bug 26781: make wfEscapeWikiText() escape "*", "#", ";" and ":" at the beginning...

diff --git a/RELEASE-NOTES b/RELEASE-NOTES
index 423d051..53c7df3 100644 (file)
--- a/RELEASE-NOTES
+++ b/RELEASE-NOTES
@@ -98,6 +98,7 @@ it from source control: http://www.mediawiki.org/wiki/Download_from_SVN
 * (bug 26449) Keep underlines from headings outside of tables and thumbs by
   adding overflow:hidden to h1,h2,h3,h4,h5,h6 (also fixes editsection bunching).
 * (bug 26708) Remove background-color:white from tables in Monobook and Vector.
+* (bug 26781) {{PAGENAME}} and related parser functions escape their output better
 
 === API changes in 1.18 ===
 * (bug 26339) Throw warning when truncating an overlarge API result

diff --git a/includes/GlobalFunctions.php b/includes/GlobalFunctions.php
index d6d6a16..8ad029b 100644 (file)
--- a/includes/GlobalFunctions.php
+++ b/includes/GlobalFunctions.php
@@ -1149,21 +1149,20 @@ function wfCheckLimits( $deflimit = 50, $optionname = 'rclimit' ) {
  * Escapes the given text so that it may be output using addWikiText()
  * without any linking, formatting, etc. making its way through. This
  * is achieved by substituting certain characters with HTML entities.
- * As required by the callers, <nowiki> is not used. It currently does
- * not filter out characters which have special meaning only at the
- * start of a line, such as "*".
+ * As required by the callers, <nowiki> is not used.
  *
  * @param $text String: text to be escaped
  */
 function wfEscapeWikiText( $text ) {
-       $text = str_replace(
-               array( '[',     '|',      ']',     '\'',    'ISBN ',
-                       'RFC ',     '://',     "\n=",     '{{',           '}}' ),
-               array( '&#91;', '&#124;', '&#93;', '&#39;', 'ISBN&#32;',
-                       'RFC&#32;', '&#58;//', "\n&#61;", '&#123;&#123;', '&#125;&#125;' ),
-               htmlspecialchars( $text )
-       );
-       return $text;
+       $text = strtr( "\n$text", array(
+               '"' => '&#34;', '&' => '&#38;', "'" => '&#39;', '<' => '&#60;',
+               '=' => '&#61;', '>' => '&#62;', '[' => '&#91;', ']' => '&#93;',
+               '{' => '&#123;', '|' => '&#124;', '}' => '&#125;',
+               "\n#" => "\n&#35;", "\n*" => "\n&#42;",
+               "\n:" => "\n&#58;", "\n;" => "\n&#59;",
+               '://' => '&#58;//', 'ISBN ' => 'ISBN&#32;', 'RFC ' => 'RFC&#32;',
+       ) );
+       return substr( $text, 1 );
 }
 
 /**

diff --git a/tests/parser/parserTests.txt b/tests/parser/parserTests.txt
index 5736d8c..08d83af 100644 (file)
--- a/tests/parser/parserTests.txt
+++ b/tests/parser/parserTests.txt
@@ -2226,6 +2226,28 @@ title=[[User:Ævar Arnfjörð Bjarmason]]
 </p>
 !! end
 
+!! test
+Magic Word: {{PAGENAME}} with metacharacters
+!! options
+title=[['foo & bar = baz']]
+!! input
+''{{PAGENAME}}''
+!! result
+<p><i>&#39;foo &#38; bar &#61; baz&#39;</i>
+</p>
+!! end
+
+!! test
+Magic Word: {{PAGENAME}} with metacharacters (bug 26781)
+!! options
+title=[[*RFC 1234 http://example.com/]]
+!! input
+{{PAGENAME}}
+!! result
+<p>&#42;RFC&#32;1234 http&#58;//example.com/
+</p>
+!! end
+
 !! test
 Magic Word: {{PAGENAMEE}}
 !! options