Validate the HTML in the admin area

[nacin]

Per the dev chat today: Check for and correct invalid HTML in the admin area.

We're not concerned about ARIA or autocomplete -- we're concerned about invalid HTML that reveals improper markup (such as unclosed or improperly nested tags), as that usually leads to larger display issues when rendering the page under some or all conditions.

Small patches from anyone willing to join in. (Stick to small patches that way multiple contributors don't duplicate efforts.) One of us will commit as soon as we see them. Be sure to post a comment in addition to the patch to trigger a notification.

Don't forget about multisite. :-)

[jshreve]

end tag for "tr" omitted in custom-background.php

[jshreve]

I'm going to jump in on this as much as I can (it's finals week). I found a missing tr in custom-background.php that the above patch fixes.

[jshreve]

two unclosed 'p' tags

[jshreve]

echoing a </td></tr> instead of adding it to output

[jshreve]

Sorry for the multiple patches - doing this in between other things.

The last one was causing an error under circumstances because a </td></tr> set was being echoed instead of added to the output string for get_media_item.

[nacin]

(In [14617]) Add closing tr tag to custom-background.php. Close paragraph tags in the recent comments and posts widget controls. props jshreve, see #13383.

[nacin]

(In [14618]) Append closing td/tr to output instead of directly echoing it. props jshreve, see #13383.

[Viper007Bond]

Replying to jshreve:

Sorry for the multiple patches - doing this in between other things.

Nothing wrong with multiple patches. See original ticket description. :)

[nacin]

Also, mark off files you've tested if you can, and mention whether or not you tested it on multisite. Just so we don't duplicate efforts.

[dremeda]

I am falling asleep. theme-editor.php is throwing <div class='highlight'> inside of an anchor. Line 184 I think.

I will get to it in the next day or two unless someone knocks it out.

[Utkarsh]

Fixes <div> inside <a> in Theme Editor.

[Utkarsh]

dremeda, just submitted a patch for that :)

[nacin]

(In [14625]) Use valid HTML in the theme editor. span instead of div inside an anchor. props Utkarsh, see #13383.

[Utkarsh]

Fixes several validation errors on custom background page.

[Utkarsh]

Fixes validation errors on custom header page.

[nacin]

(In [14625]) Use valid HTML in the theme editor. span instead of div inside an anchor. props Utkarsh, see #13383.

[nacin]

(In [14626]) Ensure validation. props Utkarsh, see #13383.

[Utkarsh]

Custom background patch refreshed against r14626

[nacin]

(In [14628]) Ensure validation. props Utkarsh, see #13383.

[TobiasBg]

(In [14628]) Ensure validation.

To avoid the second function call in line 160, we could optimize the code to something like

if ( $bg_color = get_background_color() )
    $background_styles .= "background-color: #{$bg_color};";

instead.

[zeo]

Removes unnecessary trailing space in LABEL

[zeo]

Standardize FORM id for upload to use lowercase with hyphen. See media.php: <?php echo $type; ?>-form

[ocean90]

Please pay attention if you change class/id names. You should fix it in the stylesheets too.

Validation erros for custom-header are handled in #13231.

[Utkarsh]

Fixes validation errors on ms-sites.php

[zeo]

Replying to ocean90:

Please pay attention if you change class/id names. You should fix it in the stylesheets too.

If you're referring to my patch 13383-use-lowercase.diff, uploadForm is not specified in stylesheet. So changing to upload-form doesn't affect anything.

[Utkarsh]

Fixes validation errors on ms-users.php

[jshreve]

adds missing esc_url calls, fixes many validation errors

[jshreve]

I found two missing esc_url calls so far. one on the media buttons (causing errors on dashboard and post screen) and on the set featured image link (errors on post screen). I'm sure that there may be some more.

[nacin]

(In [14632]) Valid HTML in ms-users and ms-sites. props Utkarsh, see #13383.

[nacin]

(In [14633]) esc_url the URL from get_upload_iframe_src. props jshreve, see #13383.

[TobiasBg]

Patch to remove duplicate function call of [14628], see #comment:15

[xibe]

press-this.php has a good number of issues, all tied to unescaped JavaScript it seems. A CDATA might help, but I don't if it wouldn't break something else entirely.

[nacin]

I don't have a problem with 13383-no_duplicate_function_call.patch, but it's hardly the only repetitive function call there. We call get_theme_mod alot.

