(And the tests should illustrate that kohana 2.4's API doesn't quite fit our purpose of simply getting the best match between the accepted (client) and the installed (g3) locales.)
No longer run a safe HTML string through the HTML purifier (since it's already marked as safe).
This also addresses the issue of calling purify() when no purifier is installed. In that case, we'd run clean() on a clean string (double HTML encoding).
If this approach doesn't work out, we can still modify the fallback code of purify() to check if the string is already clean before calling clean() instead of purify().
Benefits:
- url::site() is often used in views and we can ensure in the url class that returned strings are indeed safe for use in HTML. Makes the list of vars of unknown safety status shorter.
- url::site() is often used as message parameter to t() and t2(). The parameter would be HTML-escaped if it wasn't marked as safe HTML already. Makes the usage simpler / shorter.
Refactoring of Xss_Security_Test.
t() and t2() return a SafeString instance.
TODO:
- Update all code to use SafeString where appropriate.
- Update golden fole of Xss_Security_Test
- Stop reporting CLEAN vars in Xss_Security_Test
remove Gallery3 concepts from ORM_MPTT.
The following API methods:
ORM_MPTT::children
ORM_MPTT::children_count
ORM_MPTT::descendants
ORM_MPTT::descendants_count
All now take a $where clause that allow you to pass through additional
field parameters.
old API:
$album->children(10, 0, "photos")
$album->children_count("photos")
new API:
$album->children(10, 0, array("type" => "photos"))
$album->children_count(array("type" => "photos"))
This gives us a more flexible API and simplifies the code. While I
was in there, I changed the way we deal with default orderby values so
that we just assign the default value in the function definition,
which allows us to get rid of all conditionals in the implementation
which results in simpler code.
Old API: $obj->original("field_name")
New API: $obj->original()->field_name
This allows us to revert the varous xxx_updated events back to passing
an original ORM as well as the the updated one. This makes for a
cleaner event API.
Old API: comment_updated($comment) { $comment->original("field_name") }
Old API: comment_updated($old, $new) { $old->field_name }
Bharat Mediratta
Andy Staudacher
Tim Almdal