It adds the ability to replace the current section ID escaping
schema (.C0.DE) with a HTML5-compliant escaping schema that is
displayed as Unicode in many modern browsers.
See the linked bug for discussion of various options that were
considered before the implementation. A few remarks:
* Because Sanitizer::escapeId() is used in a bunch of places without
escaping, I'm deprecating it without altering its behavior.
* The bug described in comments for Parser::guessLegacySectionNameFromWikiText()
is still there in some Edge versions that display mojibake.
Bug: T152540
Change-Id: Id304010a0342efbb7ef2d56c5b8b244f2e4fb2c5
And auto-fix all errors.
The `<exclude-pattern>` stanzas are now included in the default ruleset
and don't need to be repeated.
Change-Id: I928af549dc88ac2c6cb82058f64c7c7f3111598a
The title, although it refers to a foreign page, is considered local
due to Title::isExternal() being false, hence it's namespace prefix
is localized.
We need to use the canonical namespace name instead.
Bug: T169221
Change-Id: I5e5f7d873b9497ca6c8853e7d8170a4f4f07c051
In 1bf5a652 the id selector was changed to a class selector for toctitle.
The cached HTML has been expired now and the id selector is not necessary
anymore.
Also remove the id selector #toc.tochidden for print style. This is not
necessary because the tochidden gets only added to .toc and not to #toc.
Change-Id: I43cfffdb0807e8ed8f6b7b8732ba857b709bee80
Self-links are still semantically links, and representing them as <strong>s
is inelegant and more important a real pain to work with, especially in
contexts where they may change state (like inside an editor).
Instead, render them as <a>, with no href to avoid user agent style over-
rides and with a class to style them as before, named 'mw-selflink' to go
with 'mw-redirect'. This allows much easier adjustment later. The old CSS
class 'selflink' is retained for backwards compatibility, but deprecated.
Bug: T160480
Change-Id: If058843924c3b30c116df2520aef93a004d98a5d
On Special:Watchlist, Special:Contributions, Special:Recentchanges etc.
there are links to (talk | contribs | block) for the user who did the
contribution. Add CSS class for them. Introduce the following css
classes:
- mw-usertoollinks-contribs
- mw-usertoollinks-talk
- mw-usertoollinks-block
- mw-usertoollinks-mail
Bug: T156879
Change-Id: I85a3b0987a016ff25026f1c047214a31170b0452
It's unreasonable to expect newbies to know that "bug 12345" means "Task T14345"
except where it doesn't, so let's just standardise on the real numbers.
Change-Id: I6f59febaf8fc96e80f8cfc11f4356283f461142a
This is a static function that uses global state through $wgLang, and
provides no benefit than calling Language::formatSize() directly aside
from escaping. But that should generally be handled closer to output
generation.
Change-Id: I35fdbaf2fcaa89f0d4442e1f63ec8ed29e0c339f
Linker::formatTemplates() was a static function that depended upon
global state like $wgLang (explicitly), $wgUser & $wgTitle (implicitly).
Moving it to a separate class allows us to clean it up a little bit and
use modern things like RequestContext and LinkRenderer.
Bug: T145177
Change-Id: Icdea8a2b299b4876feb3df3d66df3e4c104dd928
This is more consistent with LoadBalancer, modern, and inclusive
of master/master mysql, NDB cluster, and MariaDB galera cluster.
The old constant is an alias now.
Change-Id: I0b37299ecb439cc446ffbe8c341365d1eef45849
Usernames can be in any script/language and include weak and neutral
characters like parentheses and dashes - these flip and make things
look very weird when displayed in the opposite directionality.
This fix adds <bdi> tags to isolate the username when we output user
links. This will affect displays like user personal tools, history
and diff view.
Also, fixing LogFormatterTestCase::removeSomeHtml() that expected
a very rigid html input (and thus failed with the new <bdi> wrapping)
to use strip_tags() instead.
Change-Id: I2db5f4b7d3a00726461eb6b699fbdf0ecd47a1cb
Now that SpecialPage::getTitleValueFor() exists, use it so that we can
avoid returning a Title object uncessarily.
Change-Id: I5bf605baf2ecad62e189421a2e5c556cc0b6f6ac
...and add a link to the on-wiki LinkRenderer documentation to the
class. Actual wfDeprecated and replacements in all the uses to come in
follow-up patches.
Change-Id: I2fefb6c38153028d2cc68c13bc62434d3df69cd2
* Rename to getLinkClasses() since it's not really returning colours,
but CSS classes.
* Dependency inject LinkCache into LinkRenderer
* Update all callers of Linker::getLinkColour(), and mark it as
deprecated (no other uses in Gerrit)
* Update a bunch of tests for new dependency
Change-Id: Id178e2dcc60b833ce2dbad4920896b93cabba1bf
This partially reverts commit 9af38c046c.
* The new JS modules continue to exist. While not used by default,
the mediawiki.api.rollback may be used elsewhere by now.
