public function testSanitize()
 {
     $given = array("field1" => "<p>A <strong>string</strong> with an <script></script>escaped apostrophe: it\\'s</p>", "field2" => array("it\\'s cool", "yeah it\\'s cool"));
     $expected = array("field1" => "<p>A <strong>string</strong> with an escaped apostrophe: it's</p>", "field2" => array("it's cool", "yeah it's cool"));
     $sanitizer = new Sanitizer($given);
     $sanitizer->stripslashes()->striptags(array("<p>", "<strong>"));
     $this->assertEquals($expected, $sanitizer->data);
 }

    function __construct($job_id = false)
    {
        global $db;
        if (is_numeric($job_id)) {
            $sanitizer = new Sanitizer();
            $sql = 'SELECT a.type_id AS type_id, a.category_id AS category_id, a.title AS title, a.summary AS summary, 
			               a.description AS description, a.company AS company, a.url AS url, a.apply AS apply, 
			               DATE_FORMAT(a.created_on, "' . DATE_FORMAT . '") AS created_on, a.created_on AS mysql_date,
			               a.is_temp AS is_temp, a.is_active AS is_active, a.spotlight AS spotlight,
			               a.views_count AS views_count, a.auth AS auth, a.city_id AS city_id, a.outside_location AS outside_location,
			               a.poster_email AS poster_email, a.apply_online AS apply_online, b.name AS category_name,
			               c.var_name as type_var_name, c.name as type_name,
			               DATE_ADD(created_on, INTERVAL 30 DAY) AS closed_on, DATEDIFF(NOW(), created_on) AS days_old, cit.name AS city_name
			               FROM ' . DB_PREFIX . 'jobs a LEFT JOIN ' . DB_PREFIX . 'cities cit on a.city_id = cit.id, ' . DB_PREFIX . 'categories b, ' . DB_PREFIX . 'types c
			               WHERE a.category_id = b.id AND c.id = a.type_id AND a.id = ' . $job_id;
            $result = $db->query($sql);
            $row = $result->fetch_assoc();
            if (!empty($row)) {
                $this->mId = $job_id;
                $this->mTypeId = $row['type_id'];
                $this->mCategoryId = $row['category_id'];
                $this->mCategoryName = $row['category_name'];
                $this->mTitle = str_replace('&', '&', $row['title']);
                $this->mSummary = str_replace('&', '&', $row['summary']);
                $this->mDescription = $row['description'];
                $this->mCompany = $row['company'];
                $this->mUrl = $row['url'];
                $this->mApply = $row['apply'];
                $this->mCreatedOn = $row['created_on'];
                $this->mClosedOn = $row['closed_on'];
                $this->mIsTemp = $row['is_temp'];
                $this->mIsActive = $row['is_active'];
                $this->mViewsCount = $row['views_count'];
                $this->mAuth = $row['auth'];
                $this->mCityId = $row['city_id'];
                $this->mMySqlDate = $row['mysql_date'];
                $this->mLocation = $this->GetLocation($row);
                $this->mLocationOutsideRo = $row['outside_location'];
                $this->mPosterEmail = $row['poster_email'];
                $this->mUrlTitle = $sanitizer->sanitize_title_with_dashes($this->mTitle . ' at ' . $this->mCompany);
                $this->mApplyOnline = $row['apply_online'];
                $this->mDaysOld = $row['days_old'];
                $this->mIsSpotlight = $row['spotlight'];
                $this->mTypeName = $row['type_name'];
                $this->mTypeVarName = $row['type_var_name'];
            }
        }
    }

