Last modified: 2013-07-17 14:30:21 UTC
If you set an item's label,[1] description,[2] or alias[3] to a valid template call, the software actually renders the relevant field as if you'd input the substituted text of the template. This happens both with direct editing and with SetLabel. Note also that HTML markup shows up in the page title as rendered by one's browser (MediaWiki:pagetitle, that is), but not in the rendered label.[4] I also can't quite figure out why the "<some item>" shows up in the page title but not in the label - everything else that appears within curly brackets in the template's markup is excluded from both. Obviously there aren't that many valid reasons to set a label, description, or alias as a valid template call (I discovered this bug when someone tried to request an item's deletion by setting its label to {{Delete}}), but clearly this shouldn't be happening. 1. http://www.wikidata.org/w/index.php?diff=43025948 2. http://www.wikidata.org/w/index.php?diff=43027470 3. http://www.wikidata.org/w/index.php?diff=43027503 4. http://www.wikidata.org/w/index.php?oldid=43025948
Also String Properties execute templates. They break the format: https://www.wikidata.org/w/index.php?title=Q4115189&oldid=50036221
Also some tags work: <nowiki> and <code>, others are not checked. Nowiki does not work in the Users language label but in the other which are shown.
The issue seems to be that wfTemplate which uses the Template class that derives from Message, which will expand {{xxx}} in parameters per default. Parameters must either be sanitized/escaped before being passed in, or they need to be passed as raw parameters (in which case we have to be sore they don't contain evil html).
https://gerrit.wikimedia.org/r/#/c/72499/
Verified in Wikidata demo time July 27th