The mediawiki.page.rollback module may still be used on cached
pages and should continue to work.
* The new API behaviour remains.
* To avoid breaking mid-air rollbacks again, the token remains
the same (plain "rollback" salt). We're not re-introducing the
web-specific salt again.
Bug: T136375
Change-Id: Iba17ce55ff9506e838bfc6e70ca280e5a20b77b6
'noclasses' makes more sense as a per-link option rather than an
instance member of the LinkRenderer instance, since it depends entirely
on whether the calling code has preloaded the link classes.
Introduce LinkRenderer::makePreloadedLink() which makes this clear and
requires passing in the classes as a separate parameter. As a side-
effect, due to the way LinkRenderer::mergeAttribs() is implemented, the
'class' attribute will always appear before the 'title' attribute in the
final output.
Change-Id: I0545aa9d7139794bc22f9d3d6d6eccde003b2982
When MW_NO_SESSION is set, getting the user options for $wgUser will
result in an error. Check for that in the service definition, and
reuse that check in Linker.
Also removed an unused use clause.
Bug: T136124
Change-Id: Id6448d12e8f4a8a94852980e5eb6ccb202066822
Similar to WatchAction (converted in commit 77cdf1919).
* Make FormAction::getFormFields not abstract.
In most cases this will just be an empty array.
* Convert RollbackAction from FormlessAction to FormAction and implement the
required error handling scenarios (mostly moved out of from the old method, or
duplicated from the WikiPage method where necessary).
* In most cases the in-between form is never used since a JavaScript handler
takes over the link and uses the API over AJAX instead. In the no-js fallback
(as well as for any existing tokenless rollback links) copy the GET parameters
into the form for re-submission as POST (plus token, added by HTMLForm).
* Remove the distinction between WebUI and API tokens. This stronger token salt made it
unnecessarily complex and was only there because it used GET until now. This streamlining of
tokens matches what we already do for 'watch', 'edit', 'patrol' and other actions.
* Fix form submission bugs when 'from' query parameter is missing.
- Ensure the required 'from' query parameter is present before showing a form.
No need for the user to submit a form we know will fail.
- Plain GET request to action=rollback (with no parameters) is now a 400 Bad Request
instead of a form that would fail when submitted.
- Submitting the form without 'form' field now correctly says why it failed.
Previously it emitted a session error, which was a lie.
Bug: T88044
Change-Id: Ia457802fec2e90573c8e7d552bc1f3cee258f10b
This is a rewrite of Linker::link() to a non-static, LinkTarget-based
interface. Users of plain Linker::link() with no options can use the
LinkRenderer instance provided by MediaWikiServices. Others that
have specific options should create and configure their own instance,
which can be used to create as many links as necessary.
The main entrypoints for making links are:
* ->makeLink( $target, $text, $attribs, $query );
* ->makeKnownLink( $target, $text, $attribs, $query );
* ->makeBrokenLink( $target, $text, $attribs, $query );
The order of the parameters are the same as Linker::link(), except
$options are now part of the LinkRenderer instance, and
known/broken status requires calling the function explicitly.
Additionally, instead of passing in raw $html for the link text, the
$text parameter will automatically be escaped unless it is specially
marked as safe HTML using the MediaWiki\Linker\HtmlArmor class.
The LinkBegin and LinkEnd hooks are now deprecated, but still function
for backwards-compatability. Clients should migrate to the nearly-
equivalent LinkRendererBegin and LinkRendererEnd hooks.
The main differences between the hooks are:
* Passing HtmlPageLinkRenderer object instead of deprecated DummyLinker
* Using LinkTarget instead of Title
* Begin hook can no longer change known/broken status of link. Use the
TitleIsAlwaysKnown hook for that.
* $options are no longer passed, they can be read (but shouldn't be
modified!) from the LinkRenderer object.
Bug: T469
Change-Id: I057cc86ae6404a080aa3c8e0e956ecbb10a897d5
noreferrer is used as support for noopener is very limited.
This is to prevent the attack detailed at
https://mathiasbynens.github.io/rel-noopener/ where you can
navigate the parent window, even if the new window is a cross-origin.
Bug: T133507
Change-Id: I6e4ab938861e246ff44048077b94847e303f1859
Signed-off-by: Chad Horohoe <chadh@wikimedia.org>
The intention for Linker::linkKnown() was to be used when the caller had
already preloaded the target's existence ('known') and called
Linker::getLinkColour() directly ('noclasses'). However, nearly all
usage of linkKnown() only did the first part, and not the latter.
So do what people actually ended up using the function for, and remove
'noclasses' from the default parameters. As long as the target the link
is being created for is already in LinkCache, this shouldn't cause any
extra database queries.
Change-Id: Ia5a4c2f18ec780627146617a1498bd04fcfbb3ee
This is a private function so it doesn't really make much of a
difference, but will allow further refactoring.
Change-Id: Idacad7b1bd4776c04659ed9af64540d6ce4b2f28
