Add missing & to @param documentation to match functon call

[lhc/web/wiklou.git] / includes / search / SearchHighlighter.php

diff --git a/includes/search/SearchHighlighter.php b/includes/search/SearchHighlighter.php
index 2bd1955..6135395 100644 (file)
--- a/includes/search/SearchHighlighter.php
+++ b/includes/search/SearchHighlighter.php
@@ -29,15 +29,20 @@
 class SearchHighlighter {
        protected $mCleanWikitext = true;
 
+       /**
+        * @warning If you pass false to this constructor, then
+        *  the caller is responsible for HTML escaping.
+        */
        function __construct( $cleanupWikitext = true ) {
                $this->mCleanWikitext = $cleanupWikitext;
        }
 
        /**
-        * Default implementation of wikitext highlighting
+        * Wikitext highlighting when $wgAdvancedSearchHighlighting = true
         *
         * @param string $text
-        * @param array $terms Terms to highlight (unescaped)
+        * @param array $terms Terms to highlight (not html escaped but
+        *   regex escaped via SearchDatabase::regexTerm())
         * @param int $contextlines
         * @param int $contextchars
         * @return string
@@ -74,10 +79,10 @@ class SearchHighlighter {
                        if ( preg_match( $spat, $text, $matches, PREG_OFFSET_CAPTURE, $start ) ) {
                                $epat = '';
                                foreach ( $matches as $key => $val ) {
-                                       if ( $key > 0 && $val[1] != - 1 ) {
+                                       if ( $key > 0 && $val[1] != -1 ) {
                                                if ( $key == 2 ) {
                                                        // see if this is an image link
-                                                       $ns = substr( $val[0], 2, - 1 );
+                                                       $ns = substr( $val[0], 2, -1 );
                                                        if ( $wgContLang->getNsIndex( $ns ) != NS_FILE ) {
                                                                break;
                                                        }
@@ -145,7 +150,6 @@ class SearchHighlighter {
                }
                $anyterm = implode( '|', $terms );
                $phrase = implode( "$wgSearchHighlightBoundaries+", $terms );
-
                // @todo FIXME: A hack to scale contextchars, a correct solution
                // would be to have contextchars actually be char and not byte
                // length, and do proper utf-8 substrings and lengths everywhere,
@@ -252,10 +256,10 @@ class SearchHighlighter {
 
                // $snippets = array_map( 'htmlspecialchars', $extended );
                $snippets = $extended;
-               $last = - 1;
+               $last = -1;
                $extract = '';
                foreach ( $snippets as $index => $line ) {
-                       if ( $last == - 1 ) {
+                       if ( $last == -1 ) {
                                $extract .= $line; // first line
                        } elseif ( $last + 1 == $index
                                && $offsets[$last] + strlen( $snippets[$last] ) >= strlen( $all[$last] )
@@ -287,8 +291,8 @@ class SearchHighlighter {
        /**
         * Split text into lines and add it to extracts array
         *
-        * @param array $extracts Index -> $line
-        * @param int $count
+        * @param array &$extracts Index -> $line
+        * @param int &$count
         * @param string $text
         */
        function splitAndAdd( &$extracts, &$count, $text ) {
@@ -322,8 +326,8 @@ class SearchHighlighter {
         * @param string $text
         * @param int $start
         * @param int $end
-        * @param int $posStart (out) actual start position
-        * @param int $posEnd (out) actual end position
+        * @param int &$posStart (out) actual start position
+        * @param int &$posEnd (out) actual end position
         * @return string
         */
        function extract( $text, $start, $end, &$posStart = null, &$posEnd = null ) {
@@ -393,10 +397,10 @@ class SearchHighlighter {
         *
         * @param string $pattern Regexp for matching lines
         * @param array $extracts Extracts to search
-        * @param int $linesleft Number of extracts to make
-        * @param int $contextchars Length of snippet
-        * @param array $out Map for highlighted snippets
-        * @param array $offsets Map of starting points of snippets
+        * @param int &$linesleft Number of extracts to make
+        * @param int &$contextchars Length of snippet
+        * @param array &$out Map for highlighted snippets
+        * @param array &$offsets Map of starting points of snippets
         * @protected
         */
        function process( $pattern, $extracts, &$linesleft, &$contextchars, &$out, &$offsets ) {
@@ -456,6 +460,10 @@ class SearchHighlighter {
                $text = preg_replace( "/('''|<\/?[iIuUbB]>)/", "", $text );
                $text = preg_replace( "/''/", "", $text );
 
+               // Note, the previous /<\/?[^>]+>/ is insufficient
+               // for XSS safety as the HTML tag can span multiple
+               // search results (T144845).
+               $text = Sanitizer::escapeHtmlAllowEntities( $text );
                return $text;
        }
 
@@ -485,8 +493,10 @@ class SearchHighlighter {
         * Simple & fast snippet extraction, but gives completely unrelevant
         * snippets
         *
+        * Used when $wgAdvancedSearchHighlighting is false.
+        *
         * @param string $text
-        * @param array $terms
+        * @param array $terms Escaped for regex by SearchDatabase::regexTerm()
         * @param int $contextlines
         * @param int $contextchars
         * @return string