Template:Stats is broken!!!!!!

Ah, I knew it. I said something would probably break in the last security fix.
 
It seems to be something weird between when the template is called and when its processed. The source of the page has no width specification at all. Scripting could possibly fix it, but that would be drastic...
 
The root cause is that there is a security fix that disallows HTML parameter expansion in templates. So the {{{HP}}} in the style parameter isn't being replaced.

It has been fixed in CVS, I'm waiting for MediaWiki to release a new version.
 
I could try fixing it with some scripting to set the style to work with the template.

The script would be roughly as follows (If someone could explain to me all the funny stuff that would be great" :

Code:
<script language="javascript">
<!--

function style(div,valuename){

if(valuename="atk"){
var value={{{Attack}}}
}

if(valuename="def"){
var value={{{Defense}}}
}

if(valuename="spd"){
var value={{{Speed}}}
}

if(valuename="hp"){
var value={{{HP}}}
}

if(valuename="spatk"){
var value={{{SpAtk}}}
}

if(valuename="atk"){
var value={{{SpDef}}}
}

div.style="background-color: rgb(240,128,48); width: "+value+"px; height: 10px; border: 1px solid black; overflow: hidden";

}


//-->

</script>

{|
|-
|style="text-align:right;"|HP:
!style="text-align:left;"|{{{HP}}}
|<div class="statbar" style="" onload="style(this,"hp")>&nbsp;</div>
|-
|style="text-align:right;"|Attack:
!style="text-align:left;"|{{{Attack}}}
|<div class="statbar" style="" onload="style(this,"atk")>&nbsp;</div>
|-
|style="text-align:right;"|Defense:
!style="text-align:left;"|{{{Defense}}}
|<div class="statbar" style="" onload="style(this,"def")>&nbsp;</div>
|-
|style="text-align:right;"|SpAtk:
!style="text-align:left;"|{{{SpAtk}}}
|<div class="statbar" style="" onload="style(this,"spatk")>&nbsp;</div>
|-
|style="text-align:right;"|SpDef:
!style="text-align:left;"|{{{SpDef}}}
|<div class="statbar" style="" onload="style(this,"spdef")>&nbsp;</div>
|-
|style="text-align:right;"|Speed:
!style="text-align:left;"|{{{Speed}}}
|<div class="statbar" style="" onload="style(this,"spd")>&nbsp;</div>
|}

This should bypass the security because the system would decide that the templating was not inside an element.
 
Last edited:
Hmm. Funny, that you've used Javascript. Accidental Javascript inclusion was exactly what they were trying to prevent. (I assume you can't use custom Javascript anyway.)
 
I have patched the parser with the relevant fixes. I think this should fix the {{tt}} and {{Stats}} problems.
 
Please note: The thread is from 21 years ago.
Please take the age of this thread into consideration in writing your reply. Depending on what exactly you wanted to say, you may want to consider if it would be better to post a new thread instead.
Back
Top Bottom