From 47a4fe584b4df0695e716f46e8414adbe8e50bbb Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sat, 3 Oct 2026 20:38:56 +0000
Subject: [PATCH 1/5] Test all locale files; complete en.php and fix stale keys
 in de.php and oc.php

Unit tests check the locale files (valid, no duplicate keys, UTF-8, date formats,
all texts of the code in en.php); integration tests run the views with every
locale and with a generated locale containing markup.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UnF3JNHe2m9RQM1BRKdBMY
---
 locales/de.php                           |   7 +-
 locales/en.php                           |  44 ++++++
 locales/oc.php                           |   6 +-
 tests/Integration/LocaleEscapingTest.php |  61 ++++++++
 tests/Integration/LocaleTest.php         | 101 ++++++++++++
 tests/README.md                          |   6 +-
 tests/Unit/LocaleFilesTest.php           | 186 +++++++++++++++++++++++
 7 files changed, 404 insertions(+), 7 deletions(-)
 create mode 100644 tests/Integration/LocaleEscapingTest.php
 create mode 100644 tests/Integration/LocaleTest.php
 create mode 100644 tests/Unit/LocaleFilesTest.php

diff --git a/locales/de.php b/locales/de.php
index 04d01d4..b977b53 100644
--- a/locales/de.php
+++ b/locales/de.php
@@ -30,9 +30,10 @@
 	'Cancel' => 'Abbrechen',
 	'Saved'  => 'Gespeichert',
 	'Log In' => 'Einloggen',
-	'Log Out' => 'Ausloggen',
+	'Log out' => 'Ausloggen',
 	'Password' => 'Passwort',
 	'Wrong password' => 'Falsches Passwort',
+	'Invalid page name' => 'Ungültiger Seitenname',
 	'Title'  => 'Titel',
 	'Image Description' => 'Bildbeschreibung',
 	'Name'   => 'Name',
@@ -60,10 +61,10 @@
 	'Error renaming file' => 'Fehler beim Umbenennen der Datei',
 	'Sidebar file could not be found' => 'Seitenleisten-Datei nicht gefunden',
 	'Name of new page (restrictions in tip)' => 'Seitenname (Einschränkungen im Tip)',
-	"Character restrictions: '#' and '|' have a special meaning in page links, they will therefore be removed; also, characters '~', '/', '\\', ':', '|', '&' might cause trouble in filenames and are therefore replaced by '-'." => "Buchstaben-Beschränkungen: '#' und '|' haben eine spezielle Bedeutung in Links, sie werden deshalb entfernt. Weiters können die Zeichen '~', '/', '\\', ':', '|', '&' Probleme in Dateinamen verursachen, und werden deshalb durch einen Bindestrich '-' ersetzt.",
+	"Character restrictions: '#' and '|' have a special meaning in page links, they will therefore be removed; also, characters '~', '..', '\\', ':', '|', '&' might cause trouble in filenames and are therefore replaced by '-'." => "Buchstaben-Beschränkungen: '#' und '|' haben eine spezielle Bedeutung in Links, sie werden deshalb entfernt. Weiters können die Zeichen '~', '..', '\\', ':', '|', '&' Probleme in Dateinamen verursachen, und werden deshalb durch einen Bindestrich '-' ersetzt.",
 	'Image deleted' => 'Bild gelöscht',
 	'Image renamed' => 'Bild umbenannt',
-	'Error deleting image' => 'Fehler beim Löschen des Bildes',
+	'Error deleting image: ' => 'Fehler beim Löschen des Bildes: ',
 	'Restored unsaved draft from %s.' => 'Ungespeicherter Entwurf vom %s wiederhergestellt.',
 	'Warning: the page was changed since this draft was started.' => 'Achtung: Die Seite wurde geändert, seit dieser Entwurf begonnen wurde.',
 	'Discard draft' => 'Entwurf verwerfen',
diff --git a/locales/en.php b/locales/en.php
index c93362c..18eabfc 100644
--- a/locales/en.php
+++ b/locales/en.php
@@ -31,6 +31,50 @@
 	'Restored unsaved draft from %s.' => 'Restored unsaved draft from %s.',
 	'Warning: the page was changed since this draft was started.' => 'Warning: the page was changed since this draft was started.',
 	'Discard draft' => 'Discard draft',
+	'Close' => 'Close',
+	'Markdown Syntax Helper' => 'Markdown Syntax Helper',
+	'Header' => 'Header',
+	'Emphasize' => 'Emphasize',
+	'Bold' => 'Bold',
+	'Formatting help' => 'Formatting help',
+	'Wrong password' => 'Wrong password',
+	'Password' => 'Password',
+	'Invalid page name' => 'Invalid page name',
+	'Created' => 'Created',
+	'Creating new page since no page with given title exists!' => 'Creating new page since no page with given title exists!',
+	'Character restrictions: \'#\' and \'|\' have a special meaning in page links, they will therefore be removed; also, characters \'~\', \'..\', \'\\\', \':\', \'|\', \'&\' might cause trouble in filenames and are therefore replaced by \'-\'.' => 'Character restrictions: \'#\' and \'|\' have a special meaning in page links, they will therefore be removed; also, characters \'~\', \'..\', \'\\\', \':\', \'|\', \'&\' might cause trouble in filenames and are therefore replaced by \'-\'.',
+	'Name of new page (restrictions in tip)' => 'Name of new page (restrictions in tip)',
+	'Shrink if larger than ' => 'Shrink if larger than ',
+	'Pixels' => 'Pixels',
+	'Total' => 'Total',
+	'images' => 'images',
+	'Usage' => 'Usage',
+	'Action' => 'Action',
+	'Used on page' => 'Used on page',
+	'Rename' => 'Rename',
+	'Delete' => 'Delete',
+	'to' => 'to',
+	'Removed' => 'Removed',
+	'Renamed' => 'Renamed',
+	'matches' => 'matches',
+	'Updated links in the following pages:' => 'Updated links in the following pages:',
+	'Error deleting file' => 'Error deleting file',
+	'Error renaming file' => 'Error renaming file',
+	'Image deleted' => 'Image deleted',
+	'Image renamed' => 'Image renamed',
+	'Updated images in the following pages:' => 'Updated images in the following pages:',
+	'Error deleting image: ' => 'Error deleting image: ',
+	'Error renaming image: ' => 'Error renaming image: ',
+	'pages' => 'pages',
+	'Name' => 'Name',
+	'Modified' => 'Modified',
+	'Size' => 'Size',
+	'Create page' => 'Create page',
+	'Log out' => 'Log out',
+	'Sidebar file could not be found' => 'Sidebar file could not be found',
+	'What links here:' => 'What links here:',
+	'Image Description' => 'Image Description',
+	'Show links here' => 'Show links here',
 	// Override TITLE_DATE and TITLE_DATE_NO_TIME if set.
 	'date_format'         => 'Y-m-d H:i:s',
 	'date_format_no_time' => 'Y-m-d',
diff --git a/locales/oc.php b/locales/oc.php
index 449a762..260d5b4 100644
--- a/locales/oc.php
+++ b/locales/oc.php
@@ -29,7 +29,7 @@
 	'Cancel' => 'Anullar',
 	'Saved'  => 'Salvat',
 	'Log In' => 'Connexion',
-	'Log Out' => 'Desconnexion',
+	'Log out' => 'Desconnexion',
 	'Password' => 'Senhal',
 	'Title'  => 'Títol',
 	'Image Description' => 'Descripcion de l’imatge',
@@ -57,9 +57,9 @@
 	'Error renaming file' => 'Error en renomenant lo fichièr',
 	'Sidebar file could not be found' => 'Impossible de trobar la barra laterala',
 	'Name of new page (restrictions in tip)' => 'Nom de la pagina novèla (restriccion dins las astúcias)',
-	"Character restrictions: '#' and '|' have a special meaning in page links, they will therefore be removed; also, characters '~', '/', '\\', ':', '|', '&' might cause trouble in filenames and are therefore replaced by '-'." => "Restriccions dels caractèrs : '#' e '|' an una significacion especiala dins los ligams de pagina, seràn doncas tirats ; tanben, los caractèrs '~', '/', '\\', ':', '|', '&' que pòdon causar de problèmas dins los noms de fichièrs seràn remplaçat per '-'.",
+	"Character restrictions: '#' and '|' have a special meaning in page links, they will therefore be removed; also, characters '~', '..', '\\', ':', '|', '&' might cause trouble in filenames and are therefore replaced by '-'." => "Restriccions dels caractèrs : '#' e '|' an una significacion especiala dins los ligams de pagina, seràn doncas tirats ; tanben, los caractèrs '~', '..', '\\', ':', '|', '&' que pòdon causar de problèmas dins los noms de fichièrs seràn remplaçat per '-'.",
 	'Image deleted' => 'Imatge suprimit',
-	'Error deleting image' => 'Error de supression de l’imatge',
