Author: petrel.harp

Description:
The tooltip for the "undo" link on a "Compare selected revisions" page is put in in a way that results in malformed HTML (and is thus a problem if served as XHTML). The "title=" and surrounding quotes are omitted. For instance:

<a href='/mw/index.php?title=Stochastic_growth/Main_paper&amp;action=edit&amp;undoafter=2746&amp;undo=2760' "Undo" reverts this edit and opens the edit form in preview mode. It allows adding a reason in the summary.>

The problem seems to be in DifferenceEngine.php; below is a diff that fixes it (although perhaps the tooltip message should be run through something that e.g. escapes the quotes first?).

See also the similar (same origin?) bug #26302, traced to r75763 .

• includes/diff/DifferenceEngine.php (revision 78212)

+++ includes/diff/DifferenceEngine.php (working copy)
@@ -1017,7 +1017,7 @@

			$htmlLink = htmlspecialchars( wfMsg( 'editundo' ) );
			$htmlTitle = $wgUser->getSkin()->titleAttrib( 'undo' );
			if ( $editable && !$this->mOldRev->isDeleted( Revision::DELETED_TEXT ) && !$this->mNewRev->isDeleted( Revision::DELETED_TEXT ) ) {

• $this->mNewtitle .= " (<a href='$newUndo' $htmlTitle>" . $htmlLink . "</a>)";

+ $this->mNewtitle .= " (<a href='$newUndo' title='$htmlTitle'>" . $htmlLink . "</a>)";

			}

			if ( !$this->mOldRev->userCan( Revision::DELETED_TEXT ) ) {

Version: 1.18.x
Severity: normal