Separate adding HTML markup to message from others

We really want this to be explicit for easier review and hiding this in second parameter of addParam doesn't make it. Signed-off-by: Michal Čihař <michal@cihar.com>
2016-06-16 13:41:35 +02:00 · 2016-06-16 13:41:35 +02:00 · 9348d0cb16
commit 9348d0cb16
parent 46e8121e41
10 changed files with 70 additions and 61 deletions
--- a/db_operations.php
+++ b/db_operations.php
@ -282,12 +282,8 @@ if (!$is_information_schema) {
                '%sFind out why%s.'
            )
        );
-        $message->addParam(
-            '<a href="'
-            . './chk_rel.php' . $url_query . '">',
-            false
-        );
-        $message->addParam('</a>', false);
+        $message->addParamHtml('<a href="./chk_rel.php' . $url_query . '">');
+        $message->addParamHtml('</a>');
        /* Show error if user has configured something, notice elsewhere */
        if (!empty($cfg['Servers'][$server]['pmadb'])) {
            $message->isError(true);
--- a/import.php
+++ b/import.php
@ -608,8 +608,8 @@ if ($timeout_passed) {
            . ' please %sresubmit the same file%s and import will resume.'
        )
    );
-    $message->addParam('<a href="' . $importUrl . '">', false);
-    $message->addParam('</a>', false);
+    $message->addParamHtml('<a href="' . $importUrl . '">');
+    $message->addParamHtml('</a>');

    if ($offset == 0 || (isset($original_skip) && $original_skip == $offset)) {
        $message->addString(
--- a/index.php
+++ b/index.php
@ -569,12 +569,8 @@ if ($server > 0) {
                );
        }
        $msg = PMA\libraries\Message::notice($msg_text);
-        $msg->addParam(
-            '<a href="./chk_rel.php'
-            . $common_url_query . '">',
-            false
-        );
-        $msg->addParam('</a>', false);
+        $msg->addParamHtml('<a href="./chk_rel.php' . $common_url_query . '">');
+        $msg->addParamHtml('</a>');
        /* Show error if user has configured something, notice elsewhere */
        if (!empty($cfg['Servers'][$server]['pmadb'])) {
            $msg->isError(true);
--- a/libraries/DisplayResults.php
+++ b/libraries/DisplayResults.php
@ -4718,7 +4718,7 @@ class DisplayResults
        $message->addParam($first_shown_rec);

        if ($message_view_warning !== false) {
-            $message->addParam('... ' . $message_view_warning, false);
+            $message->addParamHtml('... ' . $message_view_warning);
        } else {
            $message->addParam($last_shown_rec);
        }
--- a/libraries/Message.php
+++ b/libraries/Message.php
@ -419,26 +419,42 @@ class Message
    }

    /**
-     * add parameter, usually in conjunction with strings
+     * add string or Message parameter
     *
     * usage
     * <code>
     * $message->addParam('[em]some string[/em]');
-     * $message->addParam('<img src="img" />', false);
     * </code>
     *
-     * @param mixed   $param parameter to add
-     * @param boolean $raw   whether parameter should be passed as is
-     *                       without html escaping
+     * @param mixed $param parameter to add
     *
     * @return void
     */
-    public function addParam($param, $raw = true)
+    public function addParam($param)
    {
        if ($param instanceof Message) {
            $this->params[] = $param;
-        } elseif ($raw) {
+        } else {
            $this->params[] = htmlspecialchars($param);
+        }
+    }
+
+    /**
+     * add parameter as raw HTML, usually in conjunction with strings
+     *
+     * usage
+     * <code>
+     * $message->addParamHtml('<img src="img" />');
+     * </code>
+     *
+     * @param mixed $param parameter to add
+     *
+     * @return void
+     */
+    public function addParamHtml($param)
+    {
+        if ($param instanceof Message) {
+            $this->params[] = $param;
        } else {
            $this->params[] = Message::notice($param);
        }
--- a/libraries/display_export.lib.php
+++ b/libraries/display_export.lib.php
@ -571,19 +571,17 @@ function PMA_getHtmlForExportOptionsOutputFormat($export_type)
            . 'Other text will be kept as is. See the %4$sFAQ%5$s for details.'
        )
    );
-    $msg->addParam(
+    $msg->addParamHtml(
        '<a href="' . PMA_linkURL(PMA_getPHPDocLink('function.strftime.php'))
-        . '" target="documentation" title="' . __('Documentation') . '">',
-        false
+        . '" target="documentation" title="' . __('Documentation') . '">'
    );
-    $msg->addParam('</a>', false);
+    $msg->addParamHtml('</a>');
    $msg->addParam($trans);
    $doc_url = PMA\libraries\Util::getDocuLink('faq', 'faq6-27');
-    $msg->addParam(
-        '<a href="' . $doc_url . '" target="documentation">',
-        false
+    $msg->addParamHtml(
+        '<a href="' . $doc_url . '" target="documentation">'
    );
-    $msg->addParam('</a>', false);
+    $msg->addParamHtml('</a>');