+	'Error deleting image: ' => 'Error de supression de l’imatge : ',
 	// Override TITLE_DATE and TITLE_DATE_NO_TIME if set.
 	'date_format'         => 'd/m/Y H:i:s',
 	'date_format_no_time' => 'd/m/Y',
diff --git a/tests/Integration/LocaleEscapingTest.php b/tests/Integration/LocaleEscapingTest.php
new file mode 100644
index 0000000..90d49e9
--- /dev/null
+++ b/tests/Integration/LocaleEscapingTest.php
@@ -0,0 +1,61 @@
+<?php
+
+namespace W2\Tests\Integration;
+
+use W2\Tests\Support\AppTestCase;
+
+/**
+ * Translations are escaped like all other output, so a locale file (e.g. from a third party) with quotes
+ * or markup in its texts can't break out of attributes or add elements. Uses a generated locale file.
+ */
+final class LocaleEscapingTest extends AppTestCase
+{
+	private const PAYLOAD = '"><img src=x onerror=alert(1)>\'<script>alert(2)</script>&amp;';
+
+	protected function configOverrides(): array
+	{
+		return ['W2_LOCALE' => 'generated'];
+	}
+
+	protected function setUp(): void
+	{
+		parent::setUp();
+		$texts = [];
+		foreach (['All', 'New', 'Upload', 'Search', 'Home', 'Edit', 'Save', 'Cancel', 'Title', 'Close', 'Formatting help', 'Header', 'Bold', 'Emphasize'] as $key) {
+			$texts[$key] = self::PAYLOAD . $key;
+		}
+		file_put_contents($this->server->rootDir() . '/locales/generated.php', "<?php\n\$w2_word_set = " . var_export($texts, true) . ";\n");
+	}
+
+	protected function tearDown(): void
+	{
+		@unlink($this->server->rootDir() . '/locales/generated.php');
+		parent::tearDown();
+	}
+
+	public function testTextsWithMarkupAndQuotesAreEscaped(): void
+	{
+		foreach (['/index.php', '/index.php?action=all', '/index.php?action=new', '/index.php?action=edit&page=Home'] as $url) {
+			$response = $this->http->get($url);
+			$this->assertSame(200, $response->status, $url);
+			$this->assertStringNotContainsString('<script>alert(2)', $response->body, $url);
+			$this->assertStringNotContainsString('<img src=x', $response->body, $url);
+			$this->assertStringNotContainsString('onerror=alert(1)>', $response->body, $url);
+			$this->assertStringContainsString(
+				'title="' . htmlspecialchars(self::PAYLOAD . 'All', ENT_QUOTES, 'UTF-8') . '"',
+				$response->body,
+				"the text is shown, escaped: $url"
+			);
+		}
+	}
+
+	public function testAttributesCannotBeClosedByTranslations(): void
+	{
+		$dom = new \DOMDocument();
+		@$dom->loadHTML('<?xml encoding="UTF-8">' . $this->http->get('/index.php')->body);
+		foreach ($dom->getElementsByTagName('img') as $img) {
+			$this->assertFalse($img->hasAttribute('onerror'), 'an img element got an event handler');
+			$this->assertNotSame('x', $img->getAttribute('src'));
+		}
+	}
+}
diff --git a/tests/Integration/LocaleTest.php b/tests/Integration/LocaleTest.php
new file mode 100644
index 0000000..27be677
--- /dev/null
+++ b/tests/Integration/LocaleTest.php
@@ -0,0 +1,101 @@
+<?php
+
+namespace W2\Tests\Integration;
+
+use PHPUnit\Framework\Attributes\DataProvider;
+use W2\Tests\Support\AppTestCase;
+
+/**
+ * Every locale file can be used: the main views are shown (PHP warnings fail the test, see AppTestCase::tearDown),
+ * with the language of the page set, and the translated texts used.
+ *
+ * The locale is the name of the data set (see configOverrides()).
+ */
+final class LocaleTest extends AppTestCase
+{
+	private const VIEWS = [
+		'/index.php',
+		'/index.php/MarkdownSyntax',
+		'/index.php?action=all',
+		'/index.php?action=new',
+		'/index.php?action=upload',
+		'/index.php?action=edit&page=Home',
+		'/index.php?action=rename&page=Home',
+		'/index.php?action=delete&page=Home',
+		'/index.php?action=view&page=Home&linkshere=true',
+		'/index.php/Nonexistent',
+		'/index.php?action=search&q=home',
+		'/index.php?action=imgRename&imgName=a.gif&prevpage=Home',
+		'/index.php?action=imgDelete&imgName=a.gif&prevpage=Home',
+	];
+
+	public static function locales(): array
+	{
+		$result = [];
+		foreach (glob(dirname(__DIR__, 2) . '/locales/*.php') as $file) {
+			$result[basename($file, '.php')] = [basename($file, '.php')];
+		}
+		return $result;
+	}
+
+	protected function configOverrides(): array
+	{
+		return ['W2_LOCALE' => (string)$this->dataName()];
+	}
+
+	/** @return array<string, string> */
+	private static function words(string $locale): array
+	{
+		return (function () use ($locale) {
+			defined('W2APP') || define('W2APP', true);
+			$w2_word_set = [];
+			require dirname(__DIR__, 2) . "/locales/$locale.php";
+			return $w2_word_set;
+		})();
+	}
+
+	#[DataProvider('locales')]
+	public function testAllViewsAreShown(string $locale): void
+	{
+		foreach (self::VIEWS as $url) {
+			$response = $this->http->get($url);
+			$this->assertSame(200, $response->status, "$locale: $url");
+			$this->assertStringContainsString('<div class="main">', $response->body, "$locale: $url");
+			$this->assertStringContainsString('</html>', $response->body, "$locale: $url");
+		}
+	}
+
+	#[DataProvider('locales')]
+	public function testLanguageAndCharsetOfThePage(string $locale): void
+	{
+		$response = $this->http->get('/index.php');
+		$this->assertStringContainsString("<html lang=\"$locale\">", $response->body);
+		$this->assertStringContainsString('<meta charset="UTF-8">', $response->body);
+		$this->assertTrue(mb_check_encoding($response->body, 'UTF-8'), 'the page is not valid UTF-8');
+	}
+
+	#[DataProvider('locales')]
+	public function testToolbarTooltipsAreTranslated(string $locale): void
+	{
+		$words = self::words($locale);
+		$body = $this->http->get('/index.php')->body;
+		foreach (['All', 'New', 'Upload'] as $key) {
+			$text = htmlspecialchars($words[$key] ?? $key, ENT_QUOTES, 'UTF-8');
+			$this->assertStringContainsString("title=\"$text\"", $body, "$locale: tooltip '$key'");
+		}
+		$this->assertStringContainsString('placeholder="' . htmlspecialchars($words['Search'] ?? 'Search', ENT_QUOTES, 'UTF-8') . '"', $body);
+	}
+
+	#[DataProvider('locales')]
+	public function testTitlesAndDatesUseTheLocale(string $locale): void
+	{
+		$words = self::words($locale);
+		$body = $this->http->get('/index.php?action=all')->body;
+		$this->assertStringContainsString('<span class="title">' . htmlspecialchars($words['All'] ?? 'All', ENT_QUOTES, 'UTF-8') . '</span>', $body);
+		$page = $this->http->get('/index.php/Home')->body;
+		$format = $words['date_format'] ?? null;
+		if ($format !== null) {
+			$this->assertMatchesRegularExpression('/<span class="titledate">[^<]+<\/span>/', $page);
+		}
+	}
+}
diff --git a/tests/README.md b/tests/README.md
index 4079d1e..c738720 100644
--- a/tests/README.md
+++ b/tests/README.md
@@ -33,7 +33,11 @@ also fails if the wiki logged PHP warnings, notices or deprecations while it ran
   `SourceGuardTest` looks at the tokens of the PHP files and fails on dangerous constructs: functions running code or
   commands, variables in regular expressions that are not quoted with `preg_quote()`, files included by variable
   names, and request data read outside the entry points.
-- `tests/Integration`: the tests. To test with another configuration, override
+  `LocaleFilesTest` checks the files in `locales/` (valid PHP, no duplicate keys, UTF-8, date formats) and that
+  `locales/en.php` has all texts used with `__()` in the code; texts missing in the other languages are only
+  reported as "incomplete", because `__()` falls back to the English text.
+- `tests/Integration`: the tests. `LocaleTest` runs the main views with every locale file (the data set name is
+  the locale, set with `W2_LOCALE`); `LocaleEscapingTest` uses a generated locale with markup in its texts. To test with another configuration, override
   `configOverrides()` in the test class; it returns values for the constants defined in
   `config.php` (or `$allowedIPs`).
 
