" size='20' />"
+                               $this->tableRow(
+                                       Xml::label( wfMsg( 'retypenew' ), 'wpRetypePass' ),
+                                       Xml::password( 'wpRetypePass', 25, $this->mRetypePass, array( 'id' => 'wpRetypePass' ) )
                                ) .
-                               "</table>\n" .
-                               $this->getToggle( "rememberpassword" ) . "</fieldset>\n\n" );
+                               Xml::tags( 'tr', null,
+                                       Xml::tags( 'td', array( 'colspan' => '2' ),
+                                               $this->getToggle( "rememberpassword" )
+                                       )
+                               )
+                       );
                }
 
                # <FIXME>
                # Enotif
-               if ($wgEnableEmail) {
-                       $wgOut->addHTML( '<fieldset><legend>' . wfMsg( 'email' ) . '</legend>' );
+               if ( $wgEnableEmail ) {
+
+                       $moreEmail = '';
+                       if ($wgEnableUserEmail) {
+                               // fixme -- the "allowemail" pseudotoggle is a hacked-together
+                               // inversion for the "disableemail" preference.
+                               $emf = wfMsg( 'allowemail' );
+                               $disabled = $disableEmailPrefs ? ' disabled="disabled"' : '';
+                               $moreEmail =
+                                       "<input type='checkbox' $emfc $disabled value='1' name='wpEmailFlag' id='wpEmailFlag' /> <label for='wpEmailFlag'>$emf</label>" .
+                                       $this->getToggle( 'ccmeonemails', '', $disableEmailPrefs );
+                       }
+
+
                        $wgOut->addHTML(
+                               $this->tableRow( Xml::element( 'h2', null, wfMsg( 'email' ) ) ) .
+                               $this->tableRow(
                                        $emailauthenticated.
                                        $enotifrevealaddr.
                                        $enotifwatchlistpages.
                                        $enotifusertalkpages.
-                                       $enotifminoredits );
-                       if ($wgEnableUserEmail) {
-                       $emf = wfMsg( 'allowemail' );
-                               $disabled = $disableEmailPrefs ? ' disabled="disabled"' : '';
-                               $wgOut->addHTML(
-                               "<div><input type='checkbox' $emfc $disabled value='1' name='wpEmailFlag' id='wpEmailFlag' /> <label for='wpEmailFlag'>$emf</label></div>" );
-                       }
-                       $wgOut->addHtml( $this->getToggle( 'ccmeonemails' ) );
-
-                       $wgOut->addHTML( '</fieldset>' );
+                                       $enotifminoredits.
+                                       $moreEmail
+                               )
+                       );
                }
                # </FIXME>
 
-               # Show little "help" tips for the real name and email address options
-               if( $wgAllowRealName || $wgEnableEmail ) {
-                       if( $wgAllowRealName )
-                               $tips[] = wfMsg( 'prefs-help-realname' );
-                       if( $wgEnableEmail )
-                               $tips[] = wfMsg( 'prefs-help-email' );
-                       $wgOut->addHtml( '<div class="prefsectiontip">' . implode( '<br />', $tips ) . '</div>' );
-               }               
+               $wgOut->addHTML(
+                       Xml::closeElement( 'table' ) .
+                       Xml::closeElement( 'fieldset' )
+               );
 
-               $wgOut->addHTML( '</fieldset>' );
 
                # Quickbar
                #
@@ -752,8 +821,12 @@ class PreferencesForm {
                if( $wgUseTeX ) {
                        $wgOut->addHTML( "<fieldset>\n<legend>" . wfMsg('math') . '</legend>' );
                        foreach ( $mathopts as $k => $v ) {
-                               $checked = $k == $this->mMath ? ' checked="checked"' : '';
-                               $wgOut->addHTML( "<div><label><input type='radio' name='wpMath' value=\"$k\"$checked /> ".wfMsg($v)."</label></div>\n" );
+                               $checked = ($k == $this->mMath);
+                               $wgOut->addHTML(
+                                       Xml::openElement( 'div' ) .
+                                       Xml::radioLabel( wfMsg( $v ), 'wpMath', $k, "mw-sp-math-$k", $checked ) .
+                                       Xml::closeElement( 'div' ) . "\n"
+                               );
                        }
                        $wgOut->addHTML( "</fieldset>\n\n" );
                }
@@ -801,44 +874,66 @@ class PreferencesForm {
                # Date/Time
                #
 