    $html .= PMA\libraries\Util::showHint($msg);
    $html .= '</label>';
--- a/libraries/plugins/import/ImportCsv.php
+++ b/libraries/plugins/import/ImportCsv.php
@ -117,7 +117,7 @@ class ImportCsv extends AbstractImportCsv
            $message = PMA\libraries\Message::error(
                __('Invalid parameter for CSV import: %s')
            );
-            $message->addParam(__('Columns terminated with'), false);
+            $message->addParam(__('Columns terminated with'));
            $error = true;
            $param_error = true;
            // The default dialog of MS Excel when generating a CSV produces a
@ -132,7 +132,7 @@ class ImportCsv extends AbstractImportCsv
            $message = PMA\libraries\Message::error(
                __('Invalid parameter for CSV import: %s')
            );
-            $message->addParam(__('Columns enclosed with'), false);
+            $message->addParam(__('Columns enclosed with'));
            $error = true;
            $param_error = true;
            // I could not find a test case where having no escaping characters
@ -143,7 +143,7 @@ class ImportCsv extends AbstractImportCsv
            $message = PMA\libraries\Message::error(
                __('Invalid parameter for CSV import: %s')
            );
-            $message->addParam(__('Columns escaped with'), false);
+            $message->addParam(__('Columns escaped with'));
            $error = true;
            $param_error = true;
        } elseif (mb_strlen($csv_new_line) != 1
@ -152,7 +152,7 @@ class ImportCsv extends AbstractImportCsv
            $message = PMA\libraries\Message::error(
                __('Invalid parameter for CSV import: %s')
            );
-            $message->addParam(__('Lines terminated with'), false);
+            $message->addParam(__('Lines terminated with'));
            $error = true;
            $param_error = true;
        }
--- a/libraries/relation.lib.php
+++ b/libraries/relation.lib.php
@ -1998,11 +1998,10 @@ function PMA_getHtmlFixPMATables($allTables, $createDb = false)
            __('%sCreate%s missing phpMyAdmin configuration storage tables.')
        );
    }
-    $message->addParam(
-        '<a href="./chk_rel.php' . $url_query . '">',
-        false
+    $message->addParamHtml(
+        '<a href="./chk_rel.php' . $url_query . '">'
    );
-    $message->addParam('</a>', false);
+    $message->addParamHtml('</a>', false);

    $retval .= $message->getDisplay();