 public function getDiv($value)
 {
     global $wgOut, $wgPromoterAdPreview;
     if (array_key_exists('language', $this->mParams)) {
         $language = $this->mParams['language'];
     } else {
         $language = $wgOut->getContext()->getLanguage()->getCode();
     }
     $html = Xml::openElement('div', array('id' => Sanitizer::escapeId("pr-ad-list-element-{$this->mParams['ad']}"), 'class' => "pr-ad-list-element"));
     // Make the label; this consists of a text link to the ad editor, and a series of status icons
     if (array_key_exists('withlabel', $this->mParams)) {
         $adName = $this->mParams['ad'];
         $html .= Xml::openElement('div', array('class' => 'pr-ad-list-element-label'));
         $html .= Linker::link(SpecialPage::getTitleFor('PromoterAds', "edit/{$adName}"), htmlspecialchars($adName), array('class' => 'pr-ad-list-element-label-text'));
         $html .= ' (' . Linker::link(SpecialPage::getTitleFor('Randompage'), $this->msg('promoter-live-preview'), array('class' => 'pr-ad-list-element-label-text'), array('ad' => $adName, 'uselang' => $language, 'force' => '1')) . ')';
         // TODO: Output status icons
         $html .= Xml::tags('div', array('class' => 'pr-ad-list-element-label-icons'), '');
         $html .= Xml::closeElement('div');
     }
     // Add the ad preview
     if ($wgPromoterAdPreview) {
         $html .= $this->getInputHTML(null);
     }
     $html .= Xml::closeElement('div');
     return $html;
 }

 function execute()
 {
     global $wgLang, $wgRequest;
     global $wgOut, $wgExtensionsPath;
     global $wgUser, $wgCaptchaClass, $wgJsMimeType;
     $wgOut->addStyle(AssetsManager::getInstance()->getSassCommonURL('extensions/wikia/SpecialContact/SpecialContact.scss'));
     $this->mName = null;
     $this->mRealName = null;
     $this->mWhichWiki = null;
     $this->mProblem = $wgRequest->getText('wpContactSubject');
     //subject
     $this->mProblemDesc = null;
     $this->mPosted = $wgRequest->wasPosted();
     $this->mAction = $wgRequest->getVal('action');
     $this->mEmail = $wgRequest->getText('wpEmail');
     $this->mBrowser = $wgRequest->getText('wpBrowser');
     $this->mAbTestInfo = $wgRequest->getText('wpAbTesting');
     $this->mCCme = $wgRequest->getCheck('wgCC');
     if ($this->mPosted && 'submit' == $this->mAction) {
         if (!$wgUser->isLoggedIn() && class_exists($wgCaptchaClass)) {
             $captchaObj = new $wgCaptchaClass();
             $captchaObj->retrieveCaptcha();
             $info = $captchaObj->retrieveCaptcha();
         }
         #ubrfzy note: these were moved inside to (lazy) prevent some stupid bots
         $this->mName = $wgRequest->getText('wpName');
         $this->mRealName = $wgRequest->getText('wpContactRealName');
         $this->mWhichWiki = $wgRequest->getText('wpContactWikiName');
         #sibject still handled outside of post check, because of existing hardcoded prefill links
         $this->mProblemDesc = $wgRequest->getText('wpContactDesc');
         //body
         #malformed email?
         if (!Sanitizer::validateEmail($this->mEmail)) {
             $this->err[] .= wfMsg('invalidemailaddress');
             $this->errInputs['wpEmail'] = true;
         }
         #empty message text?
         if (empty($this->mProblemDesc)) {
             $this->err[] .= wfMsg('specialcontact-nomessage');
             $this->errInputs['wpContactDesc'] = true;
         }
         #captcha
         if (!$wgUser->isLoggedIn() && class_exists($wgCaptchaClass)) {
             // logged in users don't need the captcha (RT#139647)
             if (!(!empty($info) && $captchaObj->keyMatch($wgRequest->getVal('wpCaptchaWord'), $info))) {
                 $this->err[] .= wfMsg('specialcontact-captchafail');
                 $this->errInputs['wpCaptchaWord'] = true;
             }
         }
         #no errors?
         if (empty($this->err)) {
             #send email
             $this->processCreation();
             #stop here
             return;
         }
         #if there were any ->err s, they will be displayed in ContactForm
     }
     $this->mainContactForm();
 }