-               $wgOut->addHTML( "<fieldset>\n<legend>" . wfMsg( 'datetime' ) . "</legend>\n" );
+               $wgOut->addHTML(
+                       Xml::openElement( 'fieldset' ) .
+                       Xml::element( 'legend', null, wfMsg( 'datetime' ) ) . "\n"
+               );
 
                if ($dateopts) {
-                       $wgOut->addHTML( "<fieldset>\n<legend>" . wfMsg( 'dateformat' ) . "</legend>\n" );
+                       $wgOut->addHTML(
+                               Xml::openElement( 'fieldset' ) .
+                               Xml::element( 'legend', null, wfMsg( 'dateformat' ) ) . "\n"
+                       );
                        $idCnt = 0;
                        $epoch = '20010115161234'; # Wikipedia day
                        foreach( $dateopts as $key ) {
                                if( $key == 'default' ) {
-                                       $formatted = wfMsgHtml( 'datedefault' );
+                                       $formatted = wfMsg( 'datedefault' );
                                } else {
-                                       $formatted = htmlspecialchars( $wgLang->timeanddate( $epoch, false, $key ) );
+                                       $formatted = $wgLang->timeanddate( $epoch, false, $key );
                                }
-                               ($key == $this->mDate) ? $checked = ' checked="checked"' : $checked = '';
-                               $wgOut->addHTML( "<div><input type='radio' name=\"wpDate\" id=\"wpDate$idCnt\" ".
-                                       "value=\"$key\"$checked /> <label for=\"wpDate$idCnt\">$formatted</label></div>\n" );
+                               $wgOut->addHTML(
+                                       Xml::tags( 'div', null,
+                                               Xml::radioLabel( $formatted, 'wpDate', $key, "wpDate$idCnt", $key == $this->mDate )
+                                       ) . "\n"
+                               );
                                $idCnt++;
                        }
-                       $wgOut->addHTML( "</fieldset>\n" );
+                       $wgOut->addHTML( Xml::closeElement( 'fieldset' ) . "\n" );
                }
 
                $nowlocal = $wgLang->time( $now = wfTimestampNow(), true );
                $nowserver = $wgLang->time( $now, false );
 
-               $wgOut->addHTML( '<fieldset><legend>' . wfMsg( 'timezonelegend' ). '</legend><table>' .
+               $wgOut->addHTML(
+                       Xml::openElement( 'fieldset' ) .
+                       Xml::element( 'legend', null, wfMsg( 'timezonelegend' ) ) .
+                       Xml::openElement( 'table' ) .
                        $this->addRow( wfMsg( 'servertime' ), $nowserver ) .
                        $this->addRow( wfMsg( 'localtime' ), $nowlocal ) .
                        $this->addRow(
-                               '<label for="wpHourDiff">' . wfMsg( 'timezoneoffset' ) . '</label>',
-                               "<input type='text' name='wpHourDiff' id='wpHourDiff' value=\"" . htmlspecialchars( $this->mHourDiff ) . "\" size='6' />"
-                       ) . "<tr><td colspan='2'>
-                               <input type='button' value=\"" . wfMsg( 'guesstimezone' ) ."\"
-                               onclick='javascript:guessTimezone()' id='guesstimezonebutton' style='display:none;' />
-                               </td></tr></table><div class='prefsectiontip'>ยน" .  wfMsg( 'timezonetext' ) . "</div></fieldset>
-               </fieldset>\n\n" );
+                               Xml::label( wfMsg( 'timezoneoffset' ), 'wpHourDiff'  ),
+                               Xml::input( 'wpHourDiff', 6, $this->mHourDiff, array( 'id' => 'wpHourDiff' ) ) ) .
+                       "<tr>
+                               <td></td>
+                               <td class='mw-submit'>" .
+                                       Xml::element( 'input',
+                                               array( 'type' => 'button',
+                                                       'value' => wfMsg( 'guesstimezone' ),
+                                                       'onclick' => 'javascript:guessTimezone()',
+                                                       'id' => 'guesstimezonebutton',
+                                                       'style' => 'display:none;' ) ) .
+                               "</td>
+                       </tr>" .
+                       Xml::closeElement( 'table' ) .
+                       Xml::tags( 'div', array( 'class' => 'prefsectiontip' ), wfMsgExt( 'timezonetext', 'parseinline' ) ).
+                       Xml::closeElement( 'fieldset' ) .
+                       Xml::closeElement( 'fieldset' ) . "\n\n"
+               );
 
                # Editing
                #
-               global $wgLivePreview, $wgUseRCPatrol;
+               global $wgLivePreview;
                $wgOut->addHTML( '<fieldset><legend>' . wfMsg( 'textboxsize' ) . '</legend>
                        <div>' .
                                wfInputLabel( wfMsg( 'rows' ), 'wpRows', 'wpRows', 3, $this->mRows ) .
@@ -861,19 +956,31 @@ class PreferencesForm {
                        ) ) . '</fieldset>'
                );
 
