From a02d4c4a161a689111adac16e6fa702b30dea27b Mon Sep 17 00:00:00 2001
From: Dominik Schilling <ocean90@git.wordpress.org>
Date: Fri, 5 Aug 2016 19:27:56 +0000
Subject: [PATCH] Update/Install: Replace "error" and "-1" failure messages
 with a more meaningful one.

* "-1" is an invalid nonce error, show 'An error has occurred. Please reload the page and try again.'.
* "error" means that the connection to the server was lost, show 'Connection lost or the server is busy. Please try again later.'.
* Escape the message in `wp-updates-admin-notice` because the response may include HTML.
* Remove HTML tags in `wp.updates.isValidResponse()` to make PHP's error messages more readable.

Props azaozz for review.
Fixes #37583.

git-svn-id: https://develop.svn.wordpress.org/trunk@38205 602fd350-edb4-49c9-b593-d223f7449a82
---
 src/wp-admin/includes/update.php  | 2 +-
 src/wp-admin/js/updates.js        | 8 +++++++-
 src/wp-includes/script-loader.php | 2 ++
 tests/qunit/fixtures/updates.js   | 2 ++
 4 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/src/wp-admin/includes/update.php b/src/wp-admin/includes/update.php
index 74899e37cb..3bc11d8954 100644
--- a/src/wp-admin/includes/update.php
+++ b/src/wp-admin/includes/update.php
@@ -631,7 +631,7 @@ function maintenance_nag() {
 function wp_print_admin_notice_templates() {
 	?>
 	<script id="tmpl-wp-updates-admin-notice" type="text/html">
-		<div <# if ( data.id ) { #>id="{{ data.id }}"<# } #> class="notice {{ data.className }}"><p>{{{ data.message }}}</p></div>
+		<div <# if ( data.id ) { #>id="{{ data.id }}"<# } #> class="notice {{ data.className }}"><p>{{ data.message }}</p></div>
 	</script>
 	<script id="tmpl-wp-bulk-updates-admin-notice" type="text/html">
 		<div id="{{ data.id }}" class="{{ data.className }} notice <# if ( data.errors ) { #>notice-error<# } else { #>notice-success<# } #>">
diff --git a/src/wp-admin/js/updates.js b/src/wp-admin/js/updates.js
index 5df8ded165..cc5090cc75 100644
--- a/src/wp-admin/js/updates.js
+++ b/src/wp-admin/js/updates.js
@@ -1562,8 +1562,12 @@
 			return true;
 		}
 
-		if ( _.isString( response ) ) {
+		if ( _.isString( response ) && '-1' === response ) {
+			error = wp.updates.l10n.nonceError;
+		} else if ( _.isString( response ) ) {
 			error = response;
+		} else if ( 'undefined' !== typeof response.readyState && 0 === response.readyState ) {
+			error = wp.updates.l10n.connectionError;
 		} else if ( _.isString( response.responseText ) && '' !== response.responseText ) {
 			error = response.responseText;
 		} else if ( _.isString( response.statusText ) ) {
@@ -1584,6 +1588,8 @@
 				break;
 		}
 
+		// Messages are escaped, remove HTML tags to make them more readable.
+		error = error.replace( /<[\/a-z][^<>]*>/gi, '' );
 		errorMessage = errorMessage.replace( '%s', error );
 
 		// Add admin notice.
diff --git a/src/wp-includes/script-loader.php b/src/wp-includes/script-loader.php
index 0864396eeb..3a1ec18e7b 100644
--- a/src/wp-includes/script-loader.php
+++ b/src/wp-includes/script-loader.php
@@ -677,6 +677,8 @@ function wp_default_scripts( &$scripts ) {
 				/* translators: %s: Importer name */
 				'activateImporterLabel'      => __( 'Run %s' ),
 				'unknownError'               => __( 'An unknown error occurred' ),
+				'connectionError'            => __( 'Connection lost or the server is busy. Please try again later.' ),
+				'nonceError'                 => __( 'An error has occurred. Please reload the page and try again.' ),
 				'pluginsFound'               => __( 'Number of plugins found: %d' ),
 				'noPluginsFound'             => __( 'No plugins found. Try a different search.' ),
 			),
diff --git a/tests/qunit/fixtures/updates.js b/tests/qunit/fixtures/updates.js
index 3a0ce374bf..013536c2b5 100644
--- a/tests/qunit/fixtures/updates.js
+++ b/tests/qunit/fixtures/updates.js
@@ -46,6 +46,8 @@ window._wpUpdatesSettings = {
 		'activateThemeLabel':  'Activate %s',
 		'activateImporter': 'Run Importer',
 		'unknownError': 'An unknown error occurred',
+		'connectionError': 'Connection lost or the server is busy. Please try again later.',
+		'nonceError': 'An error has occurred. Please reload the page and try again.',
 		'pluginsFound': 'Number of plugins found: %d',
 		'noPluginsFound': 'No plugins found. Try a different search.'
 	}