Add taint annotation to HtmlForm::getHTML()

[lhc/web/wiklou.git] / includes / htmlform / HTMLForm.php

diff --git a/includes/htmlform/HTMLForm.php b/includes/htmlform/HTMLForm.php
index cec3bfb..9a78fd8 100644 (file)
--- a/includes/htmlform/HTMLForm.php
+++ b/includes/htmlform/HTMLForm.php
@@ -57,10 +57,12 @@ use Wikimedia\ObjectFactory;
  *    'cssclass'            -- CSS class
  *    'csshelpclass'        -- CSS class used to style help text
  *    'dir'                 -- Direction of the element.
- *    'options'             -- associative array mapping labels to values.
+ *    'options'             -- associative array mapping raw text labels to values.
  *                             Some field types support multi-level arrays.
+ *                             Overwrites 'options-message'.
  *    'options-messages'    -- associative array mapping message keys to values.
  *                             Some field types support multi-level arrays.
+ *                             Overwrites 'options' and 'options-message'.
  *    'options-message'     -- message key or object to be parsed to extract the list of
  *                             options (like 'ipbreason-dropdown').
  *    'label-message'       -- message key or object for a message to use as the label.
@@ -76,11 +78,12 @@ use Wikimedia\ObjectFactory;
  *    'help-messages'       -- array of message keys/objects. As above, each item can
  *                             be an array of msg key and then parameters.
  *                             Overwrites 'help'.
- *    'notice'              -- message text for a message to use as a notice in the field.
- *                             Currently used by OOUI form fields only.
- *    'notice-messages'     -- array of message keys/objects to use for notice.
- *                             Overrides 'notice'.
- *    'notice-message'      -- message key or object to use as a notice.
+ *    'help-inline'         -- Whether help text (defined using options above) will be shown
+ *                             inline after the input field, rather than in a popup.
+ *                             Defaults to true. Only used by OOUI form fields.
+ *    'notice'              -- (deprecated, use 'help' instead)
+ *    'notice-messages'     -- (deprecated, use 'help-messages' instead)
+ *    'notice-message'      -- (deprecated, use 'help-message' instead)
  *    'required'            -- passed through to the object, indicating that it
  *                             is a required field.
  *    'size'                -- the length of text fields
@@ -752,6 +755,17 @@ class HTMLForm extends ContextSource {
                return $this;
        }
 
+       /**
+        * Get the introductory message HTML.
+        *
+        * @since 1.32
+        *
+        * @return string
+        */
+       public function getPreText() {
+               return $this->mPre;
+       }
+
        /**
         * Add HTML to the header, inside the form.
         *
@@ -1015,6 +1029,7 @@ class HTMLForm extends ContextSource {
         * @param bool|string|array|Status $submitResult Output from HTMLForm::trySubmit()
         *
         * @return string HTML
+        * @return-taint escaped
         */
        public function getHTML( $submitResult ) {
                # For good measure (it is the default)