render_tag -> tag: phame, remarkup

Summary: Converts various callsites from render_tag variants to tag variants.

Test Plan: See inlines.

Reviewers: vrana, btrahan

Reviewed By: vrana

CC: aran

Maniphest Tasks: T2432

Differential Revision: https://secure.phabricator.com/D4689

src/applications/differential/field/specification/DifferentialBlameRevisionFieldSpecification.php

@@ -48,7 +48,7 @@ final class DifferentialBlameRevisionFieldSpecification
       return null;
     }
     $engine = PhabricatorMarkupEngine::newDifferentialMarkupEngine();
-    return $engine->markupText($this->value);
+    return phutil_safe_html($engine->markupText($this->value));
   }
 
   public function shouldAppearOnConduitView() {

src/applications/differential/field/specification/DifferentialUnitFieldSpecification.php

@@ -113,7 +113,7 @@ final class DifferentialUnitFieldSpecification
         $userdata = idx($test, 'userdata');
         if ($userdata) {
           $engine = PhabricatorMarkupEngine::newDifferentialMarkupEngine();
-          $userdata = $engine->markupText($userdata);
+          $userdata = phutil_safe_html($engine->markupText($userdata));
           $rows[] = array(
             'style' => 'details',
             'value' => $userdata,

src/applications/diffusion/controller/DiffusionBrowseController.php

@@ -106,7 +106,7 @@ final class DiffusionBrowseController extends DiffusionController {
 
   private function markupText($text) {
     $engine = PhabricatorMarkupEngine::newDiffusionMarkupEngine();
-    $text = $engine->markupText($text);
+    $text = phutil_safe_html($engine->markupText($text));
 
     $text = phutil_tag(
       'div',

src/applications/diffusion/controller/DiffusionCommitController.php

@@ -93,7 +93,8 @@ final class DiffusionCommitController extends DiffusionController {
 
       $property_list->addTextContent(
         '<div class="diffusion-commit-message phabricator-remarkup">'.
-        $engine->markupText($commit_data->getCommitMessage()).
+          phutil_safe_html(
+            $engine->markupText($commit_data->getCommitMessage())).
         '</div>'
       );
 

src/applications/diffusion/query/browse/DiffusionBrowseQuery.php

@@ -127,7 +127,7 @@ abstract class DiffusionBrowseQuery {
     } else {
       // Markup extensionless files as remarkup so we get links and such.
       $engine = PhabricatorMarkupEngine::newDiffusionMarkupEngine();
-      $readme_content = $engine->markupText($readme_content);
+      $readme_content = phutil_safe_html($engine->markupText($readme_content));
 
       $class = 'phabricator-remarkup';
     }

src/applications/people/controller/PhabricatorPeopleProfileController.php

@@ -165,7 +165,7 @@ final class PhabricatorPeopleProfileController
       '//Nothing is known about this rare specimen.//');
 
     $engine = PhabricatorMarkupEngine::newProfileMarkupEngine();
-    $blurb = $engine->markupText($blurb);
+    $blurb = phutil_safe_html($engine->markupText($blurb));
 
     $viewer = $this->getRequest()->getUser();
 

src/applications/phame/skins/PhameBasicBlogSkin.php

@@ -70,6 +70,7 @@ abstract class PhameBasicBlogSkin extends PhameBlogSkin {
       $view->setFrameable(true);
     }
 
+
     $view->appendChild($content);
 
     $response = new AphrontWebpageResponse();
@@ -95,23 +96,30 @@ abstract class PhameBasicBlogSkin extends PhameBlogSkin {
       $summaries[] = $post->renderWithSummary();
     }
 
-    $list = phutil_render_tag(
+    $list = phutil_tag(
       'div',
       array(
         'class' => 'phame-post-list',
       ),
       id(new AphrontNullView())->appendChild($summaries)->render());
 
-    $pager = $this->renderOlderPageLink().$this->renderNewerPageLink();
+    $pager = null;
-    if ($pager) {
+    if ($this->renderOlderPageLink() || $this->renderNewerPageLink()) {
       $pager = phutil_tag(
         'div',
         array(
           'class' => 'phame-pager',
+        ),
+        array(
+          $this->renderOlderPageLink(),
+          $this->renderNewerPageLink(),
         ));
     }
 