diff --git a/tests/Unit/LocaleFilesTest.php b/tests/Unit/LocaleFilesTest.php
new file mode 100644
index 0000000..0ac918c
--- /dev/null
+++ b/tests/Unit/LocaleFilesTest.php
@@ -0,0 +1,186 @@
+<?php
+
+namespace W2\Tests\Unit;
+
+use PHPUnit\Framework\Attributes\DataProvider;
+use PHPUnit\Framework\TestCase;
+
+/**
+ * The locale files are valid, well-formed and (for English) complete. Missing texts in the other
+ * languages are reported as "incomplete" but don't fail, because __() falls back to the English text.
+ */
+final class LocaleFilesTest extends TestCase
+{
+	private const SOURCE_FILES = ['index.php', 'api.php', 'auth.php', 'auth_functions.php', 'functions.php'];
+	private const ROOT_LOCALE = 'en';
+
+	public static function locales(): array
+	{
+		$result = [];
+		foreach (glob(dirname(__DIR__, 2) . '/locales/*.php') as $file) {
+			$result[basename($file, '.php')] = [basename($file, '.php')];
+		}
+		return $result;
+	}
+
+	/** Loads a locale file the way index.php does, but in isolation from the globals of the test run */
+	private static function load(string $locale): array
+	{
+		$file = dirname(__DIR__, 2) . "/locales/$locale.php";
+		return (function () use ($file) {
+			$w2_word_set = null;
+			require $file;
+			return $w2_word_set;
+		})();
+	}
+
+	/** @return string[] keys of literal __() calls in the code (dynamic calls such as __($action) can't be known) */
+	private static function usedKeys(): array
+	{
+		$keys = [];
+		foreach (self::SOURCE_FILES as $file) {
+			$tokens = array_values(array_filter(
+				token_get_all((string)file_get_contents(dirname(__DIR__, 2) . "/$file")),
+				fn($token) => !is_array($token) || !in_array($token[0], [T_WHITESPACE, T_COMMENT, T_DOC_COMMENT], true)
+			));
+			foreach ($tokens as $i => $token) {
+				$previous = $tokens[$i - 1] ?? '';
+				if (is_array($token) && $token[0] === T_STRING && $token[1] === '__' && ($tokens[$i + 1] ?? '') === '('
+					&& !(is_array($previous) && $previous[0] === T_FUNCTION)
+					&& is_array($tokens[$i + 2] ?? null) && $tokens[$i + 2][0] === T_CONSTANT_ENCAPSED_STRING) {
+					$keys[] = eval('return ' . $tokens[$i + 2][1] . ';');
+				}
+			}
+		}
+		return array_values(array_unique($keys));
+	}
+
+	/** The keys of the array literal in the file, in order, to find duplicates (PHP silently keeps the last one) */
+	private static function declaredKeys(string $locale): array
+	{
+		$tokens = array_values(array_filter(
+			token_get_all((string)file_get_contents(dirname(__DIR__, 2) . "/locales/$locale.php")),
+			fn($token) => !is_array($token) || !in_array($token[0], [T_WHITESPACE, T_COMMENT, T_DOC_COMMENT], true)
+		));
+		$keys = [];
+		foreach ($tokens as $i => $token) {
+			if (is_array($token) && $token[0] === T_DOUBLE_ARROW && is_array($tokens[$i - 1])
+				&& $tokens[$i - 1][0] === T_CONSTANT_ENCAPSED_STRING) {
+				$keys[] = eval('return ' . $tokens[$i - 1][1] . ';');
+			}
+		}
+		return $keys;
+	}
+
+	#[DataProvider('locales')]
+	public function testFileDefinesAnArrayOfStrings(string $locale): void
+	{
+		$words = self::load($locale);
+		$this->assertIsArray($words);
+		$this->assertNotEmpty($words);
+		foreach ($words as $key => $value) {
+			$this->assertIsString($key);
+			$this->assertIsString($value, "value of '$key'");
+		}
+	}
+
+	#[DataProvider('locales')]
+	public function testFileHasNoOutputAndNoByteOrderMark(string $locale): void
+	{
+		$source = (string)file_get_contents(dirname(__DIR__, 2) . "/locales/$locale.php");
+		$this->assertStringStartsWith('<?php', $source, 'no byte order mark or output before the PHP tag');
+		ob_start();
+		self::load($locale);
+		$this->assertSame('', ob_get_clean());
+	}
+
+	#[DataProvider('locales')]
+	public function testFileIsValidUtf8WithoutControlCharacters(string $locale): void
+	{
+		$source = (string)file_get_contents(dirname(__DIR__, 2) . "/locales/$locale.php");
+		$this->assertTrue(mb_check_encoding($source, 'UTF-8'), 'not UTF-8');
+		foreach (self::load($locale) as $key => $value) {
+			$this->assertDoesNotMatchRegularExpression('/[\x00-\x08\x0B-\x1F\x7F]/', $value, "value of '$key'");
+		}
+	}
+
+	#[DataProvider('locales')]
+	public function testFileHasNoDuplicateKeys(string $locale): void
+	{
+		$keys = self::declaredKeys($locale);
+		$this->assertNotEmpty($keys);
+		$this->assertSame([], array_keys(array_filter(array_count_values($keys), fn($n) => $n > 1)));
+	}
+
+	#[DataProvider('locales')]
+	public function testTranslationsAreNotEmpty(string $locale): void
+	{
+		// __() treats empty values like missing ones, so they only hide the fallback
+		foreach (self::load($locale) as $key => $value) {
+			$this->assertNotSame('', trim($value), "value of '$key'");
+		}
+	}
+
+	#[DataProvider('locales')]
+	public function testDateFormatsAreValid(string $locale): void
+	{
+		$words = self::load($locale);
+		foreach (['date_format', 'date_format_no_time'] as $key) {
+			if (!isset($words[$key])) {
+				continue;
+			}
+			$formatted = date($words[$key], 86400 * 365);
+			$this->assertNotSame($words[$key], $formatted, "$key is not a date format");
+			$this->assertMatchesRegularExpression('/\d/', $formatted, $key);
+			$this->assertNotFalse(\DateTime::createFromFormat($words[$key], $formatted), "$key can't be parsed back");
+		}
+	}
+
+	#[DataProvider('locales')]
+	public function testPlaceholdersAreKept(string $locale): void
+	{
+		$this->addToAssertionCount(1);
+		foreach (self::load($locale) as $key => $value) {
+			if (str_contains($key, '%s')) {
+				$this->assertSame(substr_count($key, '%s'), substr_count($value, '%s'), "placeholders of '$key'");
+			}
+		}
+	}
+
+	public function testEnglishHasAllTextsUsedInTheCode(): void
+	{
+		$missing = array_values(array_diff(self::usedKeys(), array_keys(self::load(self::ROOT_LOCALE))));
+		$this->assertSame([], $missing, 'texts used with __() but missing in locales/en.php');
+	}
+
+	public function testExtractionFindsTheTextsOfTheCode(): void
+	{
+		$keys = self::usedKeys();
+		foreach (['Wrong password', 'Invalid page name', 'Upload error', 'date_format'] as $key) {
+			$this->assertContains($key, $keys);
+		}
+	}
+
+	#[DataProvider('locales')]
+	public function testNoUnknownTexts(string $locale): void
+	{
+		// e.g. a text of the code was renamed or has a typo (then it's never used)
+		$known = array_merge(self::usedKeys(), array_keys(self::load(self::ROOT_LOCALE)), ['imgDelete', 'imgRename']);
+		$unknown = array_values(array_diff(array_keys(self::load($locale)), $known));
+		$this->assertSame([], $unknown, "texts of locales/$locale.php which are not used in the code");
+	}
+
+	#[DataProvider('locales')]
+	public function testMissingTranslationsAreReported(string $locale): void
+	{
+		if ($locale === self::ROOT_LOCALE) {
+			$this->addToAssertionCount(1);
+			return;
+		}
+		$missing = array_values(array_diff(array_keys(self::load(self::ROOT_LOCALE)), array_keys(self::load($locale))));
+		if ($missing) {
+			$this->markTestIncomplete(count($missing) . " texts of locales/en.php are not translated in locales/$locale.php (the English text is shown): " . implode(', ', $missing));
+		}
+		$this->addToAssertionCount(1);
+	}
+}

