2009/5/5 Brad Jorsch b-jorsch@northwestern.edu:
On Tue, May 05, 2009 at 09:10:16AM -0700, Michael Dale wrote:
Could we add in an action get message to the api or add some functionality to meta=allmessages ?
Really need to be able to: A) send in parameterized replace values per msg key B) get the html rendered / parsed result (rather than the wikitext)
Security wise the parameterized replace values should be treated as wikitext and go through the wiki-text-parser before rendered back out to the browser.
I'm not sure how feasable that would actually be, as the messages are not all handled the same way. In fact, as far as I know there isn't even any generic way to tell how any particular message is handled besides "read the source". It all depends on how exactly the message is used in the code that actually makes use of it.
Among other possibilities, the message could be treated as plain text, as raw HTML, as fully-parsed wikitext (action=parse), or as preprocessed-only wikitext (similar to if not the same as action=expandtemplates); see the various wfMsg* functions. Substitution of the parameters could be done before or after the message itself is processed, and the individual parameters could themselves have been processed in any manner before being passed to wfMsgWhatever.
Good point. Because parameter substitution is trivial (e.g. with PHP's strtr() function) and all other functions (preprocess, parse) are available already, this doesn't need any additional functionality.
Roan Kattouw (Catrope)