On Tue, Aug 16, 2011 at 9:57 AM, Mike Cody <[email protected]> wrote:

> Hello,
>
> I am having an issue getting more than one Tag Extension working on the
> same page. I have included the code that i am using for the two pages that
> make up the extension. Has anyone had any luck getting
> more than one tag extension working on the same page? If so what steps did
> you use to make it work? Any help would be appreciated!
>

It may help to add some more detail:

First, what do you mean by 'getting more than one Tag Extension working on
the same page'? Your sample code only defines one tag extension (<servers>),
so I assume you mean you're trying to use it twice in one wiki page?

What does your page text look like? Tag hooks can't nest, so make sure
you're closing them:

<servers>...</servers>
or
<servers/>

If you were to just stack them like this:

<servers> ... <servers> ...

it probably won't act like you want.


Second, what do you mean by 'having an issue'? Do you get unexpected output?
A crash? What's the difference between what you wanted and what you got?


> # Set up the hook, using different logic depending
> # on the version of MediaWiki
> if (defined('MW_SUPPORTS_PARSERFIRSTCALLINIT')) {
>  $wgHooks['ParserFirstCallInit'][] = 'ServerTag::setup';
> } else {
>  $wgExtensionFunctions[] = 'ServerTag::setup';
> }
>
...

>   static function setup() {
>   global $wgParser;
>   $wgParser->setHook(self::NAME, array('ServerTag', 'render'));
>   return true;
>  }
>

A warning on this: when handling ParserFirstCallInit, you really ought to be
actually using the parser parameter that's given to you -- don't use the
global $wgParser, which may at times be actively wrong. (eg if we're setting
up a new Parser object to be used for some particular rendering purpose).

I would recommend dropping the compatibility support for
$wgExtensionFunctions unless you specifically require working with old
versions of MediaWiki.

Also, putting the setup function in your class means that the class gets
loaded *every* time a parser gets used, regardless of whether the tag hook
ever gets used at all. Not a big deal for a small extension here, but
something to keep in mind. A standalone setup function means no additional
code has to be loaded just to register the tag hook.

static function render() {
>   //required for DB connection
>   require "db_mysql.inc";
>   require "define_hosts.php";
>

You might check to ensure that those files load correctly, and that they
don't cause errors when loaded a second time. For instance if they define
functions, classes, or constants, you may encounter errors the second time
they're loaded.

               //Get end of URL remove _ from client name for DB query
>                $endURL = $_GET["title"];
>

You definitely don't want to do this -- your page may be parsed from a
command-line script, or in the background while processing something else.
You *cannot* assume that URL query parameters relevant to the current page
are present in a superglobal like $_GET!

If you want to get the title of the current page, you should retrieve it
from the $parser object that's passed to your tag's render function.


>                                        while ($em_g3->next_record()) {
>                                                $company =
> $em_g3->f("company");
>                                                $device =
> $em_g3->f("device");
>                                                $active =
> $em_g3->f("active");
>                                                $ip = $em_g3->f("ip");
>                                                $acnt = $acnt + 1;
>                                                        if ($company) {
>                                                                        if
> ($acnt){
>
>    $addr_list[$acnt] =
> "<tr><td>$company</td><td>$device</td><td>$active</td><td>$ip</td></tr>";
>
>    $string = $string.$addr_list[$acnt];
>                                                                        }
>                                                        }
>

You're failing to perform HTML escaping on output here; this leaves you open
to cross-site scripting and other types of HTML injection attacks, as well
as straightforward breakage or confusion if you just have a few "<"s or "&"s
in your data that ends up rendering confusingly.

-- brion
_______________________________________________
MediaWiki-l mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-l

Reply via email to