function efGPManagerCustomToolboxAppend(&$skin)
{
    global $wgOut, $wgUser;
    $tb = explode("\n", wfMsg('toolbox_append'));
    $new = array();
    foreach ($tb as &$nt) {
        if (strpos($nt, '*') === 0) {
            $nt = trim($nt, '*');
            $parts = explode('|', $nt);
            foreach ($parts as &$part) {
                $part = trim($part);
            }
            $href = wfMsgForContent($parts[0]);
            $text = wfMsgForContent($parts[1]);
            $perm = array_key_exists(2, $parts) ? $parts[2] : 'read';
            if (!$wgUser->isAllowed($perm)) {
                continue;
            }
            if (wfEmptyMsg($parts[0], $href)) {
                $href = $parts[0];
            }
            if (wfEmptyMsg($parts[1], $text)) {
                $text = $parts[1];
            }
            $id = Sanitizer::escapeId($parts[1], 'noninitial');
            $new[] = array($href, $text, $id);
        }
    }
    foreach ($new as $t) {
        echo '<li id="t-' . $t[2] . '"><a href="' . htmlspecialchars($t[0]) . '">' . $t[1] . '</a></li>';
    }
    return true;
}

 /**
  * Builds the HTML code for this component
  *
  * @return String the HTML code
  */
 public function getHtml()
 {
     $element = $this->getDomElement();
     if ($element === null) {
         return '';
     }
     $msgKey = $element->getAttribute('message');
     $menuFactory = new MenuFactory();
     if (empty($msgKey)) {
         $text = $element->textContent;
         $menu = $menuFactory->getMenuFromMessageText($text);
     } else {
         $menu = $menuFactory->getMenuFromMessage($msgKey);
     }
     $menu->setMenuItemFormatter(function ($href, $text, $depth, $subitems) {
         $href = \Sanitizer::cleanUrl($href);
         $text = htmlspecialchars($text);
         if ($depth === 1 && !empty($subitems)) {
             return "<li class=\"dropdown\"><a class=\"dropdown-toggle\" href=\"#\"  data-toggle=\"dropdown\">{$text}<b class=\"caret\"></b></a>{$subitems}</li>";
         } else {
             return "<li><a href=\"{$href}\">{$text}</a>{$subitems}</li>";
         }
     });
     $menu->setItemListFormatter(function ($rawItemsHtml, $depth) {
         if ($depth === 0) {
             return $rawItemsHtml;
         } elseif ($depth === 1) {
             return "<ul class=\"dropdown-menu\">{$rawItemsHtml}</ul>";
         } else {
             return "<ul>{$rawItemsHtml}</ul>";
         }
     });
     return $menu->getHtml();
 }

 /**
  * Main execution point
  *
  * @param null|string $code Confirmation code passed to the page
  * @throws PermissionsError
  * @throws ReadOnlyError
  * @throws UserNotLoggedIn
  */
 function execute($code)
 {
     // Ignore things like master queries/connections on GET requests.
     // It's very convenient to just allow formless link usage.
     $trxProfiler = Profiler::instance()->getTransactionProfiler();
     $this->setHeaders();
     $this->checkReadOnly();
     $this->checkPermissions();
     // This could also let someone check the current email address, so
     // require both permissions.
     if (!$this->getUser()->isAllowed('viewmyprivateinfo')) {
         throw new PermissionsError('viewmyprivateinfo');
     }
     if ($code === null || $code === '') {
         $this->requireLogin('confirmemail_needlogin');
         if (Sanitizer::validateEmail($this->getUser()->getEmail())) {
             $this->showRequestForm();
         } else {
             $this->getOutput()->addWikiMsg('confirmemail_noemail');
         }
     } else {
         $old = $trxProfiler->setSilenced(true);
         $this->attemptConfirm($code);
         $trxProfiler->setSilenced($old);
     }
 }

 /**
  * Strip markup to show plaintext
  * @param string $text
  * @return string
  * @access private
  */
 function _stripMarkup($text)
 {
     global $wgContLang;
     $text = substr($text, 0, 4096);
     // don't bother with long text...
     $text = str_replace("'''", "", $text);
     $text = str_replace("''", "", $text);
     $text = preg_replace('#__[a-z0-9_]+__#i', '', $text);
     // magic words
     $cleanChar = "[^|\\[\\]]";
     $subLink = "\\[\\[{$cleanChar}*(?:\\|{$cleanChar}*)*\\]\\]";
     $pipeContents = "(?:{$cleanChar}|{$subLink})*";
     $text = preg_replace_callback("#\n\t\t\t\\[\\[\n\t\t\t\t({$cleanChar}*)\n\t\t\t\t(?:\\|({$pipeContents}))?\n\t\t\t\t(?:\\|{$pipeContents})*\n\t\t\t\\]\\]\n\t\t\t#six", array($this, '_stripLink'), $text);
     $protocols = wfUrlProtocols();
     $text = preg_replace('#\\[(?:$protocols).*? (.*?)\\]#s', '$1', $text);
     // URL links
     $text = preg_replace('#</?[a-z0-9]+.*?>#s', '', $text);
     // HTML-style tags
     $text = preg_replace('#\\{\\|.*?\\|\\}#s', '', $text);
     // tables
     $text = preg_replace('#^:.*$#m', '', $text);
     // indented lines near start are usually disambigs or notices
     $text = Sanitizer::decodeCharReferences($text);
     return trim($text);
 }