I'd almost rather keep it. Or, introducing a slew of new variables at the start of the script and then using them is really the only option that will allow us to not make it too spaghetti-like throughout.

Those options are autoloaded, so it's rather trivial.

Re CDATA, see also #11939. Haven't looked at press-this though to see exactly what's going on.

[xibe]

Replying to nacin:

Re CDATA, see also #11939. Haven't looked at press-this though to see exactly what's going on.

So since #11939 is now set to Future Release, does it mean we should not look too hard on JS-related validation issues?

[zeo]

Media Library: don't wrap div with p tag.

[xibe]

A few multisite-related ones. I'm surprised by some, as the files seem to already have gone through proof-validating in this ticket...

wp-admin/network.php:

Line 127, Column 20: required attribute "action" not specified

<form method="post">

Note that here, the network was already activated, so there might not even be a need for a form in the first place...

wp-admin/ms-sites.php

Line 234, Column 30: ID "_wpnonce" already defined

<input type="hidden" id="_wpnonce" name="_wpnonce" value="9983aaea9e" /><in…

Info Line 165, Column 29: ID "_wpnonce" first defined here

<input type="hidden" id="_wpnonce" name="_wpnonce" value="f3ed217f78" /><inp…

wp-admin/ms-sites.php?action=editblog&id=1: cases of duplicated IDs, cases of non-existent IDs

wp-admin/ms-users.php: ID "_wpnonce" already defined

wp-admin/ms-options.php: a dozen of errors, including a seemingly broken table.

[zeo]

escape preview link

[Utkarsh]

Fixes all validation errors on ms-options.php

[Utkarsh]

Added patch for ms-options. Passes validation now.

[zeo]

JS: add backlash

[nacin]

(In [14655]) Validation and some textarea escaping for ms-options. props Utkarsh, see #13383.

[nacin]

(In [14656]) Escape slash in inline JS for SWFUploader. props zeo, see #13383.

[nacin]

wp-admin/network.php

Fixing.

wp-admin/ms-sites.php
wp-admin/ms-users.php

In order to fix multiple uses of _wpnonce, we need to make check to see we either only need one of them, or give each one their own name (and change the check_admin_referer checks to reflect that).

wp-admin/ms-sites.php?action=editblog&id=1

Patch welcome. I can imagine that editblog is a mess.

wp-admin/ms-options.php

Fixed in patch by Utkarsh.

[nacin]

(In [14657]) Add a form action to network.php. props xibe, see #13383.

[nacin]

untested

[Utkarsh]

Fixes all validation errors on ms-sites.php

[Utkarsh]

Added patch for ms-sites, as reported by xibe.

[nacin]

(In [14659]) Validation for network.php. props dremeda, see #13383.

[zeo]

nacin,

any reason why you skipped 13383-dont-wrap-div-with-p-tags.diff, and 13383-escape-preview.diff? Both patch tested. 13383-use-lowercase.diff tested but need review and feedback.

[nacin]

(In [14672]) Validation for ms-sites.php. props Utkarsh, see #13383.

[nacin]

(In [14673]) More validation fixes. Escape some preview=true URLs, also clean up tags in edit-attachment-rows. Slight CSS tweak to match presentation to the formerly invalid HTML. props zeo, see #13383.

[jshreve]

fixes some of the multiple nonce errors on multi isite

[jshreve]

I didn't see anyone else attempt the nonce stuff. To fix some errors on ms-users and ms-sites I gave the nonces their own names and edited the checks to reflect it (per nacin's comment).

msnonce.diff

[jshreve]

Fixes additional errors on the editblog screen in ms-sites.php

[markjaquith]

(In [14737]) Misc HTML validation fixes. see #13383. props jshreve

[ocean90]

Added patch for documentation link in theme editor.

[ocean90]

Added also a patch for new post page. There are also 3 '_ajax_nonce' IDs, should be fixed too. I couldn't find the right nonce checks.

[ocean90]

We should hide the Flash box if Javascript is deactivated.
Before: ​http://grab.by/4xsu | After: ​http://grab.by/4xsr

[nacin]

(In [14930]) Hide Flash uploader and theme/plugin editor documentation feature, if no JS. Also some validation fixes in the theme editor. props ocean90. see #13383.

[nacin]

(In [14931]) Validation in wp_dropdown_users and the non-hierarchical taxonomy meta box. props ocean90, see #13383.

[nacin]

(In [14933]) Separate out multiple _ajax_nonce fields on post forms. Yay, validation. fixes #13383.