From efd755124159ba3a86dab0749069b32adc00dd8b Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sat, 3 Oct 2026 21:02:17 +0000
Subject: [PATCH 2/5] Keep only non-identity entries in en.php; remove unused
 locale keys

__() returns the key for texts without an entry, so en.php only needs the
entries that differ from their key. The locale tests compare the other
languages with the texts used in the code instead. Removes the unused keys
Recent and Exit (Exit renamed to Log out in ja.php).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UnF3JNHe2m9RQM1BRKdBMY
---
 locales/de.php                 |  2 -
 locales/en.php                 | 71 +++-------------------------------
 locales/ja.php                 |  3 +-
 locales/oc.php                 |  2 -
 locales/sample.php             |  2 -
 tests/README.md                |  6 +--
 tests/Unit/LocaleFilesTest.php | 26 ++++++++-----
 7 files changed, 27 insertions(+), 85 deletions(-)

diff --git a/locales/de.php b/locales/de.php
index b977b53..597d6f0 100644
--- a/locales/de.php
+++ b/locales/de.php
@@ -19,8 +19,6 @@
 	'Created' => 'Angelegt',
 	'Upload' => 'Hochladen',
 	'All'    => 'Alle',
-	'Recent' => 'Zuletzt',
-	'Exit'   => 'Ausloggen',
 	'Search' => 'Suchen',
 	'Formatting help' => 'Formatierungshilfe',
 	'Bold'   => 'Fett',
diff --git a/locales/en.php b/locales/en.php
index 18eabfc..7b51124 100644
--- a/locales/en.php
+++ b/locales/en.php
@@ -6,75 +6,16 @@
  * Do not change variable name $w2_word_set.
  * Rewrite values in your locale and rename this file to locale code.
  * Set "LOCALE" to your locale in config.php.
+ *
+ * The English texts are the keys themselves: __() shows the key of a text which has no entry
+ * here, so this file only has the entries which are not the same as their key. To translate,
+ * add an entry for every text used with __() in the code (see the other files in this folder,
+ * and tests/Unit/LocaleFilesTest.php for the list of missing translations).
  */
 $w2_word_set = array(
-	// Buttons / Labels
-	'Home'   => 'Home',
-	'New'    => 'New',
-	'Edit'   => 'Edit',
-	'Upload' => 'Upload',
+	// Titles of the actions (the key is the name of the action)
 	'imgDelete' => 'Delete image',
 	'imgRename' => 'Rename image',
-	'All'    => 'All',
-	'Recent' => 'Recent',
-	'Exit'   => 'Exit',
-	'Search' => 'Search',
-	'Save'   => 'Save',
-	'Cancel' => 'Cancel',
-	'Saved'  => 'Saved',
-	'Log In' => 'Log In',
-	'Title'  => 'Title',
-	// Messages
-	'Upload error' => 'Upload error',
-	'Upload error: invalid file type' => 'Upload error: invalid file type',
-	'Image uploading has been disabled on this installation.' => 'Image uploading has been disabled on this installation.',
-	'Restored unsaved draft from %s.' => 'Restored unsaved draft from %s.',
-	'Warning: the page was changed since this draft was started.' => 'Warning: the page was changed since this draft was started.',
-	'Discard draft' => 'Discard draft',
-	'Close' => 'Close',
-	'Markdown Syntax Helper' => 'Markdown Syntax Helper',
-	'Header' => 'Header',
-	'Emphasize' => 'Emphasize',
-	'Bold' => 'Bold',
-	'Formatting help' => 'Formatting help',
-	'Wrong password' => 'Wrong password',
-	'Password' => 'Password',
-	'Invalid page name' => 'Invalid page name',
-	'Created' => 'Created',
-	'Creating new page since no page with given title exists!' => 'Creating new page since no page with given title exists!',
-	'Character restrictions: \'#\' and \'|\' have a special meaning in page links, they will therefore be removed; also, characters \'~\', \'..\', \'\\\', \':\', \'|\', \'&\' might cause trouble in filenames and are therefore replaced by \'-\'.' => 'Character restrictions: \'#\' and \'|\' have a special meaning in page links, they will therefore be removed; also, characters \'~\', \'..\', \'\\\', \':\', \'|\', \'&\' might cause trouble in filenames and are therefore replaced by \'-\'.',
-	'Name of new page (restrictions in tip)' => 'Name of new page (restrictions in tip)',
-	'Shrink if larger than ' => 'Shrink if larger than ',
-	'Pixels' => 'Pixels',
-	'Total' => 'Total',
-	'images' => 'images',
-	'Usage' => 'Usage',
-	'Action' => 'Action',
-	'Used on page' => 'Used on page',
-	'Rename' => 'Rename',
-	'Delete' => 'Delete',
-	'to' => 'to',
-	'Removed' => 'Removed',
-	'Renamed' => 'Renamed',
-	'matches' => 'matches',
-	'Updated links in the following pages:' => 'Updated links in the following pages:',
-	'Error deleting file' => 'Error deleting file',
-	'Error renaming file' => 'Error renaming file',
-	'Image deleted' => 'Image deleted',
-	'Image renamed' => 'Image renamed',
-	'Updated images in the following pages:' => 'Updated images in the following pages:',
-	'Error deleting image: ' => 'Error deleting image: ',
-	'Error renaming image: ' => 'Error renaming image: ',
-	'pages' => 'pages',
-	'Name' => 'Name',
-	'Modified' => 'Modified',
-	'Size' => 'Size',
-	'Create page' => 'Create page',
-	'Log out' => 'Log out',
-	'Sidebar file could not be found' => 'Sidebar file could not be found',
-	'What links here:' => 'What links here:',
-	'Image Description' => 'Image Description',
-	'Show links here' => 'Show links here',
 	// Override TITLE_DATE and TITLE_DATE_NO_TIME if set.
 	'date_format'         => 'Y-m-d H:i:s',
 	'date_format_no_time' => 'Y-m-d',
diff --git a/locales/ja.php b/locales/ja.php
index 26ca03a..c528a0c 100644
--- a/locales/ja.php
+++ b/locales/ja.php
@@ -14,8 +14,7 @@
 	'Edit'   => '編集',
 	'Upload' => 'アップロード',
 	'All'    => '全て',
-	'Recent' => '最近',