-               $wgOut->addHTML( '<fieldset><legend>' . htmlspecialchars(wfMsg('prefs-rc')) . '</legend>' .
-                                       wfInputLabel( wfMsg( 'recentchangescount' ),
-                                               'wpRecent', 'wpRecent', 3, $this->mRecent ) .
-                       $this->getToggles( array(
-                               'hideminor',
-                               $wgRCShowWatchingUsers ? 'shownumberswatching' : false,
-                               'usenewrc' )
-                       ) . '</fieldset>'
-               );
+               # Recent changes
+               $wgOut->addHtml( '<fieldset><legend>' . wfMsgHtml( 'prefs-rc' ) . '</legend>' );
+
+               $rc  = '<table><tr>';
+               $rc .= '<td>' . Xml::label( wfMsg( 'recentchangesdays' ), 'wpRecentDays' ) . '</td>';
+               $rc .= '<td>' . Xml::input( 'wpRecentDays', 3, $this->mRecentDays, array( 'id' => 'wpRecentDays' ) ) . '</td>';
+               $rc .= '</tr><tr>';
+               $rc .= '<td>' . Xml::label( wfMsg( 'recentchangescount' ), 'wpRecent' ) . '</td>';
+               $rc .= '<td>' . Xml::input( 'wpRecent', 3, $this->mRecent, array( 'id' => 'wpRecent' ) ) . '</td>';
+               $rc .= '</tr></table>';
+               $wgOut->addHtml( $rc );
+
+               $wgOut->addHtml( '<br />' );
+
+               $toggles[] = 'hideminor';
+               if( $wgRCShowWatchingUsers )
+                       $toggles[] = 'shownumberswatching';
+               $toggles[] = 'usenewrc';
+               $wgOut->addHtml( $this->getToggles( $toggles ) );
+
+               $wgOut->addHtml( '</fieldset>' );
 
                # Watchlist
                $wgOut->addHtml( '<fieldset><legend>' . wfMsgHtml( 'prefs-watchlist' ) . '</legend>' );
-               
+
                $wgOut->addHtml( wfInputLabel( wfMsg( 'prefs-watchlist-days' ), 'wpWatchlistDays', 'wpWatchlistDays', 3, $this->mWatchlistDays ) );
                $wgOut->addHtml( '<br /><br />' );
 
@@ -881,32 +988,63 @@ class PreferencesForm {
                $wgOut->addHtml( wfInputLabel( wfMsg( 'prefs-watchlist-edits' ), 'wpWatchlistEdits', 'wpWatchlistEdits', 3, $this->mWatchlistEdits ) );
                $wgOut->addHtml( '<br /><br />' );
 
-               $wgOut->addHtml( $this->getToggles( array( 'watchlisthideown', 'watchlisthidebots' ) ) );
-               $wgOut->addHtml( $this->getToggles( array( 'watchdefault', 'watchcreations', 'watchdeletion' ) ) );
-               
+               $wgOut->addHtml( $this->getToggles( array( 'watchlisthideown', 'watchlisthidebots', 'watchlisthideminor' ) ) );
+
+               if( $wgUser->isAllowed( 'createpage' ) || $wgUser->isAllowed( 'createtalk' ) )
+                       $wgOut->addHtml( $this->getToggle( 'watchcreations' ) );
+               foreach( array( 'edit' => 'watchdefault', 'move' => 'watchmoves', 'delete' => 'watchdeletion' ) as $action => $toggle ) {
+                       if( $wgUser->isAllowed( $action ) )
+                               $wgOut->addHtml( $this->getToggle( $toggle ) );
+               }
+               $this->mUsedToggles['watchcreations'] = true;
+               $this->mUsedToggles['watchdefault'] = true;
+               $this->mUsedToggles['watchmoves'] = true;
+               $this->mUsedToggles['watchdeletion'] = true;
+
                $wgOut->addHtml( '</fieldset>' );
 