 /**
  * Creates HTML for the given tags
  *
  * @param string $tags Comma-separated list of tags
  * @param string $page A label for the type of action which is being displayed,
  *   for example: 'history', 'contributions' or 'newpages'
  * @return array Array with two items: (html, classes)
  *   - html: String: HTML for displaying the tags (empty string when param $tags is empty)
  *   - classes: Array of strings: CSS classes used in the generated html, one class for each tag
  */
 public static function formatSummaryRow($tags, $page)
 {
     global $wgLang;
     if (!$tags) {
         return array('', array());
     }
     $classes = array();
     $tags = explode(',', $tags);
     $displayTags = array();
     foreach ($tags as $tag) {
         if (!$tag) {
             continue;
         }
         $description = self::tagDescription($tag);
         if ($description === false) {
             continue;
         }
         $displayTags[] = Xml::tags('span', array('class' => 'mw-tag-marker ' . Sanitizer::escapeClass("mw-tag-marker-{$tag}")), $description);
         $classes[] = Sanitizer::escapeClass("mw-tag-{$tag}");
     }
     if (!$displayTags) {
         return array('', array());
     }
     $markers = wfMessage('tag-list-wrapper')->numParams(count($displayTags))->rawParams($wgLang->commaList($displayTags))->parse();
     $markers = Xml::tags('span', array('class' => 'mw-tag-markers'), $markers);
     return array($markers, $classes);
 }

 protected function parseWikitext($title, $newRevId)
 {
     $apiParams = array('action' => 'parse', 'page' => $title->getPrefixedDBkey(), 'oldid' => $newRevId, 'prop' => 'text|revid|categorieshtml|displaytitle|modules|jsconfigvars');
     $api = new ApiMain(new DerivativeRequest($this->getRequest(), $apiParams, false), true);
     $api->execute();
     if (defined('ApiResult::META_CONTENT')) {
         $result = $api->getResult()->getResultData(null, array('BC' => array(), 'Types' => array(), 'Strip' => 'all'));
     } else {
         $result = $api->getResultData();
     }
     $content = isset($result['parse']['text']['*']) ? $result['parse']['text']['*'] : false;
     $categorieshtml = isset($result['parse']['categorieshtml']['*']) ? $result['parse']['categorieshtml']['*'] : false;
     $links = isset($result['parse']['links']) ? $result['parse']['links'] : array();
     $revision = Revision::newFromId($result['parse']['revid']);
     $timestamp = $revision ? $revision->getTimestamp() : wfTimestampNow();
     $displaytitle = isset($result['parse']['displaytitle']) ? $result['parse']['displaytitle'] : false;
     $modules = isset($result['parse']['modules']) ? $result['parse']['modules'] : array();
     $jsconfigvars = isset($result['parse']['jsconfigvars']) ? $result['parse']['jsconfigvars'] : array();
     if ($content === false || strlen($content) && $revision === null) {
         return false;
     }
     if ($displaytitle !== false) {
         // Escape entities as in OutputPage::setPageTitle()
         $displaytitle = Sanitizer::normalizeCharReferences(Sanitizer::removeHTMLtags($displaytitle));
     }
     return array('content' => $content, 'categorieshtml' => $categorieshtml, 'basetimestamp' => $timestamp, 'starttimestamp' => wfTimestampNow(), 'displayTitleHtml' => $displaytitle, 'modules' => $modules, 'jsconfigvars' => $jsconfigvars);
 }

