mediawiki-extensions-Templa.../includes/TemplateStylesContentHandler.php

<?php

/**
 * @file
 * @license GPL-2.0-or-later
 */

/**
 * Content handler for sanitized CSS
 */
class TemplateStylesContentHandler extends CodeContentHandler {

	/**
	 * @param string $modelId
	 */
	public function __construct( $modelId = 'sanitized-css' ) {
		parent::__construct( $modelId, [ CONTENT_FORMAT_CSS ] );
	}

	protected function getContentClass() {
		return TemplateStylesContent::class;
	}
}
Use wikimedia/css-sanitizer, and rewrite the hooking wikimedia/css-sanitizer provides a real CSS parser, which should be safer than poking at things with regular expressions. Instead of the strange hybrid model that tried to both process inline CSS and save CSS when the template is saved, it now looks for <templatestyles src="Title" /> during the parse to do all the transclusion of styles. The output method is "<style> tags in the body", pending someone implementing T160563. It now also registers a "sanitized-css" content model, which should pick up the CSS syntax highlighting and will validate the submitted CSS on submit and prevent a save if it's not valid. This patch also takes advantage of LGPL-2.x § 3 to relicense the extension as GPL-2.0+, although at this point none of the LGPL code remains anyway. Bug: T133408 Bug: T136054 Bug: T135788 Bug: T135789 Change-Id: I993e6f18d32a43aac8398743133d227b05133bbd Depends-On: If4eb5bf71f94fa366ec4eddb6964e8f4df6b824a 2017-02-20 04:33:24 +00:00			`<?php`

			`/**`
			`* @file`
Use SPDX 3.0 license identifier SPDX released version 3 of their license list (<https://spdx.org/licenses/>), which changed the FSF licenses to explicitly end in -only or -or-later instead of relying on an easy to miss + symbol. Bug: T183858 Change-Id: Ic9accb2eb34bc32d455f48dfe81a91d23a2d5f5e 2018-03-02 23:43:40 +00:00			`* @license GPL-2.0-or-later`
Use wikimedia/css-sanitizer, and rewrite the hooking wikimedia/css-sanitizer provides a real CSS parser, which should be safer than poking at things with regular expressions. Instead of the strange hybrid model that tried to both process inline CSS and save CSS when the template is saved, it now looks for <templatestyles src="Title" /> during the parse to do all the transclusion of styles. The output method is "<style> tags in the body", pending someone implementing T160563. It now also registers a "sanitized-css" content model, which should pick up the CSS syntax highlighting and will validate the submitted CSS on submit and prevent a save if it's not valid. This patch also takes advantage of LGPL-2.x § 3 to relicense the extension as GPL-2.0+, although at this point none of the LGPL code remains anyway. Bug: T133408 Bug: T136054 Bug: T135788 Bug: T135789 Change-Id: I993e6f18d32a43aac8398743133d227b05133bbd Depends-On: If4eb5bf71f94fa366ec4eddb6964e8f4df6b824a 2017-02-20 04:33:24 +00:00			`*/`

			`/**`
			`* Content handler for sanitized CSS`
			`*/`
			`class TemplateStylesContentHandler extends CodeContentHandler {`

			`/**`
			`* @param string $modelId`
			`*/`
			`public function __construct( $modelId = 'sanitized-css' ) {`
			`parent::__construct( $modelId, [ CONTENT_FORMAT_CSS ] );`
			`}`

			`protected function getContentClass() {`
			`return TemplateStylesContent::class;`
			`}`
			`}`