Page MenuHomePhabricator

Tags defined in $htmlattrs are not rendered as html tags on screen
Closed, InvalidPublic

Description

I have several tags, including "iframe", that are defined as being allowed html
tags in the $htmlattrs variable in Parser.php.

http://meta.wikimedia.org/wiki/HTML#Permitted_HTML

However, when i try to draw the page, these values are escaped, and not returned
as html tags. See this example:

http://www.tmbw.net/wiki/index.php/Template:Song_Nav_Stub

According to all documentation i can find, i am doing it correctly. Here's the
example from my Parser.php file:

function getHTMLattrs () {

		$htmlattrs = array( # Allowed attributes--no scripting, etc.
				'title', 'align', 'lang', 'dir', 'width', 'height',
				'bgcolor', 'clear', /* BR */ 'noshade', /* HR */
				'cite', /* BLOCKQUOTE, Q */ 'size', 'face', 'color',
				/* FONT */ 'type', 'start', 'value', 'compact',
				/* For various lists, mostly deprecated but safe */
				'summary', 'width', 'border', 'frame', 'rules',
				'cellspacing', 'cellpadding', 'valign', 'char',
				'charoff', 'colgroup', 'col', 'span', 'abbr', 'axis',
				'headers', 'scope', 'rowspan', 'colspan', /* Tables */
				'id', 'class', 'name', 'style', 'iframe', 'src', 'frameborder', 'scrolling'
				);
		return $htmlattrs ;

Version: 1.4.x
Severity: normal
URL: http://www.tmbw.net/wiki/index.php/Template:Song_Nav_Stub

Details

Reference
bz3071

Revisions and Commits

Event Timeline

bzimport raised the priority of this task from to Medium.Nov 21 2014, 8:46 PM
bzimport added a project: MediaWiki-Parser.
bzimport set Reference to bz3071.
bzimport added a subscriber: Unknown Object (MLST).

That's the whitelist of HTML attributes, not elements.

Check the arrays in removeHTMLtags().

epriestley changed the task status from Invalid to Resolved by committing Unknown Object (Diffusion Commit).Mar 4 2015, 8:15 AM
epriestley added a commit: Unknown Object (Diffusion Commit).
Aklapper changed the task status from Resolved to Invalid.Mar 4 2015, 11:36 AM
Aklapper claimed this task.