Clarify info action's "search engine status"

[lhc/web/wiklou.git] / includes / parser / CoreParserFunctions.php

diff --git a/includes/parser/CoreParserFunctions.php b/includes/parser/CoreParserFunctions.php
index be945f7..8246f71 100644 (file)
--- a/includes/parser/CoreParserFunctions.php
+++ b/includes/parser/CoreParserFunctions.php
@@ -363,22 +363,43 @@ class CoreParserFunctions {
        static function displaytitle( $parser, $text = '' ) {
                global $wgRestrictDisplayTitle;
 
-               #parse a limited subset of wiki markup (just the single quote items)
+               // parse a limited subset of wiki markup (just the single quote items)
                $text = $parser->doQuotes( $text );
 
-               #remove stripped text (e.g. the UNIQ-QINU stuff) that was generated by tag extensions/whatever
+               // remove stripped text (e.g. the UNIQ-QINU stuff) that was generated by tag extensions/whatever
                $text = preg_replace( '/' . preg_quote( $parser->uniqPrefix(), '/' ) . '.*?'
                        . preg_quote( Parser::MARKER_SUFFIX, '/' ) . '/', '', $text );
 
-               #list of disallowed tags for DISPLAYTITLE
-               #these will be escaped even though they are allowed in normal wiki text
+               // list of disallowed tags for DISPLAYTITLE
+               // these will be escaped even though they are allowed in normal wiki text
                $bad = array( 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'div', 'blockquote', 'ol', 'ul', 'li', 'hr',
                        'table', 'tr', 'th', 'td', 'dl', 'dd', 'caption', 'p', 'ruby', 'rb', 'rt', 'rp', 'br' );
 
-               #only requested titles that normalize to the actual title are allowed through
-               #if $wgRestrictDisplayTitle is true (it is by default)
-               #mimic the escaping process that occurs in OutputPage::setPageTitle
-               $text = Sanitizer::normalizeCharReferences( Sanitizer::removeHTMLtags( $text, null, array(), array(), $bad ) );
+               // disallow some styles that could be used to bypass $wgRestrictDisplayTitle
+               if ( $wgRestrictDisplayTitle ) {
+                       $htmlTagsCallback = function ( &$params ) {
+                               $decoded = Sanitizer::decodeTagAttributes( $params );
+
+                               if ( isset( $decoded['style'] ) ) {
+                                       // this is called later anyway, but we need it right now for the regexes below to be safe
+                                       // calling it twice doesn't hurt
+                                       $decoded['style'] = Sanitizer::checkCss( $decoded['style'] );
+
+                                       if ( preg_match( '/(display|user-select|visibility)\s*:/i', $decoded['style'] ) ) {
+                                               $decoded['style'] = '/* attempt to bypass $wgRestrictDisplayTitle */';
+                                       }
+                               }
+
+                               $params = Sanitizer::safeEncodeTagAttributes( $decoded );
+                       };
+               } else {
+                       $htmlTagsCallback = null;
+               }
+
+               // only requested titles that normalize to the actual title are allowed through
+               // if $wgRestrictDisplayTitle is true (it is by default)
+               // mimic the escaping process that occurs in OutputPage::setPageTitle
+               $text = Sanitizer::normalizeCharReferences( Sanitizer::removeHTMLtags( $text, $htmlTagsCallback, array(), array(), $bad ) );
                $title = Title::newFromText( Sanitizer::stripAllTags( $text ) );
 
                if ( !$wgRestrictDisplayTitle ) {
@@ -435,7 +456,8 @@ class CoreParserFunctions {
                return self::formatRaw( SiteStats::edits(), $raw );
        }
        static function numberofviews( $parser, $raw = null ) {
-               return self::formatRaw( SiteStats::views(), $raw );
+               global $wgDisableCounters;
+               return !$wgDisableCounters ? self::formatRaw( SiteStats::views(), $raw ) : '';
        }
        static function pagesinnamespace( $parser, $namespace = 0, $raw = null ) {
                return self::formatRaw( SiteStats::pagesInNs( intval( $namespace ) ), $raw );
@@ -803,7 +825,9 @@ class CoreParserFunctions {
                        $title = SpecialPage::getTitleFor( $page, $subpage );
                        return $title->getPrefixedText();
                } else {
-                       return wfMessage( 'nosuchspecialpage' )->inContentLanguage()->text();
+                       // unknown special page, just use the given text as its title, if at all possible
+                       $title = Title::makeTitleSafe( NS_SPECIAL, $text );
+                       return $title ? $title->getPrefixedText() : self::special( $parser, 'Badtitle' );
                }
        }
 
@@ -838,8 +862,13 @@ class CoreParserFunctions {
                if ( $old === false || $old == $text || $arg ) {
                        return '';
                } else {
+                       $converter = $parser->getConverterLanguage()->getConverter();
                        return '<span class="error">' .
-                               wfMessage( 'duplicate-defaultsort', $old, $text )->inContentLanguage()->escaped() .
+                               wfMessage( 'duplicate-defaultsort',
+                                       // Message should be parsed, but these params should only be escaped.
+                                       $converter->markNoConversion( wfEscapeWikiText( $old ) ),
+                                       $converter->markNoConversion( wfEscapeWikiText( $text ) )
+                               )->inContentLanguage()->text() .
                                '</span>';
                }
        }