-	'Exit'   => 'ログアウト',
+	'Log out' => 'ログアウト',
 	'Search' => '検索',
 	'Save'   => '保存',
 	'Cancel' => 'キャンセル',
diff --git a/locales/oc.php b/locales/oc.php
index 260d5b4..ff79cf7 100644
--- a/locales/oc.php
+++ b/locales/oc.php
@@ -18,8 +18,6 @@
 	'Created' => 'Creacion',
 	'Upload' => 'Enviar',
 	'All'    => 'Tot',
-	'Recent' => 'Recents',
-	'Exit'   => 'Sortir',
 	'Search' => 'Recercar',
 	'Formatting help' => 'Ajuda al formatatge',
 	'Bold'   => 'Gras',
diff --git a/locales/sample.php b/locales/sample.php
index c609d05..76ac32a 100644
--- a/locales/sample.php
+++ b/locales/sample.php
@@ -14,8 +14,6 @@
 	'Edit'   => 'Edit',
 	'Upload' => 'Upload',
 	'All'    => 'All',
-	'Recent' => 'Recent',
-	'Exit'   => 'Exit',
 	'Search' => 'Search',
 	'Save'   => 'Save',
 	'Cancel' => 'Cancel',
diff --git a/tests/README.md b/tests/README.md
index c738720..1f1cd32 100644
--- a/tests/README.md
+++ b/tests/README.md
@@ -33,9 +33,9 @@ also fails if the wiki logged PHP warnings, notices or deprecations while it ran
   `SourceGuardTest` looks at the tokens of the PHP files and fails on dangerous constructs: functions running code or
   commands, variables in regular expressions that are not quoted with `preg_quote()`, files included by variable
   names, and request data read outside the entry points.
-  `LocaleFilesTest` checks the files in `locales/` (valid PHP, no duplicate keys, UTF-8, date formats) and that
-  `locales/en.php` has all texts used with `__()` in the code; texts missing in the other languages are only
-  reported as "incomplete", because `__()` falls back to the English text.
+  `LocaleFilesTest` checks the files in `locales/` (valid PHP, no duplicate keys, UTF-8, date formats) ;
+  `locales/en.php` only has entries that differ from their key (`__()` returns the key for texts without entry).
+  Texts of the code (`__()` calls) missing in the other languages are only reported as "incomplete".
 - `tests/Integration`: the tests. `LocaleTest` runs the main views with every locale file (the data set name is
   the locale, set with `W2_LOCALE`); `LocaleEscapingTest` uses a generated locale with markup in its texts. To test with another configuration, override
   `configOverrides()` in the test class; it returns values for the constants defined in
diff --git a/tests/Unit/LocaleFilesTest.php b/tests/Unit/LocaleFilesTest.php
index 0ac918c..8265ccb 100644
--- a/tests/Unit/LocaleFilesTest.php
+++ b/tests/Unit/LocaleFilesTest.php
@@ -6,8 +6,8 @@
 use PHPUnit\Framework\TestCase;
 
 /**
- * The locale files are valid, well-formed and (for English) complete. Missing texts in the other
- * languages are reported as "incomplete" but don't fail, because __() falls back to the English text.
+ * The locale files are valid and well-formed. Texts used in the code which a language doesn't translate are
+ * reported as "incomplete" but don't fail, because __() falls back to the English text.
  */
 final class LocaleFilesTest extends TestCase
 {
@@ -147,10 +147,19 @@ public function testPlaceholdersAreKept(string $locale): void
 		}
 	}
 
-	public function testEnglishHasAllTextsUsedInTheCode(): void
+	/** Texts used in the code, and the entries which aren't texts of the code (e.g. titles looked up by action name) */
+	private static function knownKeys(): array
 	{
-		$missing = array_values(array_diff(self::usedKeys(), array_keys(self::load(self::ROOT_LOCALE))));
-		$this->assertSame([], $missing, 'texts used with __() but missing in locales/en.php');
+		// 'Home' is the value of DEFAULT_PAGE, which is looked up with __(DEFAULT_PAGE)
+		return array_values(array_unique(array_merge(self::usedKeys(), ['Home'], array_keys(self::load(self::ROOT_LOCALE)))));
+	}
+
+	public function testEnglishOnlyHasEntriesWhichDifferFromTheirKey(): void
+	{
+		// __() returns the key for texts without entry, so identical entries only need to be maintained
+		foreach (self::load(self::ROOT_LOCALE) as $key => $value) {
+			$this->assertNotSame($key, $value, "'$key' is shown as it is without an entry in locales/en.php");
+		}
 	}
 
 	public function testExtractionFindsTheTextsOfTheCode(): void
@@ -165,8 +174,7 @@ public function testExtractionFindsTheTextsOfTheCode(): void
 	public function testNoUnknownTexts(string $locale): void
 	{
 		// e.g. a text of the code was renamed or has a typo (then it's never used)
-		$known = array_merge(self::usedKeys(), array_keys(self::load(self::ROOT_LOCALE)), ['imgDelete', 'imgRename']);
-		$unknown = array_values(array_diff(array_keys(self::load($locale)), $known));
+		$unknown = array_values(array_diff(array_keys(self::load($locale)), self::knownKeys()));
 		$this->assertSame([], $unknown, "texts of locales/$locale.php which are not used in the code");
 	}
 
@@ -177,9 +185,9 @@ public function testMissingTranslationsAreReported(string $locale): void
 			$this->addToAssertionCount(1);
 			return;
 		}
-		$missing = array_values(array_diff(array_keys(self::load(self::ROOT_LOCALE)), array_keys(self::load($locale))));
+		$missing = array_values(array_diff(self::knownKeys(), array_keys(self::load($locale))));
 		if ($missing) {
-			$this->markTestIncomplete(count($missing) . " texts of locales/en.php are not translated in locales/$locale.php (the English text is shown): " . implode(', ', $missing));
+			$this->markTestIncomplete(count($missing) . " texts of the code are not translated in locales/$locale.php (the English text is shown): " . implode(', ', $missing));
 		}
 		$this->addToAssertionCount(1);
 	}

