Convert phutil_render_tag(X, Y) to phutil_tag

Summary:
Created with spatch:

  lang=diff
  - phutil_render_tag
  + phutil_tag
    (X, Y)

(and null manually)

Test Plan: Loaded homepage

Reviewers: epriestley

Reviewed By: epriestley

CC: aran, Korvin

Differential Revision: https://secure.phabricator.com/D4500
Convert phutil_render_tag(X, Y, phutil_escape_html(Z)) to phutil_tag

Summary:
Created with spatch:

  lang=diff
  - phutil_render_tag
  + phutil_tag
    (X, Y,
  - phutil_escape_html(
    Z
  - )
    )

Test Plan: Loaded homepage

Reviewers: epriestley

Reviewed By: epriestley

CC: aran, Korvin

Differential Revision: https://secure.phabricator.com/D4501
Convert phutil_render_tag(X, Y, '...') to phutil_tag

Summary:
Created with spatch:

  lang=diff
  - phutil_render_tag
  + phutil_tag
    (X, Y, '...')

Then searched for `&` and `<` in the output and replaced them.

Test Plan: Loaded homepage.

Reviewers: epriestley

Reviewed By: epriestley

CC: aran, Korvin

Differential Revision: https://secure.phabricator.com/D4503
Convert phutil_render_tag(X, Y, pht('...')) to phutil_tag

Summary:
Created with spatch:

  lang=diff
  - phutil_render_tag
  + phutil_tag
    (X, Y, pht('...'))

The searched for `<` and `&` by sgrep.

Test Plan: Loaded homepage.

Reviewers: epriestley

Reviewed By: epriestley

CC: aran, Korvin

Differential Revision: https://secure.phabricator.com/D4504
Convert simple phutil_render_tag() to phutil_tag()

Summary: Done manually.

Test Plan: Loaded homepage.

Reviewers: epriestley

Reviewed By: epriestley

CC: aran, Korvin

Differential Revision: https://secure.phabricator.com/D4509
Convert phutil_render_tag(X, Y, phutil_render_tag(...)) to phutil_render_html

Summary:
Created with spatch:

  lang=diff
  - phutil_render_tag
  + phutil_render_html
    (X, Y, phutil_render_tag(...))

  - phutil_render_tag
  + phutil_render_html
    (X, Y, phutil_render_html(...))

Test Plan: Loaded homepage

Reviewers: epriestley

CC: aran, Korvin

Differential Revision: https://secure.phabricator.com/D4502
Fix some easy phutil_render_tag()

Summary:
  - Grepped for phutil_render_tag().
  - Fixed some easy ones.

Test Plan:
  - Browsed around; site didn't seem more broken than it was before.

Reviewers: vrana

Reviewed By: vrana

CC: aran

Differential Revision: https://secure.phabricator.com/D4638
Fix double escaping after D4638

Auditors: epriestley
Restore string cast for textarea control

Summary: Removed in 48561a8b but actually necessary.

Test Plan: Differential now renders textareas correctly.

Reviewers: vrana

Reviewed By: vrana

CC: aran

Differential Revision: https://secure.phabricator.com/D4643
Add javelin_tag(), convert easy callsites

Summary:
  - Implements `javelin_tag()`, which is `javelin_render_tag()` on top of `phutil_tag()` instead of `phutil_render_tag()`.
  - Manually converts all or almost all of the trivial callsites.

Test Plan:
  - Site does not seem any more broken than before.

Reviewers: vrana

Reviewed By: vrana

CC: aran

Differential Revision: https://secure.phabricator.com/D4639
Add renderHTMLView

Summary:
  - Implement AphrontView->renderHTMLView(), which works like AphrontView->renderSingleView() but always return PhutilSafeHTML.

Test Plan: Action list view no longer as broken.

