Undo url helper changes - url methods no longer return a SafeString.

Adding SafeString::of_safe_html() calls where urls are passed as parameters to t() and t2().

5 files changed, 20 insertions, 33 deletions

diff --git a/modules/gallery/helpers/MY_url.php b/modules/gallery/helpers/MY_url.php
index 6092a9d8..c4967c52 100644
--- a/modules/gallery/helpers/MY_url.php
+++ b/modules/gallery/helpers/MY_url.php
@@ -30,8 +30,7 @@ class url extends url_Core {
     if ($parts[0] == "albums" || $parts[0] == "photos") {
       $uri = model_cache::get("item", $parts[1])->relative_path();
     }
-    $url = parent::site($uri . $query, $protocol);
-    return SafeString::of_safe_html($url);
+    return parent::site($uri . $query, $protocol);
   }
 
   static function parse_url() {
@@ -100,25 +99,4 @@ class url extends url_Core {
   static function abs_current($qs=false) {
     return self::abs_site(url::current($qs));
   }
-
-  public static function base($index=false, $protocol=false) {
-    $url = parent::base($index, $protocol);
-    return SafeString::of_safe_html($url);
-  }
-
-  public static function current($qs=false) {
-    $url = parent::current($qs);
-    return SafeString::of_safe_html($url);
-  }
-
-  public static function file($file, $index=false) {
-    $url = parent::file($file, $index);
-    return SafeString::of_safe_html($url);
-  }
-
-  public static function merge(array $arguments) {
-    $url = parent::merge($arguments);
-    return SafeString::of_safe_html($url);
-  }
-
 }
diff --git a/modules/gallery/helpers/graphics.php b/modules/gallery/helpers/graphics.php
index 7dc46eeb..fbb85bec 100644
--- a/modules/gallery/helpers/graphics.php
+++ b/modules/gallery/helpers/graphics.php
@@ -442,7 +442,7 @@ class graphics_Core {
     if (!module::get_var("gallery", "graphics_toolkit")) {
       site_status::warning(
         t("Graphics toolkit missing!  Please <a href=\"%url\">choose a toolkit</a>",
-          array("url" => url::site("admin/graphics"))),
+          array("url" => SafeString::of_safe_html(url::site("admin/graphics")))),
         "missing_graphics_toolkit");
     }
   }
diff --git a/modules/gallery/tests/Xss_Security_Test.php b/modules/gallery/tests/Xss_Security_Test.php
index 690dc760..a2d3d59b 100644
--- a/modules/gallery/tests/Xss_Security_Test.php
+++ b/modules/gallery/tests/Xss_Security_Test.php
@@ -130,14 +130,14 @@ class Xss_Security_Test extends Unit_Test_Case {
 	      $token = $tokens[$token_number];
 	    }
 	  } else if ($token[1] == "url") {
-	    // url methods return a SafeString
+	    // url methods return safe HTML
 	    if (self::_token_matches(array(T_DOUBLE_COLON, "::"), $tokens, $token_number + 1) &&
 		self::_token_matches(array(T_STRING), $tokens, $token_number + 2) &&
 		in_array($tokens[$token_number + 2][1],
 			 array("site", "current", "base", "file", "abs_site", "abs_current",
 			       "abs_file", "merge")) &&
 		self::_token_matches("(", $tokens, $token_number + 3)) {
-	      $frame->is_safestring(true);
+	      $frame->is_safe_html(true);
 
 	      $method = $tokens[$token_number + 2][1];
 	      $frame->expr_append("::$method(");
@@ -203,7 +203,8 @@ class Xss_Security_Test extends Unit_Test_Case {
 	    $state = "CLEAN";
 	  }
 	} else {
-	  if ($frame->is_safestring() || $frame->purified_html_called() || $frame->for_html_called()) {
+	  if ($frame->is_safe_html() || $frame->is_safestring() ||
+              $frame->purified_html_called() || $frame->for_html_called()) {
 	    $state = "CLEAN";
 	  }
 	}
@@ -259,6 +260,7 @@ class Xss_Security_Test_Frame {
   private $_for_html_called = false;
   private $_purified_html_called = false;
   private $_json_encode_called = false;
+  private $_is_safe_html = false;
   private $_line;
 
   function __construct($line_number, $in_script_block) {
@@ -288,6 +290,13 @@ class Xss_Security_Test_Frame {
     return $this->_is_safestring;
   }
 
+  function is_safe_html($new_val=NULL) {
+    if ($new_val !== NULL) {
+      $this->_is_safe_html = (bool) $new_val;
+    }
+    return $this->_is_safe_html;
+  }
+
   function json_encode_called($new_val=NULL) {
     if ($new_val !== NULL) {
       $this->_json_encode_called = (bool) $new_val;
diff --git a/modules/gallery/views/admin_block_welcome.html.php b/modules/gallery/views/admin_block_welcome.html.php
index 38d2bd56..c6ccdbf3 100644
--- a/modules/gallery/views/admin_block_welcome.html.php
+++ b/modules/gallery/views/admin_block_welcome.html.php
@@ -5,16 +5,16 @@
 <ul>
   <li>
     <?= t("General Settings - choose your <a href=\"%graphics_url\">graphics</a> and <a href=\"%language_url\">language</a> settings.",
-        array("graphics_url" => url::site("admin/graphics"),
-              "language_url" => url::site("admin/languages"))) ?>
+          array("graphics_url" => SafeString::of_safe_html(url::site("admin/graphics")),
+                "language_url" => SafeString::of_safe_html(url::site("admin/languages")))) ?>
   </li>
   <li>
     <?= t("Appearance - <a href=\"%theme_url\">choose a theme</a>, or <a href=\"%theme_options_url\">customize the way it looks</a>.",
-        array("theme_url" => url::site("admin/themes"),
-              "theme_options_url" => url::site("admin/theme_options"))) ?>
+          array("theme_url" => SafeString::of_safe_html(url::site("admin/themes")),
+                "theme_options_url" => SafeString::of_safe_html(url::site("admin/theme_options")))) ?>
   </li>
   <li>
     <?= t("Customize - <a href=\"%modules_url\">install modules</a> to add cool features!",
-          array("modules_url" => url::site("admin/modules"))) ?>
+          array("modules_url" => SafeString::of_safe_html(url::site("admin/modules")))) ?>
   </li>
 </ul>
diff --git a/modules/gallery/views/upgrader.html.php b/modules/gallery/views/upgrader.html.php
index 37578855..ccc86da8 100644
--- a/modules/gallery/views/upgrader.html.php
+++ b/modules/gallery/views/upgrader.html.php
@@ -18,7 +18,7 @@
             <h1> <?= t("That's it!") ?> </h1>
             <p>
               <?= t("Your <a href=\"%url\">Gallery</a> is up to date.",
-                    array("url" => url::site("albums/1"))) ?>
+                    array("url" => SafeString::of_safe_html(url::site("albums/1")))) ?>
             </p>
           </div>
         </div>