function wfCSSRender(&$parser, $css)
{
    global $wgOut, $wgRequest;
    $parser->mOutput->mCacheTime = -1;
    $url = false;
    if (preg_match('|\\{|', $css)) {
        # Inline CSS
        $css = htmlspecialchars(trim(Sanitizer::checkCss($css)));
        $parser->mOutput->addHeadItem(<<<EOT
<style type="text/css">
/*<![CDATA[*/
{$css}
/*]]>*/
</style>
EOT
);
    } elseif ($css[0] == '/') {
        # File
        $url = $css;
    } else {
        # Article?
        $title = Title::newFromText($css);
        if (is_object($title)) {
            $url = $title->getLocalURL('action=raw&ctype=text/css');
            $url = str_replace("&", "&amp;", $url);
        }
    }
    if ($url) {
        $wgOut->addScript("<link rel=\"stylesheet\" type=\"text/css\" href=\"{$url}\" />");
    }
    return '';
}

function PoemExtension($in, $param = array(), $parser = null)
{
    /* using newlines in the text will cause the parser to add <p> tags,
     * which may not be desired in some cases
     */
    $nl = isset($param['compact']) ? '' : "\n";
    if (method_exists($parser, 'recursiveTagParse')) {
        //new methods in 1.8 allow nesting <nowiki> in <poem>.
        $tag = $parser->insertStripItem("<br />", $parser->mStripState);
        $text = preg_replace(array("/^\n/", "/\n\$/D", "/\n/", "/^( +)/me"), array("", "", "{$tag}\n", "str_replace(' ','&nbsp;','\\1')"), $in);
        $text = $parser->recursiveTagParse($text);
    } else {
        $text = preg_replace(array("/^\n/", "/\n\$/D", "/\n/", "/^( +)/me"), array("", "", "<br />\n", "str_replace(' ','&nbsp;','\\1')"), $in);
        $ret = $parser->parse($text, $parser->getTitle(), $parser->getOptions(), true, false);
        $text = $ret->getText();
    }
    global $wgVersion;
    if (version_compare($wgVersion, "1.7alpha") >= 0) {
        // Pass HTML attributes through to the output.
        $attribs = Sanitizer::validateTagAttributes($param, 'div');
    } else {
        // Can't guarantee safety on 1.6 or older.
        $attribs = array();
    }
    // Wrap output in a <div> with "poem" class.
    if (isset($attribs['class'])) {
        $attribs['class'] = 'poem ' . $attribs['class'];
    } else {
        $attribs['class'] = 'poem';
    }
    return Xml::openElement('div', $attribs) . $nl . trim($text) . "{$nl}</div>";
}

 /**
  * Creates HTML for the given tags
  *
  * @param string $tags Comma-separated list of tags
  * @param string $page A label for the type of action which is being displayed,
  *   for example: 'history', 'contributions' or 'newpages'
  * @param IContextSource|null $context
  * @note Even though it takes null as a valid argument, an IContextSource is preferred
  *       in a new code, as the null value is subject to change in the future
  * @return array Array with two items: (html, classes)
  *   - html: String: HTML for displaying the tags (empty string when param $tags is empty)
  *   - classes: Array of strings: CSS classes used in the generated html, one class for each tag
  */
 public static function formatSummaryRow($tags, $page, IContextSource $context = null)
 {
     if (!$tags) {
         return array('', array());
     }
     if (!$context) {
         $context = RequestContext::getMain();
     }
     $classes = array();
     $tags = explode(',', $tags);
     $displayTags = array();
     foreach ($tags as $tag) {
         if (!$tag) {
             continue;
         }
         $description = self::tagDescription($tag);
         if ($description === false) {
             continue;
         }
         $displayTags[] = Xml::tags('span', array('class' => 'mw-tag-marker ' . Sanitizer::escapeClass("mw-tag-marker-{$tag}")), $description);
         $classes[] = Sanitizer::escapeClass("mw-tag-{$tag}");
     }
     if (!$displayTags) {
         return array('', array());
     }
     $markers = $context->msg('tag-list-wrapper')->numParams(count($displayTags))->rawParams($context->getLanguage()->commaList($displayTags))->parse();
     $markers = Xml::tags('span', array('class' => 'mw-tag-markers'), $markers);
     return array($markers, $classes);
 }