From 57f329f4532617c3888db2c42d8b646fd99ffd72 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sat, 3 Oct 2026 21:08:21 +0000
Subject: [PATCH 3/5] Translate remaining UI texts: list headers, Cancel,
 search heading, git message label, upload alerts, page errors

Adds __js() for texts in inline scripts, German translations, and tests that
check these texts for every locale.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UnF3JNHe2m9RQM1BRKdBMY
---
 functions.php                    | 11 +++++++
 index.php                        | 24 ++++++++--------
 locales/de.php                   |  7 +++++
 tests/Integration/LocaleTest.php | 49 ++++++++++++++++++++++++++++++++
 tests/Unit/LocaleFilesTest.php   |  2 +-
 5 files changed, 80 insertions(+), 13 deletions(-)

diff --git a/functions.php b/functions.php
index bf19c2d..b3f6ced 100644
--- a/functions.php
+++ b/functions.php
@@ -51,6 +51,17 @@ function __( $label, $alt_word = null )
 	return h($w2_word_set[$label]);
 }
 
+/**
+ * Get translated word as a JavaScript string literal (with quotes), for inline scripts
+ *
+ * String	$label		Key for locale word
+ * return	String
+ */
+function __js( $label )
+{
+	return json_encode(html_entity_decode(__($label), ENT_QUOTES | ENT_HTML5, W2_CHARSET), JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_UNESCAPED_UNICODE);
+}
+
 function descLengthSort($val_1, $val_2)
 {
 	$firstVal = strlen($val_1);
diff --git a/index.php b/index.php
index 4d0ac5e..ddd5da0 100644
--- a/index.php
+++ b/index.php
@@ -291,8 +291,8 @@ function destroy_session()
 	if ($isNew && (file_exists($filename) || !isValidPageName($page)))
 	{
 		$msg .= file_exists($filename)
-			? "Error creating page '".h($page)."' - it already exists! Please choose a different name, or <a href=\"?action=edit&amp;page=".urlencode($page)."\">edit</a> the existing page (this discards current text!)!\n"
-			: "Error creating page '".h($page)."' - invalid page name! Page names must not start with '".UPLOAD_FOLDER."/', or contain empty or hidden ('.'-prefixed) folder names.\n";
+			? sprintf(__("Error creating page '%s' - it already exists! Please choose a different name, or %s the existing page (this discards current text!)!"), h($page), "<a href=\"?action=edit&amp;page=".urlencode($page)."\">".__('edit')."</a>")."\n"
+			: sprintf(__("Error creating page '%s' - invalid page name! Page names must not start with '%s/', or contain empty or hidden ('.'-prefixed) folder names."), h($page), h(UPLOAD_FOLDER))."\n";
 		$action = 'new';
 		$text = $newText;
 		$newPage = $page;
@@ -311,7 +311,7 @@ function destroy_session()
 		$success = file_put_contents($filename, $newText);
 		if ( $success === FALSE)
 		{
-			$msg .= "Error saving changes! Make sure your web server has write access to the pages folder.\n";
+			$msg .= __('Error saving changes! Make sure your web server has write access to the pages folder.')."\n";
 			error_log("W2: error saving $filename");
 			$action = ($isNew ? 'new' : 'edit');
 			$text = $newText;
@@ -373,7 +373,7 @@ function destroy_session()
 	$html .= "<p><textarea id=\"text\" name=\"newText\" rows=\"" . EDIT_ROWS . "\" autocomplete=\"off\" autocorrect=\"off\" autocapitalize=\"off\" spellcheck=\"false\">".h($text)."</textarea></p>\n";
 	if (GIT_COMMIT_ENABLED)
 	{
-		$html .= "<p>Message: <input type=\"text\" id=\"gitmsg\" name=\"gitmsg\" value=\"".h($oldgitmsg)."\" /></p>\n";
+		$html .= "<p>".__('Message').": <input type=\"text\" id=\"gitmsg\" name=\"gitmsg\" value=\"".h($oldgitmsg)."\" /></p>\n";
 	}
 
 	$html .= "<p><input type=\"hidden\" name=\"action\" value=\"save\" />\n";
@@ -417,14 +417,14 @@ function destroy_session()
 			'function processForm(e) {'."\n".
 			'    e.preventDefault();'."\n".
 			'    var fileInput = document.getElementById("file");'."\n".
-			'    if (fileInput.files.length == 0) { alert("No file selected!"); return; }'."\n".
+			'    if (fileInput.files.length == 0) { alert('.__js('No file selected!').'); return; }'."\n".
 			'    var filename = fileInput.files[0].name;'."\n".
 			'    fetch("'.BASE_URI.'/api.php?task=checkupload&filename="+encodeURIComponent(filename))'."\n".
 			'        .then((response) => {'."\n".
 			'            response.json().then((data) => {'."\n".
 			'                upload = true;'."\n".
 			'                if (data) {'."\n".
-			'                     upload = window.confirm("File "+filename+" already exists. Overwrite?");'."\n".
+			'                     upload = window.confirm('.__js('File %s already exists. Overwrite?').'.replace("%s", () => filename));'."\n".
 			'                }'."\n".
 			'                if (upload) {'."\n".
 			'                    document.getElementById("overwrite").value = data ? "true" : "";'."\n".
@@ -490,10 +490,10 @@ function destroy_session()
 
 	$html .= "<table><thead>";
 	$html .= "<tr>".
-		"<th>".(($sortBy!='name')?("<a href=\"".SELF."?action=upload&sortBy=name\">Name</a>"):"<span class=\"sortBy\">Name</span>")."</th>".
+		"<th>".(($sortBy!='name')?("<a href=\"".SELF."?action=upload&sortBy=name\">".__('Name')."</a>"):"<span class=\"sortBy\">".__('Name')."</span>")."</th>".
 		"<th>".__("Usage")."</th>".
-		"<th>".(($sortBy!='recent')?("<a href=\"".SELF."?action=upload&sortBy=recent\">Modified</a>"):"<span class=\"sortBy\">Modified</span>")."</th>".
-		"<th>".(($sortBy!='size')?("<a href=\"".SELF."?action=upload&sortBy=size\">Size</a>"):"<span class=\"sortBy\">Size</span>")."</th>".
+		"<th>".(($sortBy!='recent')?("<a href=\"".SELF."?action=upload&sortBy=recent\">".__('Modified')."</a>"):"<span class=\"sortBy\">".__('Modified')."</span>")."</th>".
+		"<th>".(($sortBy!='size')?("<a href=\"".SELF."?action=upload&sortBy=size\">".__('Size')."</a>"):"<span class=\"sortBy\">".__('Size')."</span>")."</th>".
 		"<th>".__("Action")."</th>";
 	if (SHOW_PAGES_WHERE_FILE_USED)
 	{
@@ -715,7 +715,7 @@ function destroy_session()
 			: "?")
 		. "</p>";
 	$html .= "<p><input id=\"$action\" type=\"submit\" value=\"$actionName\">";
-	$html .= "<input id=\"cancel\" type=\"button\" onclick=\"history.go(-1);\" value=\"Cancel\" />\n";
+	$html .= "<input id=\"cancel\" type=\"button\" onclick=\"history.go(-1);\" value=\"".__('Cancel')."\" />\n";
 	$html .= "<input type=\"hidden\" name=\"action\" value=\"{$action}d\" />";
 	$html .= "<input type=\"hidden\" name=\"oldPageName\" value=\"" . h($page) . "\" />";
 	if ($action === 'imgDelete' || $action === 'imgRename')
@@ -889,7 +889,7 @@ function destroy_session()
 	$html .= "<p>".__('Total').": ".count($pageNames)." ".__("pages")."</p>";
 	$html .= "<table><thead>";
 	$html .= "<tr>".
-		"<th>".(($sortBy!='name')?("<a href=\"".SELF."?action=all&sortBy=name\">Name</a>"):"<span class=\"sortBy\">".__('Name')."</span>")."</th>".
+		"<th>".(($sortBy!='name')?("<a href=\"".SELF."?action=all&sortBy=name\">".__('Name')."</a>"):"<span class=\"sortBy\">".__('Name')."</span>")."</th>".
 		"<th>".(($sortBy!='recent')?("<a href=\"".SELF."?action=all&sortBy=recent\">".__('Modified')."</a>"):"<span class=\"sortBy\">".__('Modified')."</span>")."</th>".
 		"<th>".(($sortBy!='size')?("<a href=\"".SELF."?action=all&sortBy=size\">".__('Size')."</a>"):"<span class=\"sortBy\">".__('Size')."</span>")."</th>".
 		"<th>".__('Action')."</th>".
@@ -911,7 +911,7 @@ function destroy_session()
 {
 	$matches = 0;
 	$q = $_REQUEST['q'];
-	$html .= "    <h1>Search: ".h($q)."</h1>\n";
+	$html .= "    <h1>".__('Search').": ".h($q)."</h1>\n";
 
