@recaptime-dev's working patches + fork for Phorge, a community fork of Phabricator. (Upstream dev and stable branches are at upstream/main and upstream/stable respectively.)
hq.recaptime.dev/wiki/Phorge
phorge
phabricator
Fix most timeline escaping
Summary: Some content might be broken but it's hard to test since JS/Ajax is also a bit broken.
Test Plan: Looked at timeline examples.
Reviewers: vrana
Reviewed By: vrana
CC: aran
Maniphest Tasks: T2432
Differential Revision: https://secure.phabricator.com/D4683
+49
-31
+2
-2
src/applications/uiexample/examples/PhabricatorTimelineExample.php
+2
-2
src/applications/uiexample/examples/PhabricatorTimelineExample.php
···
98
98
99
99
$events[] = id(new PhabricatorTimelineEventView())
100
100
->setUserHandle($handle)
101
-
->setTitle(phutil_escape_html("Colorless"))
101
+
->setTitle("Colorless")
102
102
->setIcon('lock');
103
103
104
104
foreach ($colors as $color) {
105
105
$events[] = id(new PhabricatorTimelineEventView())
106
106
->setUserHandle($handle)
107
-
->setTitle(phutil_escape_html("Color '{$color}'"))
107
+
->setTitle("Color '{$color}'")
108
108
->setIcon('lock')
109
109
->setColor($color);
110
110
}
+13
src/view/AphrontView.php
+13
src/view/AphrontView.php
···
74
74
}
75
75
}
76
76
77
+
final protected function isEmptyContent($content) {
78
+
if (is_array($content)) {
79
+
foreach ($content as $element) {
80
+
if (!$this->isEmptyContent($element)) {
81
+
return false;
82
+
}
83
+
}
84
+
return true;
85
+
} else {
86
+
return !strlen((string)$content);
87
+
}
88
+
}
89
+
77
90
abstract public function render();
78
91
79
92
}
+1
-1
src/view/layout/PhabricatorAnchorView.php
+1
-1
src/view/layout/PhabricatorAnchorView.php
+33
-28
src/view/layout/PhabricatorTimelineEventView.php
+33
-28
src/view/layout/PhabricatorTimelineEventView.php
···
100
100
}
101
101
102
102
public function render() {
103
-
$content = $this->renderChildren();
103
+
$content = $this->renderHTMLChildren();
104
104
105
105
$title = $this->title;
106
-
if (($title === null) && !strlen($content)) {
106
+
if (($title === null) && $this->isEmptyContent($content)) {
107
107
$title = '';
108
108
}
109
109
···
131
131
''));
132
132
}
133
133
134
-
$title = phutil_render_tag(
134
+
$title = phutil_tag(
135
135
'div',
136
136
array(
137
137
'class' => implode(' ', $title_classes),
138
138
),
139
-
$title.$extra);
139
+
array($title, $extra));
140
140
141
-
$title = $icon.$title;
141
+
$title = $this->renderHTMLView(array($icon, $title));
142
142
}
143
143
144
144
$wedge = phutil_tag(
···
165
165
$classes[] = 'phabricator-timeline-border';
166
166
if ($content) {
167
167
$classes[] = 'phabricator-timeline-major-event';
168
-
$content = phutil_render_tag(
168
+
$content = phutil_tag(
169
169
'div',
170
170
array(
171
171
'class' => implode(' ', $content_classes),
172
172
),
173
-
phutil_render_tag(
173
+
phutil_tag(
174
174
'div',
175
175
array(
176
176
'class' => 'phabricator-timeline-inner-content',
177
177
),
178
-
$title.
179
-
phutil_render_tag(
180
-
'div',
181
-
array(
182
-
'class' => 'phabricator-timeline-core-content',
183
-
),
184
-
$content)));
185
-
$content = $image.$wedge.$content;
178
+
array(
179
+
$title,
180
+
phutil_tag(
181
+
'div',
182
+
array(
183
+
'class' => 'phabricator-timeline-core-content',
184
+
),
185
+
$content),
186
+
)));
187
+
$content = array($image, $wedge, $content);
186
188
} else {
187
189
$classes[] = 'phabricator-timeline-minor-event';
188
-
$content = phutil_render_tag(
190
+
$content = phutil_tag(
189
191
'div',
190
192
array(
191
193
'class' => implode(' ', $content_classes),
192
194
),
193
-
$image.$wedge.$title);
195
+
array($image, $wedge, $title));
194
196
}
195
197
196
198
$outer_classes = $this->classes;
···
209
211
);
210
212
}
211
213
212
-
return javelin_render_tag(
214
+
return javelin_tag(
213
215
'div',
214
216
array(
215
217
'class' => implode(' ', $outer_classes),
···
217
219
'sigil' => $sigil,
218
220
'meta' => $meta,
219
221
),
220
-
phutil_render_tag(
222
+
phutil_tag(
221
223
'div',
222
224
array(
223
225
'class' => implode(' ', $classes),
···
273
275
->setAnchorName($this->anchor)
274
276
->render();
275
277
276
-
$date = $anchor.phutil_tag(
277
-
'a',
278
-
array(
279
-
'href' => '#'.$this->anchor,
280
-
),
281
-
$date);
278
+
$date = $this->renderHTMLView(
279
+
array(
280
+
$anchor,
281
+
phutil_tag(
282
+
'a',
283
+
array(
284
+
'href' => '#'.$this->anchor,
285
+
),
286
+
$date),
287
+
));
282
288
}
283
289
$extra[] = $date;
284
290
}
285
291
}
286
292
287
-
$extra = implode(' · ', $extra);
288
293
if ($extra) {
289
-
$extra = phutil_render_tag(
294
+
$extra = phutil_tag(
290
295
'span',
291
296
array(
292
297
'class' => 'phabricator-timeline-extra',
293
298
),
294
-
$extra);
299
+
array_interleave(" \xC2\xB7 ", $extra));
295
300
}
296
301
297
302
return $extra;