 public static function receiverIsValid($receiver)
 {
     // Returns true if the parameter is a valid e-mail address, false if not
     $receiverIsValid = true;
     // There may be multiple e-mail addresses, divided by commas - which is valid
     // for us, but not for the validation functions we use below. So get the single
     // address into an array first, validate them one by one, and only if all are ok,
     // return true.
     $receiverArray = explode(',', str_replace(', ', ',', $receiver));
     // To make sure some joker doesn't copy in a large number of e-mail addresses
     // and spams them all, lets set a (admittedly arbitrary) limit of 10.
     if (count($receiverArray) > 10) {
         return false;
     }
     if (method_exists('Sanitizer', 'validateEmail')) {
         // User::isValidEmailAddr() has been moved to Sanitizer::validateEmail as of
         // MediaWiki version 1.18 (I think).
         foreach ($receiverArray as $singleEmailAddress) {
             if (!Sanitizer::validateEmail($singleEmailAddress)) {
                 $receiverIsValid = false;
             }
         }
     } else {
         foreach ($receiverArray as $singleEmailAddress) {
             if (!User::isValidEmailAddr($singleEmailAddress)) {
                 $receiverIsValid = false;
             }
         }
     }
     return $receiverIsValid;
 }

 /**
  * Show the special page
  * @param string|null $par
  */
 public function execute($par)
 {
     $this->setHeaders();
     $this->outputHeader();
     $out = $this->getOutput();
     $out->addModuleStyles('mediawiki.special');
     $out->addHTML(\Html::openElement('table', array('class' => 'wikitable mw-listgrouprights-table')) . '<tr>' . \Html::element('th', null, $this->msg('listgrants-grant')->text()) . \Html::element('th', null, $this->msg('listgrants-rights')->text()) . '</tr>');
     foreach ($this->getConfig()->get('GrantPermissions') as $grant => $rights) {
         $descs = array();
         $rights = array_filter($rights);
         // remove ones with 'false'
         foreach ($rights as $permission => $granted) {
             $descs[] = $this->msg('listgrouprights-right-display', \User::getRightDescription($permission), '<span class="mw-listgrants-right-name">' . $permission . '</span>')->parse();
         }
         if (!count($descs)) {
             $grantCellHtml = '';
         } else {
             sort($descs);
             $grantCellHtml = '<ul><li>' . implode("</li>\n<li>", $descs) . '</li></ul>';
         }
         $id = \Sanitizer::escapeId($grant);
         $out->addHTML(\Html::rawElement('tr', array('id' => $id), "<td>" . $this->msg("grant-{$grant}")->escaped() . "</td>" . "<td>" . $grantCellHtml . '</td>'));
     }
     $out->addHTML(\Html::closeElement('table'));
 }

 /**
  * Format a line using the old system (aka without any javascript).
  *
  * @param RecentChange $rc Passed by reference
  * @param bool $watched (default false)
  * @param int $linenumber (default null)
  *
  * @return string|bool
  */
 public function recentChangesLine(&$rc, $watched = false, $linenumber = null)
 {
     $classes = array();
     // use mw-line-even/mw-line-odd class only if linenumber is given (feature from bug 14468)
     if ($linenumber) {
         if ($linenumber & 1) {
             $classes[] = 'mw-line-odd';
         } else {
             $classes[] = 'mw-line-even';
         }
     }
     // Indicate watched status on the line to allow for more
     // comprehensive styling.
     $classes[] = $watched && $rc->mAttribs['rc_timestamp'] >= $watched ? 'mw-changeslist-line-watched' : 'mw-changeslist-line-not-watched';
     $html = $this->formatChangeLine($rc, $classes, $watched);
     if ($this->watchlist) {
         $classes[] = Sanitizer::escapeClass('watchlist-' . $rc->mAttribs['rc_namespace'] . '-' . $rc->mAttribs['rc_title']);
     }
     if (!Hooks::run('OldChangesListRecentChangesLine', array(&$this, &$html, $rc, &$classes))) {
         return false;
     }
     $dateheader = '';
     // $html now contains only <li>...</li>, for hooks' convenience.
     $this->insertDateHeader($dateheader, $rc->mAttribs['rc_timestamp']);
     return "{$dateheader}<li class=\"" . implode(' ', $classes) . "\">" . $html . "</li>\n";
 }

