Commit graph

113 commits

Author SHA1 Message Date
Kunal Mehta
a85f569dd1 Revert "Use CsrfTokenSet as CSRF token source"
This reverts commit 0d75fdb4f7.

Bug: T287542
Change-Id: Iedd3461869f973f8d621a39e6ad4674cbb577551
2021-08-05 15:48:26 -07:00
Petr Pchelko
0d75fdb4f7 Use CsrfTokenSet as CSRF token source
Change-Id: I079d2c802d9b48d6abf7f37fa9ef7dafac631345
2021-07-12 14:19:15 -07:00
Bartosz Dziewoński
0feccb0cb1 Rename CSS class 'mw-htmlform-field-autoinfuse' to fit the convention
Rename to 'mw-htmlform-autoinfuse'. This avoids the 'mw-htmlform-field-'
prefix normally only used by HTMLFormField subclasses, and matches the
'mw-htmlform-autoinfuse-lazy' class used in related code.

Bug: T278036
Change-Id: I4a73ec6d5993a7e4f10ef8523eef594a70c9abcc
2021-06-19 15:57:43 +02:00
Thiemo Kreuz
2ba01c7ee7 Remove some more comments that literally repeat the code
… including PHPDoc tags like `@return <type> $variableName`.
A return value doesn't have a variable name. I can see that
some people do this intentionally, repeating the variable
name that was used in the final `return $var;` at the end
of a method. This can indeed be helpful. I leave a lot of
these untouched and removed them only when it's obviously
wrong, or does not provide any additional information in
addition to what the code already says.

Change-Id: Ia18cd9f25ef658b08ad25b97a744897e2a8deffc
2021-06-18 21:23:56 +00:00
Umherirrender
1121757ed7 Allow html form field option 'options-messages' to get parsed
The message keys by 'options-messages' are evaluated with
Message::plain(), but some situation needs Message::parse() to support
templates and HTML formatting in this values.

Bug: T58633
Change-Id: I8f52f21ae2641ddcad1aa85ce6bf14de1a09ab4b
2021-05-28 21:55:09 +02:00
Umherirrender
cf541752e0 Add comment to fall-through cases in switch
Fix new coming sniff
PSR2.ControlStructures.SwitchDeclaration.TerminatingComment

Bug: T182546
Change-Id: I3f8d43c730981d8faaa72910d7f3b58a14a8372f
2021-04-15 17:31:12 +00:00
Reedy
5bb8d031c0 HTMLFormField: Use non namespaced class name rather than static::class
Bug: T277414
Change-Id: I9ba76522932147df098abef48b2a076c2aa81aac
2021-03-19 18:19:20 +00:00
DannyS712
78b8a56114 Remove mentions of mw.htmlform.Checker
mw.htmlform.Checker was removed in 743edb1
and no longer exists

Change-Id: Id269f63fd3ca64a719745868d6df907548c15fad
2020-08-18 06:26:07 +00:00
Nikki Nikkhoui
6b0e9eafe1 HTML Classes stability annotations
Add stability annotations for HTML classes.

Bug: T247862
Change-Id: I4dad7b98213ceceb8c04b24e5d52e6fecadb3538
2020-07-13 14:54:28 +02:00
Bartosz Dziewoński
68cbfcf3ed Use errorbox/warningbox for all HTMLFormField errors
Continuing the work for 441e12f2d9,
which did this for the main HTMLForm errors (grouped at the top of
the form). This handles errors for individual fields.

This fixes the display of error/warning messages on Special:CreateAccount,
and should not break anything else too badly (it helps that most forms
are using OOUI these days).

Bug: T246894
Change-Id: If1ccdff10bebe0c2eeca4c15d82271c9de1af164
2020-03-19 21:29:15 +01:00
James D. Forrester
0958a0bce4 Coding style: Auto-fix MediaWiki.Usage.IsNull.IsNull
Change-Id: I90cfe8366c0245c9c67e598d17800684897a4e27
2020-01-10 14:17:13 -08:00
Daimona Eaytoy
598c4d7fcb build: Upgrade phan to 0.9.0
Scalar casts are still allowed (for now), because there's a huge amount
of false positives. Ditto for invalid array offsets.