 	if ( trim($q) != "" )
 	{
diff --git a/locales/de.php b/locales/de.php
index 8ed900e..aca09ba 100644
--- a/locales/de.php
+++ b/locales/de.php
@@ -69,6 +69,13 @@
 	'Restored unsaved draft from %s.' => 'Ungespeicherter Entwurf vom %s wiederhergestellt.',
 	'Warning: the page was changed since this draft was started.' => 'Achtung: Die Seite wurde geändert, seit dieser Entwurf begonnen wurde.',
 	'Discard draft' => 'Entwurf verwerfen',
+	'Message' => 'Nachricht',
+	'edit' => 'bearbeite',
+	'No file selected!' => 'Keine Datei ausgewählt!',
+	'File %s already exists. Overwrite?' => 'Die Datei %s existiert bereits. Überschreiben?',
+	"Error creating page '%s' - it already exists! Please choose a different name, or %s the existing page (this discards current text!)!" => "Fehler beim Anlegen der Seite '%s' - sie existiert bereits! Bitte wähle einen anderen Namen oder %s die bestehende Seite (der aktuelle Text geht dabei verloren!)!",
+	"Error creating page '%s' - invalid page name! Page names must not start with '%s/', or contain empty or hidden ('.'-prefixed) folder names." => "Fehler beim Anlegen der Seite '%s' - ungültiger Seitenname! Seitennamen dürfen nicht mit '%s/' beginnen und keine leeren oder versteckten (mit '.' beginnenden) Ordnernamen enthalten.",
+	'Error saving changes! Make sure your web server has write access to the pages folder.' => 'Fehler beim Speichern der Änderungen! Stelle sicher, dass der Webserver Schreibzugriff auf den Seitenordner hat.',
 	// Override TITLE_DATE and TITLE_DATE_NO_TIME if set.
 	'date_format'         => 'd.m.Y H:i',
 	'date_format_no_time' => 'd.m.Y',
diff --git a/tests/Integration/LocaleTest.php b/tests/Integration/LocaleTest.php
index 27be677..da749cc 100644
--- a/tests/Integration/LocaleTest.php
+++ b/tests/Integration/LocaleTest.php
@@ -98,4 +98,53 @@ public function testTitlesAndDatesUseTheLocale(string $locale): void
 			$this->assertMatchesRegularExpression('/<span class="titledate">[^<]+<\/span>/', $page);
 		}
 	}
+
+	private static function text(array $words, string $key): string
+	{
+		return htmlspecialchars($words[$key] ?? $key, ENT_QUOTES, 'UTF-8');
+	}
+
+	#[DataProvider('locales')]
+	public function testListHeadersAndFormButtonsAreTranslated(string $locale): void
+	{
+		$words = self::words($locale);
+		foreach (['/index.php?action=upload', '/index.php?action=all'] as $url) {
+			$body = $this->http->get($url)->body;
+			foreach (['Name', 'Modified', 'Size'] as $key) {
+				$this->assertStringContainsString('>' . self::text($words, $key) . '</', $body, "$locale: $url $key");
+			}
+		}
+		$this->assertStringContainsString('value="' . self::text($words, 'Cancel') . '"', $this->http->get('/index.php?action=delete&page=Home')->body);
+		$this->assertStringContainsString('<h1>' . self::text($words, 'Search') . ': home</h1>', $this->http->get('/index.php?action=search&q=home')->body);
+	}
+
+	#[DataProvider('locales')]
+	public function testUploadScriptMessagesAreTranslated(string $locale): void
+	{
+		$words = self::words($locale);
+		$body = $this->http->get('/index.php?action=upload')->body;
+		foreach (['No file selected!', 'File %s already exists. Overwrite?'] as $key) {
+			$literal = json_encode($words[$key] ?? $key, JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_UNESCAPED_UNICODE);
+			$this->assertStringContainsString($literal, $body, "$locale: $key");
+		}
+	}
+
+	#[DataProvider('locales')]
+	public function testPageCreationErrorsAreTranslated(string $locale): void
+	{
+		$words = self::words($locale);
+		$existing = $this->savePage('Home', 'again')->body;
+		$key = "Error creating page '%s' - it already exists! Please choose a different name, or %s the existing page (this discards current text!)!";
+		$this->assertStringContainsString(
+			sprintf(self::text($words, $key), 'Home', '<a href="?action=edit&amp;page=Home">' . self::text($words, 'edit') . '</a>'),
+			$existing,
+			$locale
+		);
+		$key = "Error creating page '%s' - invalid page name! Page names must not start with '%s/', or contain empty or hidden ('.'-prefixed) folder names.";
+		$this->assertStringContainsString(
+			sprintf(self::text($words, $key), '.hidden/x', 'images'),
+			$this->savePage('.hidden/x', 'text')->body,
+			$locale
+		);
+	}
 }
diff --git a/tests/Unit/LocaleFilesTest.php b/tests/Unit/LocaleFilesTest.php
index 8265ccb..d8a4703 100644
--- a/tests/Unit/LocaleFilesTest.php
+++ b/tests/Unit/LocaleFilesTest.php
@@ -45,7 +45,7 @@ private static function usedKeys(): array
 			));
 			foreach ($tokens as $i => $token) {
 				$previous = $tokens[$i - 1] ?? '';
-				if (is_array($token) && $token[0] === T_STRING && $token[1] === '__' && ($tokens[$i + 1] ?? '') === '('
+				if (is_array($token) && $token[0] === T_STRING && in_array($token[1], ['__', '__js'], true) && ($tokens[$i + 1] ?? '') === '('
 					&& !(is_array($previous) && $previous[0] === T_FUNCTION)
 					&& is_array($tokens[$i + 2] ?? null) && $tokens[$i + 2][0] === T_CONSTANT_ENCAPSED_STRING) {
 					$keys[] = eval('return ' . $tokens[$i + 2][1] . ';');

From 4754f2623c1c46d6d1b188020b9ab308df47e3b1 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sat, 3 Oct 2026 21:13:28 +0000
Subject: [PATCH 4/5] Translate the remaining UI texts: upload results, notes,
 rejected requests, IP and git errors

