Last modified: 2012-06-29 08:52:19 UTC

Wikimedia Bugzilla is closed!

Wikimedia migrated from Bugzilla to Phabricator. Bug reports are handled in Wikimedia Phabricator.
This static website is read-only and for historical purposes. It is not possible to log in and except for displaying bug reports and their history, links might be broken. See T36365, the corresponding Phabricator task for complete and up-to-date bug report information.
Bug 34365 - Inconsistent escaping in mw.msg vs. jqueryMsg
Inconsistent escaping in mw.msg vs. jqueryMsg
Status: RESOLVED FIXED
Product: MediaWiki
Classification: Unclassified
JavaScript (Other open bugs)
1.19
All All
: Normal normal (vote)
: 1.20.0 release
Assigned To: Krinkle
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2012-02-13 08:44 UTC by Michael M.
Modified: 2012-06-29 08:52 UTC (History)
4 users (show)

See Also:
Web browser: ---
Mobile Platform: ---
Assignee Huggle Beta Tester: ---


Attachments

Description Michael M. 2012-02-13 08:44:19 UTC
The message functions from mediawiki.js (mw.msg etc.) and the functions from mediawiki.jqueryMsg.js treat HTML in parameters differently. While mw.msg leaves it just as it is, jqueryMsg escapes every input without a way to avoid it:

>>> mw.messages.set({'testmsg': 'Parameter: $1'});
true
>>> mw.msg('testmsg', '<b>Bold</b>');
"Parameter: <b>Bold</b>"
>>> gM('testmsg', '<b>Bold</b>');
"Parameter: &lt;b&gt;Bold&lt;/b&gt;"
Comment 1 Niklas Laxström 2012-02-13 08:56:21 UTC
That's probably by design. You can give jquery objects as parameters.
Comment 2 Michael M. 2012-02-14 09:33:46 UTC
(In reply to comment #1)
> You can give jquery objects as parameters.

OK, that works:

>>> gM('testmsg', $('<b>Bold</b>'));
"Parameter: <b>Bold</b>"

But

>>> mw.msg('testmsg', $('<b>Bold</b>'));
"Parameter: [object Object]"

Or in a more complex example:

>>> mw.messages.set({'testmsg1': '$1 thing(s): $2', 'testmsg2': '$1 {{PLURAL:$1|thing|things}}: $2'});
true

>>> mw.msg('testmsg1', 1, '<b>item</b>');
"1 thing(s): <b>item</b>"

>>> mw.msg('testmsg2', 1, '<b>item</b>');
"1 thing: &lt;b&gt;item&lt;/b&gt;"

>>> mw.msg('testmsg1', 1, $('<b>item</b>'));
"1 thing(s): [object Object]"

>>> mw.msg('testmsg2', 1, $('<b>item</b>'));
"1 thing: <b>item</b>"

This still means that you have change the parameters in the calls to mw.msg whenever the message changes from something without "{{" to something with "{{" or vice versa. (Or when the code jqueryMsg changes, which parser to use.)

So the default mw.msg should change to escape all HTML but accept jQuery objects.
Comment 3 Michael M. 2012-06-29 08:50:55 UTC
Seems fixed with https://gerrit.wikimedia.org/r/#/c/8991/
I get now

>>> mw.msg('testmsg2', 1, '<b>item</b>');
"1 thing: <b>item</b>"

as expected.

Note You need to log in before you can comment on or make changes to this bug.


Navigation
Links