Updated mediawiki/extensions
Project: mediawiki/extensions/Flow  4a24b47df18a7e35d23870b8994327fe1af06adf

Auto-wrapping explicit escaper for templates

Within the current templating system its difficult to tell if
all content is being escaped properly.  This is a replacement
(not drop in ) which only provides values to the templates via
$this and wraps all values in an escaper.

This is the same general structure as the intial templating system,
before it grew into what it is today. It adds an escaper and a system
for handling helper objects within templates to the previous implementation.
Additionally some concern was expressed previously over variables magically
appearing in the template, so now all access to template data is
done with propery access on the $this value within the template.

The escaper is explicit, you must call either ->sanitized() or ->raw
on the provided values. By using an auto-wrapping explicit escaper
we switch from default unsafe to default explicit. This will make
some things more difficult, like passing a string into a template to
be included in a wfMessage call.  A __raw() method is provided to
unwrap the escaped values.

For more details on the escaping see the class docblock on
Flow\Template.

Change-Id: I44dced1ce4f64d324e9d4692a832a3b233da2e29