Thoughts about the rest: luckily, many false positives with array offsets
have gone. Moreover, since *Internal issues are suppressed in the base
config, we can remove inline suppressions.

Unfortunately, there are a couple of new issues about array additions
with only false positives, because apparently they don't take
branches into account.

Change-Id: I5a3913c6e762f77bfdae55051a395fae95d1f841
2019-12-07 20:16:19 +00:00
Umherirrender
8752df6592 Use varargs for MessageLocalizer::msg and similar
Bug: T191666
Change-Id: I59f2ae1a96af392026fc106e57d23553003c16b8
2019-10-05 17:47:49 +00:00
Daimona Eaytoy
3439c00073 Suppress PhanUndeclaredProperty for custom properties and phan bugs
And remove the issue from the exclusions list.

Bug: T231636
Change-Id: Iee73ddb554e354abe52d13dcfc453f9a15bb8877
2019-09-14 13:22:54 +00:00
Daimona Eaytoy
7862475b0d Improve various PHP method doc blocks
Follows-up 5eac6d131c.

Change-Id: I92c9d482fd8693a16b3967e763a4eb40b963c562
2019-09-05 18:45:40 +00:00
Daimona Eaytoy
5eac6d131c Unsuppress more phan issues (part 3)
Bug: T231636
Depends-On: I78354bf5f0c831108c8f606e50c87cf6bc00d8bd
Change-Id: I58e67c2b38389df874438deada4239510d21654f
2019-08-31 16:38:55 +00:00
Umherirrender
11c9075767 Adjust type hints in htmlform related classes
The return type of HTMLFormField::loadDataFromRequest to mixed
Some sub classes returning arrays or bools, not everytime strings

HTMLCheckField is working with arrays, so also allow array on getTableRow

Change-Id: I076feea76d8e296f27c8a9fb4cbd9368584ba187
2019-07-05 18:11:53 +00:00
Fomafix
110a5877e9 Use [...] instead of array(...) in PHP comments and documentation
Change-Id: I0c83783051bf35fe785bc01644eeb2946902b6b2
2019-06-17 21:15:09 +02:00
Umherirrender
cb897cbad4 Restore func_get_args in HTMLFormField
Mocking variadic arguments does not work in hhvm

Follow-Up: I066ec95a7beb7c0665146195a08e7cce1222c788
Change-Id: Ic3b689d003a4659abdc4c9344ffd83f24f448912
2019-04-14 15:01:20 +02:00
Aryeh Gregor
7b4489e019 Get rid of unnecessary func_get_args() and friends
HHVM does not support variadic arguments with type hints.  This is
mostly not a big problem, because we can just drop the type hint, but
for some reason PHPUnit adds a type hint of "array" when it creates
mocks, so a class with a variadic method can't be mocked (at least in
some cases).  As such, I left alone all the classes that seem like
someone might like to mock them, like Title and User.  If anyone wants
to mock them in the future, they'll have to switch back to
func_get_args().  Some of the changes are definitely safe, like
functions and test classes.

In most cases, func_get_args() (and/or func_get_arg(), func_num_args() )
were only present because the code was written before we required PHP
5.6, and writing them as variadic functions is strictly superior. In
some cases I left them alone, aside from HHVM compatibility:

* Forwarding all arguments to another function. It's useful to keep
  func_get_args() here where we want to keep the list of expected
  arguments and their meanings in the function signature line for
  documentation purposes, but don't want to copy-paste a long line of
  argument names.
* Handling deprecated calling conventions.
* One or two miscellaneous cases where we're basically using the
  arguments individually but want to use them as an array as well for
  some reason.

Change-Id: I066ec95a7beb7c0665146195a08e7cce1222c788
2019-04-12 20:17:01 +00:00
Ed Sanders
9b277fb5da OOUI forms: Remove infusable = false
False is already the default value for infusable.