-    return $list.$pager;
+    return array(
+      $list,
+      $pager,
+    );
   }
 
   protected function render404Page() {

src/applications/phame/view/PhamePostView.php

@@ -87,7 +87,7 @@ final class PhamePostView extends AphrontView {
   }
 
   public function renderBody() {
-    return phutil_render_tag(
+    return phutil_tag(
       'div',
       array(
         'class' => 'phame-post-body',
@@ -96,7 +96,7 @@ final class PhamePostView extends AphrontView {
   }
 
   public function renderSummary() {
-    return phutil_render_tag(
+    return phutil_tag(
       'div',
       array(
         'class' => 'phame-post-body',
@@ -159,11 +159,11 @@ final class PhamePostView extends AphrontView {
       array(
         'id' => 'fb-root',
       ),
-      ''
+      '');
-    );
 
     $c_uri = '//connect.facebook.net/en_US/all.js#xfbml=1&appId='.$fb_id;
-    $fb_js = jsprintf(
+    $fb_js = phutil_safe_html(
+      jsprintf(
         '<script>(function(d, s, id) {'.
         ' var js, fjs = d.getElementsByTagName(s)[0];'.
         ' if (d.getElementById(id)) return;'.
@@ -171,8 +171,7 @@ final class PhamePostView extends AphrontView {
         ' js.src = %s;'.
         ' fjs.parentNode.insertBefore(js, fjs);'.
         '}(document, \'script\', \'facebook-jssdk\'));</script>',
-      $c_uri
+        $c_uri));
-    );
 
 
     $uri = $this->getSkin()->getURI('post/'.$this->getPost()->getPhameTitle());
@@ -183,17 +182,18 @@ final class PhamePostView extends AphrontView {
         'data-href'        => $uri,
         'data-num-posts'   => 5,
       ),
-      ''
+      '');
-    );
 
-    return phutil_render_tag(
+    return phutil_tag(
       'div',
       array(
         'class' => 'phame-comments-facebook',
       ),
-      $fb_root.
+      array(
-      $fb_js.
+        $fb_root,
-      $fb_comments);
+        $fb_js,
+        $fb_comments,
+      ));
   }
 
   private function renderDisqusComments() {
@@ -211,7 +211,8 @@ final class PhamePostView extends AphrontView {
     );
 
     // protip - try some  var disqus_developer = 1; action to test locally
-    $disqus_js = jsprintf(
+    $disqus_js = phutil_safe_html(
+      jsprintf(
         '<script>'.
         ' var disqus_shortname = "phabricator";'.
         ' var disqus_identifier = %s;'.
@@ -227,16 +228,17 @@ final class PhamePostView extends AphrontView {
         '})(); </script>',
         $post->getPHID(),
         $this->getSkin()->getURI('post/'.$this->getPost()->getPhameTitle()),
-      $post->getTitle()
+        $post->getTitle()));
-    );
 
-    return phutil_render_tag(
+    return phutil_tag(
       'div',
       array(
         'class' => 'phame-comments-disqus',
       ),
-      $disqus_thread.
+      array(
-      $disqus_js);
+        $disqus_thread,
+        $disqus_js,
+      ));
   }
 
 }

src/applications/remarkup/conduit/ConduitAPI_remarkup_process_Method.php

@@ -43,8 +43,15 @@ final class ConduitAPI_remarkup_process_Method extends ConduitAPIMethod {
     $engine = PhabricatorMarkupEngine::$engine_class();
     $engine->setConfig('viewer', $request->getUser());
 
+    $text = $engine->markupText($content);
+    if ($text) {
+      $content = phutil_safe_html($text)->getHTMLContent();
+    } else {
+      $content = '';
+    }
+
     $result = array(
-      'content' => $engine->markupText($content),
+      'content' => $content,
     );
 
     return $result;

src/applications/slowvote/controller/PhabricatorSlowvotePollController.php

@@ -203,7 +203,8 @@ final class PhabricatorSlowvotePollController
     foreach ($comments as $comment) {
       $handle = $handles[$comment->getAuthorPHID()];
 
-      $markup = $engine->markupText($comment->getCommentText());
+      $markup = phutil_safe_html(
+        $engine->markupText($comment->getCommentText()));
 
       require_celerity_resource('phabricator-remarkup-css');
 

src/infrastructure/markup/PhabricatorMarkupEngine.php

@@ -160,7 +160,7 @@ final class PhabricatorMarkupEngine {
         "Call process() before getOutput().");
     }
 
-    return $this->objects[$key]['output'];
+    return new PhutilSafeHTML($this->objects[$key]['output']);
   }