Reviewers: vrana

Reviewed By: vrana

CC: aran

Differential Revision: https://secure.phabricator.com/D4642
Fix AphrontCrumbView (phutil_tag)

Summary: Proper fix is to do some layout work in Diffusion. Short of that, make this escape properly.

Test Plan: Viewed various crumbs, no more overescaping for non-diffusion crumbs.

Reviewers: vrana

Reviewed By: vrana

CC: aran

Differential Revision: https://secure.phabricator.com/D4641
Merge branch 'master' into phutil_tag

(Just synchronizing master into the tag branch.)
Fix object ObjectItemListView attributes

Summary: This works after pht() + html got sorted out.

Test Plan: Looked at some object attribute lists.

Reviewers: vrana

Reviewed By: vrana

CC: aran

Maniphest Tasks: T2432

Differential Revision: https://secure.phabricator.com/D4645
Fix most timeline escaping

Summary: Some content might be broken but it's hard to test since JS/Ajax is also a bit broken.

Test Plan: Looked at timeline examples.

Reviewers: vrana

Reviewed By: vrana

CC: aran

Maniphest Tasks: T2432

Differential Revision: https://secure.phabricator.com/D4683
Fix JSON encoding of PhutilSafeHTML for browser consumption

Summary:
If you run this code:

  json_encode(array('tag' => phutil_tag('div', array())));

...you get this result, because json_encode() does not call toString() on objects:

  {"tag":{}}

Instead, convert such objects to their underlying strings. Javelin has support for JX.HTML and for implicit conversion (which is kind of sketchy for other reasons) but it's sort of complicated (only happens on Ajax, not behaviors) and messy (not metadata-based), so ignore it for now.

We'll need to do something similar for serialization to the database. My plan there is just to throw on any objects. The only time we put HTML in the database is cache-related and those tiny number of callsites can manually handle it.

Test Plan: Various ajax things now receive the correct data.

Reviewers: vrana

Reviewed By: vrana

CC: aran

Maniphest Tasks: T2432

Differential Revision: https://secure.phabricator.com/D4684
Simplify form/lightbox stuff

Summary:
I broke this a bit a few revisions ago by making `phabricator_render_csrf_magic()` return array instead of string without actually grepping for callsites.

Instead of building a form in JS, build it in PHP and just change its action in JS. This is simpler and doesn't require us to expose CSRF magic in more places.

This change triggered a rather subtle bug: if we rendered a normal form on the page (and thus installed the "disable forms when submitted" behavior), the download button would incorrectly disable after being clicked. This doesn't currently happen in Files because we don't put a form on the same page as the download button.

Instead, make the "disable" behavior check if the form is downloading stuff, and not disable stuff if it is. Then mark the lightbox and Files form as both download forms.

Test Plan: Used lightbox; used Files. Verified download buttons download the right stuff and behave correctly. Grepped for other download forms, but all the other places where we write "download" don't appear to actually be download links.

Reviewers: vrana, btrahan

Reviewed By: vrana

CC: aran

Maniphest Tasks: T2432

Differential Revision: https://secure.phabricator.com/D4685
Convert more render_tag -> tag

Summary: Mostly straightforward.

Test Plan: Browsed most of the affected interfaces.

Reviewers: vrana, btrahan

Reviewed By: vrana

CC: aran

Maniphest Tasks: T2432

Differential Revision: https://secure.phabricator.com/D4687
More render_tag -> tag (misc, form inset view)

Summary: Converts some callsites.

Test Plan: Grepped; looked -- see inlines.

Reviewers: vrana

Reviewed By: vrana

CC: aran

Maniphest Tasks: T2432

Differential Revision: https://secure.phabricator.com/D4688
render_tag -> tag: phame, remarkup

Summary: Converts various callsites from render_tag variants to tag variants.

Test Plan: See inlines.

Reviewers: vrana, btrahan

Reviewed By: vrana

CC: aran

Maniphest Tasks: T2432

Differential Revision: https://secure.phabricator.com/D4689