Change-Id: Ie0e9b7467b7f3f13c45372b38b7b80ba78852e55
2019-03-25 19:00:18 +00:00
Thiemo Kreuz
fa7e5bd901 Avoid expensive array_shift where possible
array_shift manipulates the original array. This is surprisingly
expensive, because it iterates *all* elements in the array and
decrements numeric keys. The code touched in this patch does not need
this restructured new array, but only the individual elements.

Change-Id: Iee28377b2c9930f6de821e041381a1d7564f7633
2018-12-17 11:58:55 +01:00
Bartosz Dziewoński
54d9b373cd HTMLForm: Remove parameters 'notice', 'notice-messages', 'notice-message'
Bug: T197179
Change-Id: I911cabc1e1e1c2abb8e91a55c05eaa1c76134087
2018-10-22 12:19:58 -07:00
Bartosz Dziewoński
65b11b8fee Use PHP 7 '??' operator instead of '?:' (round 2)
A few issues have snuck in since I33b421c8cb11cdd4ce896488c9ff5313f03a38cf.

Change-Id: Ib75470a7a3c19e2d48f498b396eee6ed733690e4
2018-09-03 20:48:10 +02:00
jenkins-bot
fede766fe9 Merge "Fix some warnings from phan-taint-check" 2018-08-30 02:54:03 +00:00
Bartosz Dziewoński
76e7016993 HTMLForm: Deprecate parameters 'notice', 'notice-messages', 'notice-message'
Bug: T197179
Change-Id: I603436e0720fdc0f08f35f3c0630b79865a9c82a
2018-08-29 22:02:52 +02:00
Ed Sanders
e5911a826c Pass through 'helpInline' to OOUI FieldLayout and make true by default
This change is meant to improve the layout of Special:Preferences in
particular, but it will affect any OOUI form using help messages. It
should be a harmless or beneficial change for most of them.

Previous behavior can be restored by passing `'help-inline' => false`
to the HTMLForm factory after 'help-message'/'help-messages'/'help'.

For example:

* Special:Preferences?ooui=1#mw-prefsection-watchlist
  * Before: https://phabricator.wikimedia.org/F25025213
  * After:  https://phabricator.wikimedia.org/F25025181

* Special:ChangeEmail
  * Before: https://phabricator.wikimedia.org/F25073327
  * After:  https://phabricator.wikimedia.org/F25073328

* Special:BotPasswords/foo
  * Before: https://phabricator.wikimedia.org/F25073324
  * After:  https://phabricator.wikimedia.org/F25073326

Bug: T181854
Change-Id: Ica67fe4081dfaa8eb9e8f56fdb93530750e47012
2018-08-17 22:34:33 +02:00
Brian Wolff
f631c16e84 Fix some warnings from phan-taint-check
Change-Id: I58af7bc21f4c6b77dbda689faa904b53705fe576
2018-08-13 23:00:06 +00:00
Fomafix
6866cfec37 Simplify PHP by using ?? and ?:
Also remove not necessary surrounding parentheses.

Change-Id: I0eb5c9c1bdfb09a800258379cdcefb5fd4d3d21c
2018-07-10 20:03:17 +00:00
Fomafix
f02eed24ac Allow overloading of getLabel() with return '&#160;'
This is a follow-up to 125cbd8c01.

Bug: T198338
Change-Id: I21626326dde368d70fcc33052e43ff90db5ea9c0
2018-06-28 11:25:39 +02:00
Fomafix
125cbd8c01 Use \u{00A0} instead of &#160; or &nbsp;
Directly use the UTF-8 encoding of the 'NO-BREAK SPACE' (U+00A0) instead of
the HTML/XML entities &#160; or &#xa0; or &nbsp;.

With the UTF-8 character the generated HTML is shorter and better to read.

Also change the special value for the label in HTMLForm from &#160; to
U+00A0 but also support &#160; for backward compability.

Bug: T154300
Change-Id: I882599ac1120789bb4e524c4394870680caca4f4
2018-06-24 01:20:13 +00:00
Max Semenik
1e680456b4 Get rid of call_user_func(_array)(), part 3
Also cleaned up nearby code in a couple places.