--- a/libraries/server_privileges.lib.php
+++ b/libraries/server_privileges.lib.php
@ -2113,10 +2113,7 @@ function PMA_updatePassword($err_url, $username, $hostname)
        $message = Message::success(
            __('The password for %s was changed successfully.')
        );
-        $message->addParam(
-            '\'' . htmlspecialchars($username)
-            . '\'@\'' . htmlspecialchars($hostname) . '\''
-        );
+        $message->addParam('\'' . $username . '\'@\'' . $hostname . '\'');
        if (isset($orig_value)) {
            $GLOBALS['dbi']->tryQuery(
                'SET `old_passwords` = ' . $orig_value . ';'
@ -2160,10 +2157,7 @@ function PMA_getMessageAndSqlQueryForPrivilegesRevoke($dbname,
    $message = Message::success(
        __('You have revoked the privileges for %s.')
    );
-    $message->addParam(
-        '\'' . htmlspecialchars($username)
-        . '\'@\'' . htmlspecialchars($hostname) . '\''
-    );
+    $message->addParam('\'' . $username . '\'@\'' . $hostname . '\'');

    return array($message, $sql_query);
 }
@ -4022,10 +4016,7 @@ function PMA_updatePrivileges($username, $hostname, $tablename, $dbname, $itemTy
    }
    $sql_query = $sql_query0 . ' ' . $sql_query1 . ' ' . $sql_query2;
    $message = Message::success(__('You have updated the privileges for %s.'));
-    $message->addParam(
-        '\'' . htmlspecialchars($username)
-        . '\'@\'' . htmlspecialchars($hostname) . '\''
-    );
+    $message->addParam('\'' . $username . '\'@\'' . $hostname . '\'');

    return array($sql_query, $message);
 }
@ -4260,9 +4251,7 @@ function PMA_addUser(
        . " AND `Host` = '" . Util::sqlAddSlashes($hostname) . "';";
    if ($GLOBALS['dbi']->fetchValue($sql) == 1) {
        $message = Message::error(__('The user %s already exists!'));
-        $message->addParam(
-            '[em]\'' . $username . '\'@\'' . $hostname . '\'[/em]'
-        );
+        $message->addParam('[em]\'' . $username . '\'@\'' . $hostname . '\'[/em]');
        $_REQUEST['adduser'] = true;
        $_add_user_error = true;

@ -4821,14 +4810,12 @@ function PMA_getHtmlForUserOverview($pmaThemeImage, $text_dir)
                    ),
                    Message::NOTICE
                );
-                $flushLink = '<a href="server_privileges.php'
+                $flushnote->addParamHtml(
+                    '<a href="server_privileges.php'
                    . URL::getCommon(array('flush_privileges' => 1))
-                    . '" id="reload_privileges_anchor">';
-                $flushnote->addParam(
-                    $flushLink,
-                    false
+                    . '" id="reload_privileges_anchor">'
                );
-                $flushnote->addParam('</a>', false);
+                $flushnote->addParamHtml('</a>');
            } else {
                $flushnote = new Message(
                    __(
--- a/test/classes/MessageTest.php
+++ b/test/classes/MessageTest.php
@ -210,18 +210,35 @@ class MessageTest extends PMATestCase
            array(PMA\libraries\Message::notice('test')),
            $this->object->getParams()
        );
-        $this->object->addParam('test', true);
+        $this->object->addParam('test');
        $this->assertEquals(
            array(PMA\libraries\Message::notice('test'), 'test'),
            $this->object->getParams()
        );
-        $this->object->addParam('test', false);
+        $this->object->addParam('test');
        $this->assertEquals(
            array(PMA\libraries\Message::notice('test'), 'test', PMA\libraries\Message::notice('test')),
            $this->object->getParams()
        );
    }

+    /**
+     * Test adding html markup
+     *
+     * @return void
+     */
+    public function testAddParamHtml()
+    {
+        $this->object->setMessage('Hello %s%s%s');
+        $this->object->addParamHtml('<a href="">');
+        $this->object->addParam('user<>');
+        $this->object->addParamHtml('</a>');
+        $this->assertEquals(
+            'Hello <a href="">user&lt;&gt;</a>',
+            $this->object->getMessage()
+        );
+    }
+
    /**
     * testing add string method
     *