Prefer using plaintextParams instead of rawParams where possible
authorBrian Wolff <bawolff+wn@gmail.com>
Fri, 27 Oct 2017 14:26:33 +0000 (14:26 +0000)
committerBrian Wolff <bawolff+wn@gmail.com>
Mon, 30 Oct 2017 15:45:53 +0000 (15:45 +0000)
commitfc6d8a9cdb90e753ea05f2da9b32148456ecccc1
treef5b72fbf571ee15dedc8a85b3cee35aeee05657c
parent8e58cebbae0f940efcf548bcde85a3b69d133e59
Prefer using plaintextParams instead of rawParams where possible

Using Message::rawParams() is something that should immediately
jump out as scary. While it's perfectly safe to do something like
wfMessage( 'foo' )->rawParams( $userControlledVar )->text() and
escape later, mixing the safe type of rawParams with the
dangerous type makes it more likely someone will miss something
when checking for security.

To reduce the likelyhood of confusion, prefer ->plaintextParams
for such cases, as it can be seen to be safe at a glance.

Change-Id: Ib067eb08ec934779ae743751306f1a0397bdf71c
includes/specials/SpecialSearch.php
includes/specials/SpecialUndelete.php