Change-Id: Ibf44ee7c0ceb739d7e79406e4ff39303c316e285
2018-06-10 02:21:24 +00:00
Bartosz Dziewoński
485f66f174 Use PHP 7 '??' operator instead of '?:' with 'isset()' where convenient
Find: /isset\(\s*([^()]+?)\s*\)\s*\?\s*\1\s*:\s*/
Replace with: '\1 ?? '

(Everywhere except includes/PHPVersionCheck.php)
(Then, manually fix some line length and indentation issues)

Then manually reviewed the replacements for cases where confusing
operator precedence would result in incorrect results
(fixing those in I478db046a1cc162c6767003ce45c9b56270f3372).

Change-Id: I33b421c8cb11cdd4ce896488c9ff5313f03a38cf
2018-05-30 18:06:13 -07:00
Kunal Mehta
c381dd0a99 Enable "PhanTypeInvalidRightOperand" phan checks
HTMLFormField subclasses triggered false positives when phan incorrectly
thought that $this->mOptions was only a boolean.

ReplacementArray $this->data was defined as possibly being boolean, but
in reality that never happened.

Change-Id: I06bae9c9952366ff7927df37373b146d570f4a02
2018-05-17 23:27:42 -07:00
Volker E
21a36e8046 Hygiene: Use “OOUI” as unified name in build and code documentation
Bug: T182360
Change-Id: I981c574003fa505fe133be6da405e73330c4e9a1
2018-01-31 22:10:46 -08:00
Bartosz Dziewoński
59ab21b0ab HTMLFormField: Treat weird '&#160;' labels as empty in OOUI mode
I have no idea where this convention came from, but we had them in
core until 265ff105aa and they still
appear widely in extensions. The non-OOUI code also has special
handling for it (a label equalling '&#160;' is treated as raw HTML
even when not marked as such). In OOUI-style "vertical" forms these
fake labels cause a lot of unnecessary white space to appear, so let's
just not display them.

Change-Id: I45559fa69dc1ae4b9d048445e27a24815fe93b6d
2017-09-28 14:13:14 +02:00
Bartosz Dziewoński
a5c3d029c5 Reduce code duplication for parsing messages into dropdown menus
The same behavior was implemented by Xml::listDropDown(),
Article::confirmDelete() and HTMLFormField::getOptions().
A new function Xml::listDropDownOptions() is added and
all three are changed to use it.

Additionally:
* Xml::listDropDown() now uses XmlSelect internally to generate the
  dropdown HTML.
* Xml::listDropDownOptionsOoui() is introduced to handle converting
  the existing format to the OOUI format, which was previously
  duplicated in Article::confirmDelete() and HTMLFormField::getOptionsOOUI().
* This change allows HTMLForm 'select' fields (HTMLSelectField) to
  support nested options (optgroups) in OOUI mode. This is a
  prerequisite for T117781.

Bug: T117781
Change-Id: I0a088f61eb32ec59677113583c7ecdcbc3fd2af0
2017-09-12 20:49:20 +02:00
Umherirrender
f739a8f368 Improve some parameter docs
Add missing @return and @param to function docs and fixed some @param

Change-Id: I810727961057cfdcc274428b239af5975c57468d
2017-09-10 20:32:31 +02:00
Umherirrender
3f1a52805e Use short type bool/int in param documentation
Enable the phpcs sniffs for this and used phpcbf

Change-Id: Iaa36687154ddd2bf663b9dd519f5c99409d37925
2017-08-20 13:20:59 +02:00
Max Semenik
fd6e9ef2d4 Human-readable section ID support
It adds the ability to replace the current section ID escaping
schema (.C0.DE) with a HTML5-compliant escaping schema that is
displayed as Unicode in many modern browsers.

See the linked bug for discussion of various options that were
considered before the implementation. A few remarks:
* Because Sanitizer::escapeId() is used in a bunch of places without
  escaping, I'm deprecating it without altering its behavior.
* The bug described in comments for Parser::guessLegacySectionNameFromWikiText()
  is still there in some Edge versions that display mojibake.