                # Search
-               $wgOut->addHTML( '<fieldset><legend>' . wfMsg( 'searchresultshead' ) . '</legend><table>' .
+               $ajaxsearch = $wgAjaxSearch ?
+                       $this->addRow(
+                               Xml::label( wfMsg( 'useajaxsearch' ), 'wpUseAjaxSearch' ),
+                               Xml::check( 'wpUseAjaxSearch', $this->mUseAjaxSearch, array( 'id' => 'wpUseAjaxSearch' ) )
+                       ) : '';
+               $mwsuggest = $wgEnableMWSuggest ?
                        $this->addRow(
-                               wfLabel( wfMsg( 'resultsperpage' ), 'wpSearch' ),
-                               wfInput( 'wpSearch', 4, $this->mSearch, array( 'id' => 'wpSearch' ) )
+                               Xml::label( wfMsg( 'mwsuggest-disable' ), 'wpDisableMWSuggest' ),
+                               Xml::check( 'wpDisableMWSuggest', $this->mDisableMWSuggest, array( 'id' => 'wpDisableMWSuggest' ) )
+                       ) : '';
+               $wgOut->addHTML(
+                       Xml::openElement( 'fieldset' ) .
+                       Xml::element( 'legend', null, wfMsg( 'searchresultshead' ) ) .
+                       Xml::openElement( 'table' ) .
+                       $ajaxsearch .
+                       $this->addRow(
+                               Xml::label( wfMsg( 'resultsperpage' ), 'wpSearch' ),
+                               Xml::input( 'wpSearch', 4, $this->mSearch, array( 'id' => 'wpSearch' ) )
                        ) .
                        $this->addRow(
-                               wfLabel( wfMsg( 'contextlines' ), 'wpSearchLines' ),
-                               wfInput( 'wpSearchLines', 4, $this->mSearchLines, array( 'id' => 'wpSearchLines' ) )
+                               Xml::label( wfMsg( 'contextlines' ), 'wpSearchLines' ),
+                               Xml::input( 'wpSearchLines', 4, $this->mSearchLines, array( 'id' => 'wpSearchLines' ) )
                        ) .
                        $this->addRow(
-                               wfLabel( wfMsg( 'contextchars' ), 'wpSearchChars' ),
-                               wfInput( 'wpSearchChars', 4, $this->mSearchChars, array( 'id' => 'wpSearchChars' ) )
+                               Xml::label( wfMsg( 'contextchars' ), 'wpSearchChars' ),
+                               Xml::input( 'wpSearchChars', 4, $this->mSearchChars, array( 'id' => 'wpSearchChars' ) )
                        ) .
-               "</table><fieldset><legend>" . wfMsg( 'defaultns' ) . "</legend>$ps</fieldset></fieldset>" );
+                       $mwsuggest .
+                       Xml::closeElement( 'table' ) .
+                       Xml::openElement( 'fieldset' ) .
+                       Xml::element( 'legend', null, wfMsg( 'defaultns' ) ) .
+                       $ps .
+                       Xml::closeElement( 'fieldset' ) .
+                       Xml::closeElement( 'fieldset' )
+               );
 
                # Misc
                #
                $wgOut->addHTML('<fieldset><legend>' . wfMsg('prefs-misc') . '</legend>');
-               $wgOut->addHTML( wfInputLabel( wfMsg( 'stubthreshold' ),
-                       'wpStubs', 'wpStubs', 6, $this->mStubs ) );
+               $wgOut->addHtml( '<label for="wpStubs">' . wfMsg( 'stub-threshold' ) . '</label>&nbsp;' );
+               $wgOut->addHtml( Xml::input( 'wpStubs', 6, $this->mStubs, array( 'id' => 'wpStubs' ) ) );
                $msgUnderline = htmlspecialchars( wfMsg ( 'tog-underline' ) );
                $msgUnderlinenever = htmlspecialchars( wfMsg ( 'underline-never' ) );
                $msgUnderlinealways = htmlspecialchars( wfMsg ( 'underline-always' ) );
@@ -930,22 +1068,24 @@ class PreferencesForm {
                }
                $wgOut->addHTML( '</fieldset>' );
 
-               $token = $wgUser->editToken();
+               wfRunHooks( 'RenderPreferencesForm', array( $this, $wgOut ) );
+
+               $token = htmlspecialchars( $wgUser->editToken() );
+               $skin = $wgUser->getSkin();
                $wgOut->addHTML( "
        <div id='prefsubmit'>
        <div>
-               <input type='submit' name='wpSaveprefs' class='btnSavePrefs' value=\"" . wfMsgHtml( 'saveprefs' ) . "\" accesskey=\"".
-               wfMsgHtml('accesskey-save')."\" title=\"".wfMsgHtml('tooltip-save')."\" />
+               <input type='submit' name='wpSaveprefs' class='btnSavePrefs' value=\"" . wfMsgHtml( 'saveprefs' ) . '"'.$skin->tooltipAndAccesskey('save')." />
                <input type='submit' name='wpReset' value=\"" . wfMsgHtml( 'resetprefs' ) . "\" />
        </div>
 
        </div>
 
-       <input type='hidden' name='wpEditToken' value='{$token}' />
+       <input type='hidden' name='wpEditToken' value=\"{$token}\" />
        </div></form>\n" );
 
-               $wgOut->addWikiText( '<div class="prefcache">' . wfMsg('clearyourcache') . '</div>' );
-
+               $wgOut->addHtml( Xml::tags( 'div', array( 'class' => "prefcache" ),
+                       wfMsgExt( 'clearyourcache', 'parseinline' ) )
+               );
        }
 }
-?>