mime-type

chris steipp requested that:

* mimeTypeAndExtensionMatch doesn't ensure mime = extension.
  mimeTypeAndExtensionMatch() should use MimeMagic::isMatchingExtension()

* It looks like this is only used for the xml metadata. If so, can you please
  document that in the code?

* Use MimeMagic for mimetype detection in /Php/File.php

also adjust lines > 100 characters and removed no longer needed /Php/FileException.php

Change-Id: If378337bec65532128c35919e5e8e21be2ecbcaa
js-error-output

chris steipp requested that:

* Line 311: Don't include error message in that string, since it's sent to
  .html().

Change-Id: I6fa6f74c21c444f66faf5780a644681b5f87182e
table-create

chris steipp pointed out that:

* table-create-gwtoolset-mediawiki-templates.sql is missing hooks for update.php

it’s no longer needed.

Change-Id: I8381b057569ac12a69cc3f592b4d09c9fa832c35
sanitizer-escape-id

chris steipp requested that:

* getButtonRowNoMetadata, getFirstRow use Sanitizer::escapeId for html id attr
* xml_validator.asp needs to be an external link

when the $msg on line line 463 of /includes/Handlers/Xml/XmlDetectHandler.php
is passed to GWTException, it is properly converted to an external exception. i’m
assuming that this means that class="external free" gets applied to the link
and rel="nofollow".

i also adjusted the same link that is in /includes/Forms/MetadataDetectForm.php

Change-Id: I8b1fa6a77ad1b03a3131b76e1564b2133bb053a9
derivative-request

chris steipp requested that:

* includes/Adapters/Php/MediawikiTemplatePhpAdapter.php should use a derivative request
  object instead of curling the api. If this isn't possible for some reason, it needs to
  use https instead of http.

while working on this request i also found an issue with the retrieval of MediaWiki templates
that contain a space in their title, Musical work, or do not exist; corrected the issue.

Change-Id: Ia627baa116be379c5975faecfe4921b9d330dc74
augmentAllowedExtensions

chris steipp requested that:

* we remove augmentAllowedExtensions from includes/Handlers/UploadHandler.php if it's unused

Change-Id: If1a738835e249819a92a2b1f8042997a1da3bad1
PreviewFrom

chris steipp requested that:

* Can getPostAsHiddenFields in includes/Forms/PreviewForm.php only return a whitelist of fields?

chris steipp mentioned that:

* Checking for PHP_SAPI = 'cli' in includes/Handlers/Forms/MetadataMappingHandler.php seems like
  the wrong way to check if this is running from a job

Change-Id: Ic7e3609327ed9452659dbd8bbfa8bd2d3ada0fd9
FOR_PUBLIC

chris steipp requested that:

* includes/Adapters/Php/MappingPhpAdapter.php needs to check of the user has access,
  or get FOR_PUBLIC

Change-Id: I203a2ecb20a3bd9e7349723a205edb2382cdb4e8
original-post

chris steipp requested that:

* in includes/Jobs/UploadMetadataJob.php, the variables put into the $_POST
  global state can be anything, since the whitelisting for MetadataMappingHandler
  is based on the templates, which are user-controlled. If you need arbitrary
  values to be input from the form, you need to use something other than $_POST
  to pass the state to the dependent objects.

Change-Id: Ie60468852d773a914cdb940ecc105ba070e8da36
Merge branch 'mime-type'
Merge branch 'table-create'
Merge branch 'sanitizer-escape-id'
Merge branch 'derivative-request'
Merge branch 'augmentAllowedExtensions'
Merge branch 'PreviewForm'
Merge branch 'FOR_PUBLIC'
Merge branch 'original-post'