Bug: T152540
Change-Id: Id304010a0342efbb7ef2d56c5b8b244f2e4fb2c5
2017-08-01 20:32:20 -07:00
Bartosz Dziewoński
8c1a1a62a1 Avoid duplicate accesskey hints on OOUI widgets
Values returned by `Linker::tooltipAndAccesskeyAttribs()` and
`Linker::titleAttrib( ..., 'withaccess' )` include an accesskey
hint in the title text. This is unnecessary when used for OOjs UI
widgets, since after the changes from T168408 they display an
accesskey hint automatically.

Also fixed some other accesskey bugs in HTMLForm which probably
no one ever ran into.

Bug: T168408
Change-Id: I63285b5bce3341875a6d82eba059623bf105ca62
2017-08-01 20:59:13 +00:00
Brad Jorsch
4d59edf138 Update account creation form validation
Use the cancreateerror returned from list=users&usprop=cancreate for
username validation.

Use the new action=validatepassword to validate entered passwords.

This also injects the resulting errors in the style of HTMLForm's field
validation rather than at the top of the form.

Change-Id: Ie8c1270eb605367556fe36b0b2080eb3f957dc54
2017-03-16 15:42:06 +00:00
Timo Tijhof
3a2a707546 Clean up remaining get_class() uses
* get_class()        -> __CLASS__ (same as self::class)
* get_called_class() -> static::class
* get_class($this)   -> static::class

Change-Id: I1888a1897ecf4548a2e5a67a942e5c080dd7e3d3
2017-03-07 22:03:47 +00:00
Bartosz Dziewoński
38cc8a697f HTMLForm: Suppress HTML5 form validation for non-JS users when needed
Our 'hide-if' fields are fundamentally incompatible with HTML5 form
validation attributes. If you have a checkbox field A, and field B
that is required, but hidden if A is unchecked - that's impossible to
express with HTML5 form validation. The only thing you can do is
remove the validation on B (or on the entire form).

The field contents are still validated server-side, just like if the
browser did not support HTML5 forms. The validation is also re-enabled
in JavaScript, since we have extra support for 'hide-if' field that
makes them work.

Change-Id: Ia7ffa76965a7c14af9b6d2db007b6255498398d9
2017-01-10 22:49:38 +00:00
Erik Bernhardson
d67197fa11 Cleanup some incorrect return annotations
Most of these are simply changing annotations to reflect
reality. If a function can return false to indicate failure
the @return should indicate it.

Some are fixing preg_match calls, preg match returns 1, 0 or false,
but the functions all claim to return booleans.

This is far from all the incorrect return types in mediawiki, there
are around 250 detected by phan, but have to start somewhere.

Change-Id: I1bbdfee6190747bde460f8a7084212ccafe169ef
2016-12-12 10:15:05 -08:00
Brad Jorsch
7fdbe15fb6 HTMLForm: Allow returning Message objects from HTMLFormField::validate()
It mostly already worked. HTMLForm::trySubmit() needed a little
adjustment to handle things properly.

Change-Id: Ibb17bb61ac0b2d41953249980bc2f23b8a3ae5b6
2016-11-14 13:25:14 -05:00
addshore
63dd31cd31 Add access modifiers to htmlform classes
Change-Id: Id8c0f0676b3200993af3cec493efc99839211bcc
2016-11-04 11:40:42 +01:00
Gergő Tisza
3090a1d1f8 Add HTMLFormField class for MWRestrictions and use it for bot passwords
Change-Id: Ib50238e3be5eec63eb5df97154b60dc4ca33d581
2016-09-22 20:50:36 +00:00
jenkins-bot
4ff253aa23 Merge "HTMLFormField: Don't display empty popup in OOUI mode if empty 'help' is given" 2016-08-25 16:27:45 +00:00
Bartosz Dziewoński
6585b865c1 HTMLFormField: Don't display empty popup in OOUI mode if empty 'help' is given
Change-Id: I1aa68dcb9cdf1584f65436a641b119f0d61537ef
2016-08-24 15:24:39 +00:00