Remove over/underescaping detected in Special:UserRights

Bug: T31340
Change-Id: I99823cd56e0a6f501101cb85be832d2925ce9779

diff --git a/includes/User.php b/includes/User.php
index 34af4c5..88004dc 100644 (file)
--- a/includes/User.php
+++ b/includes/User.php
@@ -4471,7 +4471,7 @@ class User implements IDBAccessObject {
                if ( $title ) {
                        return Linker::link( $title, htmlspecialchars( $text ) );
                } else {
-                       return $text;
+                       return htmlspecialchars( $text );
                }
        }
 

diff --git a/includes/specials/SpecialUserrights.php b/includes/specials/SpecialUserrights.php
index 3e9313c..892ff5b 100644 (file)
--- a/includes/specials/SpecialUserrights.php
+++ b/includes/specials/SpecialUserrights.php
@@ -493,25 +493,32 @@ class UserrightsPage extends SpecialPage {
                }
 
                $language = $this->getLanguage();
-               $displayedList = $this->msg( 'userrights-groupsmember-type',
-                       $language->listToText( $list ),
-                       $language->listToText( $membersList )
-               )->plain();
-               $displayedAutolist = $this->msg( 'userrights-groupsmember-type',
-                       $language->listToText( $autoList ),
-                       $language->listToText( $autoMembersList )
-               )->plain();
+               $displayedList = $this->msg( 'userrights-groupsmember-type' )
+                       ->rawParams(
+                               $language->listToText( $list ),
+                               $language->listToText( $membersList )
+                       )->escaped();
+               $displayedAutolist = $this->msg( 'userrights-groupsmember-type' )
+                       ->rawParams(
+                               $language->listToText( $autoList ),
+                               $language->listToText( $autoMembersList )
+                       )->escaped();
 
                $grouplist = '';
                $count = count( $list );
                if ( $count > 0 ) {
-                       $grouplist = $this->msg( 'userrights-groupsmember', $count, $user->getName() )->parse();
+                       $grouplist = $this->msg( 'userrights-groupsmember' )
+                               ->numParams( $count )
+                               ->params( $user->getName() )
+                               ->parse();
                        $grouplist = '<p>' . $grouplist . ' ' . $displayedList . "</p>\n";
                }
 
                $count = count( $autoList );
                if ( $count > 0 ) {
-                       $autogrouplistintro = $this->msg( 'userrights-groupsmember-auto', $count, $user->getName() )
+                       $autogrouplistintro = $this->msg( 'userrights-groupsmember-auto' )
+                               ->numParams( $count )
+                               ->params( $user->getName() )
                                ->parse();
                        $grouplist .= '<p>' . $autogrouplistintro . ' ' . $displayedAutolist . "</p>\n";
                }
@@ -669,9 +676,9 @@ class UserrightsPage extends SpecialPage {
 
                                $member = User::getGroupMember( $group, $user->getName() );
                                if ( $checkbox['irreversible'] ) {
-                                       $text = $this->msg( 'userrights-irreversible-marker', $member )->escaped();
+                                       $text = $this->msg( 'userrights-irreversible-marker', $member )->text();
                                } else {
-                                       $text = htmlspecialchars( $member );
+                                       $text = $member;
                                }
                                $checkboxHtml = Xml::checkLabel( $text, "wpGroup-" . $group,
                                        "wpGroup-" . $group, $checkbox['set'], $attr );

diff --git a/languages/Language.php b/languages/Language.php
index 93c186c..c0de1b4 100644 (file)
--- a/languages/Language.php
+++ b/languages/Language.php
@@ -3406,10 +3406,10 @@ class Language {
                        return '';
                }
                if ( $m > 0 ) {
-                       $and = $this->getMessageFromDB( 'and' );
-                       $space = $this->getMessageFromDB( 'word-separator' );
+                       $and = htmlspecialchars( $this->getMessageFromDB( 'and' ) );
+                       $space = htmlspecialchars( $this->getMessageFromDB( 'word-separator' ) );
                        if ( $m > 1 ) {
-                               $comma = $this->getMessageFromDB( 'comma-separator' );
+                               $comma = htmlspecialchars( $this->getMessageFromDB( 'comma-separator' ) );
                        }
                }
                $s = $l[$m];