Change Details

[Note, this is a little more involved than some of the other GCI tasks] The file `includes/Feed.php` in MediaWiki core is using php as a templating language. For example, in `RSSFeed::outHeader()` it is directly outputting XML mixed with things like `<?php print $this->getTitle(); ?>` It also seems to have inconsistent escaping (For example, calling `wfExpandUrl()` on a value already passed through `htmlspecialchars()`, where `htmlspecialchars()` is always supposed to be the last thing you do. It would be nicer if this used [Mustache](https://en.wikipedia.org/wiki/Mustache_(template_system)) and was consistently escaped using Mustache's double brace syntax. See the folder `includes/templates` for example Mustache templates, and `$templateParser->processTemplate()` for examples of where Mustache is used in MediaWiki. And https://mustache.github.io/mustache.5.html

[Note, this is a little more involved than some of the other GCI tasks] The file `includes/Feed.php` in MediaWiki core is using php as a templating language. For example, in `RSSFeed::outHeader()` it is directly outputting XML mixed with things like `<?php print $this->getTitle(); ?>` It also seems to have inconsistent escaping (For example, calling `wfExpandUrl()` on a value already passed through `htmlspecialchars()`, where `htmlspecialchars()` is always supposed to be the last thing you do. It would be nicer if this used [Mustache](https://en.wikipedia.org/wiki/Mustache_(template_system%29) and was consistently escaped using Mustache's double brace syntax. See the folder `includes/templates` for example Mustache templates, and `$templateParser->processTemplate()` for examples of where Mustache is used in MediaWiki. And https://mustache.github.io/mustache.5.html

[Note, this is a little more involved than some of the other GCI tasks] The file `includes/Feed.php` in MediaWiki core is using php as a templating language. For example, in `RSSFeed::outHeader()` it is directly outputting XML mixed with things like `<?php print $this->getTitle(); ?>` It also seems to have inconsistent escaping (For example, calling `wfExpandUrl()` on a value already passed through `htmlspecialchars()`, where `htmlspecialchars()` is always supposed to be the last thing you do. It would be nicer if this used [Mustache](https://en.wikipedia.org/wiki/Mustache_(template_system)%29) and was consistently escaped using Mustache's double brace syntax. See the folder `includes/templates` for example Mustache templates, and `$templateParser->processTemplate()` for examples of where Mustache is used in MediaWiki. And https://mustache.github.io/mustache.5.html