 function testDecodeTagAttributes()
 {
     $this->assertEquals(Sanitizer::decodeTagAttributes('foo=bar'), array('foo' => 'bar'), 'Unquoted attribute');
     $this->assertEquals(Sanitizer::decodeTagAttributes('    foo   =   bar    '), array('foo' => 'bar'), 'Spaced attribute');
     $this->assertEquals(Sanitizer::decodeTagAttributes('foo="bar"'), array('foo' => 'bar'), 'Double-quoted attribute');
     $this->assertEquals(Sanitizer::decodeTagAttributes('foo=\'bar\''), array('foo' => 'bar'), 'Single-quoted attribute');
     $this->assertEquals(Sanitizer::decodeTagAttributes('foo=\'bar\'   baz="foo"'), array('foo' => 'bar', 'baz' => 'foo'), 'Several attributes');
     $this->assertEquals(Sanitizer::decodeTagAttributes('foo=\'bar\'   baz="foo"'), array('foo' => 'bar', 'baz' => 'foo'), 'Several attributes');
     $this->assertEquals(Sanitizer::decodeTagAttributes('foo=\'bar\'   baz="foo"'), array('foo' => 'bar', 'baz' => 'foo'), 'Several attributes');
     $this->assertEquals(Sanitizer::decodeTagAttributes(':foo=\'bar\''), array(':foo' => 'bar'), 'Leading :');
     $this->assertEquals(Sanitizer::decodeTagAttributes('_foo=\'bar\''), array('_foo' => 'bar'), 'Leading _');
     $this->assertEquals(Sanitizer::decodeTagAttributes('Foo=\'bar\''), array('foo' => 'bar'), 'Leading capital');
     $this->assertEquals(Sanitizer::decodeTagAttributes('FOO=BAR'), array('foo' => 'BAR'), 'Attribute keys are normalized to lowercase');
     # Invalid beginning
     $this->assertEquals(Sanitizer::decodeTagAttributes('-foo=bar'), array(), 'Leading - is forbidden');
     $this->assertEquals(Sanitizer::decodeTagAttributes('.foo=bar'), array(), 'Leading . is forbidden');
     $this->assertEquals(Sanitizer::decodeTagAttributes('foo-bar=bar'), array('foo-bar' => 'bar'), 'A - is allowed inside the attribute');
     $this->assertEquals(Sanitizer::decodeTagAttributes('foo-=bar'), array('foo-' => 'bar'), 'A - is allowed inside the attribute');
     $this->assertEquals(Sanitizer::decodeTagAttributes('foo.bar=baz'), array('foo.bar' => 'baz'), 'A . is allowed inside the attribute');
     $this->assertEquals(Sanitizer::decodeTagAttributes('foo.=baz'), array('foo.' => 'baz'), 'A . is allowed as last character');
     $this->assertEquals(Sanitizer::decodeTagAttributes('foo6=baz'), array('foo6' => 'baz'), 'Numbers are allowed');
     # This bit is more relaxed than XML rules, but some extensions use it, like ProofreadPage (see bug 27539)
     $this->assertEquals(Sanitizer::decodeTagAttributes('1foo=baz'), array('1foo' => 'baz'), 'Leading numbers are allowed');
     $this->assertEquals(Sanitizer::decodeTagAttributes('foo$=baz'), array(), 'Symbols are not allowed');
     $this->assertEquals(Sanitizer::decodeTagAttributes('foo@=baz'), array(), 'Symbols are not allowed');
     $this->assertEquals(Sanitizer::decodeTagAttributes('foo~=baz'), array(), 'Symbols are not allowed');
     $this->assertEquals(Sanitizer::decodeTagAttributes('foo=1[#^`*%w/('), array('foo' => '1[#^`*%w/('), 'All kind of characters are allowed as values');
     $this->assertEquals(Sanitizer::decodeTagAttributes('foo="1[#^`*%\'w/("'), array('foo' => '1[#^`*%\'w/('), 'Double quotes are allowed if quoted by single quotes');
     $this->assertEquals(Sanitizer::decodeTagAttributes('foo=\'1[#^`*%"w/(\''), array('foo' => '1[#^`*%"w/('), 'Single quotes are allowed if quoted by double quotes');
     $this->assertEquals(Sanitizer::decodeTagAttributes('foo=&"'), array('foo' => '&"'), 'Special chars can be provided as entities');
     $this->assertEquals(Sanitizer::decodeTagAttributes('foo=&foobar;'), array('foo' => '&foobar;'), 'Entity-like items are accepted');
 }

	/**
	 * Main execution point
	 *
	 * @param null|string $code Confirmation code passed to the page
	 */
	function execute( $code ) {
		$this->setHeaders();

		$this->checkReadOnly();
		$this->checkPermissions();

		// This could also let someone check the current email address, so
		// require both permissions.
		if ( !$this->getUser()->isAllowed( 'viewmyprivateinfo' ) ) {
			throw new PermissionsError( 'viewmyprivateinfo' );
		}

		if ( $code === null || $code === '' ) {
			if ( $this->getUser()->isLoggedIn() ) {
				if ( Sanitizer::validateEmail( $this->getUser()->getEmail() ) ) {
					$this->showRequestForm();
				} else {
					$this->getOutput()->addWikiMsg( 'confirmemail_noemail' );
				}
			} else {
				$llink = Linker::linkKnown(
					SpecialPage::getTitleFor( 'Userlogin' ),
					$this->msg( 'loginreqlink' )->escaped(),
					array(),
					array( 'returnto' => $this->getTitle()->getPrefixedText() )
				);
				$this->getOutput()->addHTML(
					$this->msg( 'confirmemail_needlogin' )->rawParams( $llink )->parse()
				);
			}
		} else {
			$this->attemptConfirm( $code );
		}
	}

 public function execute()
 {
     $this->commit = $this->hasOption('commit');
     $dbr = $this->getDB(DB_SLAVE);
     $dbw = $this->getDB(DB_MASTER);
     $lastId = 0;
     do {
         $rows = $dbr->select('user', array('user_id', 'user_email'), array('user_id > ' . $dbr->addQuotes($lastId), 'user_email != ""', 'user_email_authenticated IS NULL'), __METHOD__, array('LIMIT' => $this->mBatchSize));
         $count = $rows->numRows();
         $badIds = array();
         foreach ($rows as $row) {
             if (!Sanitizer::validateEmail(trim($row->user_email))) {
                 $this->output("Found bad email: {$row->user_email} for user #{$row->user_id}\n");
                 $badIds[] = $row->user_id;
             }
             if ($row->user_id > $lastId) {
                 $lastId = $row->user_id;
             }
         }
         if ($badIds) {
             $badCount = count($badIds);
             if ($this->commit) {
                 $this->output("Removing {$badCount} emails from the database.\n");
                 $dbw->update('user', array('user_email' => ''), array('user_id' => $badIds), __METHOD__);
                 foreach ($badIds as $badId) {
                     User::newFromId($badId)->invalidateCache();
                 }
                 wfWaitForSlaves();
             } else {
                 $this->output("Would have removed {$badCount} emails from the database.\n");
             }
         }
     } while ($count !== 0);
     $this->output("Done.\n");
 }

 protected function checkContactLink($name, $url, &$countOk)
 {
     global $wgVersion;
     $ok = false;
     if (Sanitizer::validateEmail($url)) {
         $ok = true;
         // assume OK
     } else {
         $bits = wfParseUrl($url);
         if ($bits && isset($bits['scheme'])) {
             if ($bits['scheme'] == 'mailto') {
                 $ok = true;
                 // assume OK
             } elseif (in_array($bits['scheme'], array('http', 'https'))) {
                 $req = MWHttpRequest::factory($url, array('method' => 'GET', 'timeout' => 8, 'sslVerifyHost' => false, 'sslVerifyCert' => false));
                 $req->setUserAgent("MediaWiki {$wgVersion}, CheckCongressLinks Checker");
                 $ok = $req->execute()->isOK();
             }
         }
     }
     if ($ok) {
         ++$countOk;
     } else {
         $this->output("Broken: [{$name}] [{$url}]\n");
     }
 }