Adds German translations and per-locale tests for these texts.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UnF3JNHe2m9RQM1BRKdBMY
---
 auth.php                         |  4 ++-
 index.php                        | 40 ++++++++++++++---------------
 locales/de.php                   | 22 ++++++++++++++++
 tests/Integration/LocaleTest.php | 43 ++++++++++++++++++++++++++++++++
 4 files changed, 88 insertions(+), 21 deletions(-)

diff --git a/auth.php b/auth.php
index 1f5ad8a..0ef6fbf 100644
--- a/auth.php
+++ b/auth.php
@@ -40,7 +40,9 @@
 	if ( !$accepted )
 	{
 		http_response_code(403);
-		print "<html><body>Access from IP address ".htmlspecialchars($ip)." is not allowed</body></html>";
+		// (api.php doesn't load the locale)
+		$text = function_exists('__') ? __('Access from IP address %s is not allowed') : 'Access from IP address %s is not allowed';
+		print "<html><body>" . sprintf($text, htmlspecialchars($ip)) . "</body></html>";
 		exit;
 	}
 }
diff --git a/index.php b/index.php
index ddd5da0..9f61a19 100644
--- a/index.php
+++ b/index.php
@@ -128,7 +128,7 @@ function printDrawer()
 		}
 		if ( (!defined('W2_PASSWORD_HASH') || W2_PASSWORD_HASH === '') && defined('W2_PASSWORD') && W2_PASSWORD === 'secret' )
 		{
-			print "    <p class=\"note\">Login is disabled while the default password is configured; please set W2_PASSWORD_HASH (or W2_PASSWORD) in config.php.</p>\n";
+			print "    <p class=\"note\">" . __('Login is disabled while the default password is configured; please set W2_PASSWORD_HASH (or W2_PASSWORD) in config.php.') . "</p>\n";
 		}
 		print "    <form method=\"post\">\n";
 		print "      ".__('Password') . ": <input type=\"password\" name=\"p\">\n";
@@ -174,7 +174,7 @@ function checkedExecute(&$msg, $cmd)
 	{
 		// details (command, output) may reveal server internals, so only log them
 		error_log("W2: error executing command $cmd (return value: $returnValue): ".implode(" ", $output));
-		$msg .= "<br/>Error executing git command (return value: ".$returnValue."); see the web server's error log for details.";
+		$msg .= "<br/>".sprintf(__("Error executing git command (return value: %s); see the web server's error log for details."), h($returnValue));
 	}
 	return ($returnValue == 0);
 }
@@ -221,7 +221,7 @@ function destroy_session()
 	($_SERVER['REQUEST_METHOD'] !== 'POST' || !isValidCSRFToken($_POST['csrf_token'] ?? null)))
 {
 	http_response_code(403);
-	die('Invalid request: missing or wrong security token. Please go back, reload the page and try again.');
+	die(__('Invalid request: missing or wrong security token. Please go back, reload the page and try again.'));
 }
 if ($action === 'logout' && !isValidCSRFToken($_GET['csrf_token'] ?? null))
 {
@@ -269,7 +269,7 @@ function destroy_session()
 		{
 			$basePage = basename($p);
 			if ($basePage == $page) {
-				redirectWithMessage($p, "Page ".h($page)." does not exist, redirected instead to first page in a subfolder with matching filename (".h($p).")");
+				redirectWithMessage($p, sprintf(__("Page %s does not exist, redirected instead to first page in a subfolder with matching filename (%s)"), h($page), h($p)));
 			}
 		}
 		$newPage = $page;
@@ -361,7 +361,7 @@ function destroy_session()
 			{
 				if (levenshtein(strtoupper($newPage), strtoupper($pageName)) < sqrt(min(strlen($newPage), strlen($pageName))) )
 				{
-					$html .= "<br/><strong>Note:</strong> Found similar page ".pageLink($pageName, h($pageName)).". Maybe you meant to edit this instead?";
+					$html .= "<br/><strong>".__('Note').":</strong> ".sprintf(__('Found similar page %s. Maybe you meant to edit this instead?'), pageLink($pageName, h($pageName)));
 				}
 			}
 			$html .= "</div>\n";
@@ -541,7 +541,7 @@ function destroy_session()
 {
 	if ( DISABLE_UPLOADS )
 	{
-		die('Invalid access. Uploads are disabled in the configuration.');
+		die(__('Invalid access. Uploads are disabled in the configuration.'));
 	}
 	$uploadError = $_FILES['userfile']['error'] ?? UPLOAD_ERR_NO_FILE;
 	if ( $uploadError === UPLOAD_ERR_INI_SIZE || $uploadError === UPLOAD_ERR_FORM_SIZE )
@@ -586,12 +586,12 @@ function destroy_session()
 		}
 		if ( file_exists($finalPath) && ($_POST['overwrite'] ?? '') !== 'true' )
 		{
-			$msg .= __('Upload error').": ".h(basename($finalPath))." already exists!";
+			$msg .= __('Upload error').": ".sprintf(__('%s already exists!'), h(basename($finalPath)));
 		}
 		else if ( ($svgData !== null) ? (file_put_contents($path, $svgData) !== false) : (move_uploaded_file($tmpName, $path) === true) )
 		{
 			$commitMsg = "File '$dstName' uploaded!";
-			$msg .= h($commitMsg)." ";
+			$msg .= sprintf(__("File '%s' uploaded!"), h($dstName))." ";
 			$processFailed = false;
 			if ($doProcess)
 			{
@@ -614,11 +614,11 @@ function destroy_session()
 						try
 						{
 							$img->resizeImage($newSize[0], $newSize[1], imagick::FILTER_LANCZOS, 1);
-							$msg .= "Original size was $size[0]x$size[1], resized to $newSize[0]x$newSize[1]. ";
+							$msg .= sprintf(__('Original size was %s, resized to %s.'), "$size[0]x$size[1]", "$newSize[0]x$newSize[1]")." ";
 						}
 						catch (ImagickException $e)
 						{
-							$msg .= "Resizing file failed! ";
+							$msg .= __('Resizing file failed!')." ";
 						}
 					}
 					$ori = $img->getImageOrientation();
@@ -627,15 +627,15 @@ function destroy_session()
 						switch($ori)
 						{
 						case imagick::ORIENTATION_RIGHTTOP:
-							$msg .= "Image rotated by +90°. ";
+							$msg .= sprintf(__('Image rotated by %s°.'), '+90')." ";
 							$img->rotateImage('#000',90);
 							break;
 						case imagick::ORIENTATION_BOTTOMRIGHT:
-							$msg .= "Image rotated by 180°. ";
+							$msg .= sprintf(__('Image rotated by %s°.'), '180')." ";
 							$img->rotateImage('#000',180);
 							break;
 						case imagick:: ORIENTATION_LEFTBOTTOM:
-							$msg .= "Image rotated by -90°. ";
+							$msg .= sprintf(__('Image rotated by %s°.'), '-90')." ";
 							$img->rotateImage('#000',-90);
 							break;
 //						default:
@@ -648,7 +648,7 @@ function destroy_session()
 					{
 						$dstName = substr($dstName, 0, strlen($dstName)-strlen($fileExt)).CONVERT_FORMAT;
 						$img->setImageFormat(CONVERT_FORMAT);
-						$msg .= "Converted to format ".CONVERT_FORMAT.". ";
+						$msg .= sprintf(__('Converted to format %s.'), h(CONVERT_FORMAT))." ";
 					}
 					$img->writeImage($finalPath);
 					unlink($path);
@@ -663,14 +663,14 @@ function destroy_session()
 						unlink($path);
 					}
 					$processFailed = true;
-					$msg = __('Upload error').": ".h($dstName)." could not be processed (is it a valid image?)";
+					$msg = __('Upload error').": ".sprintf(__('%s could not be processed (is it a valid image?)'), h($dstName));
 				}
 			}
 
 			if (!$processFailed)
 			{
 				gitChangeHandler($commitMsg, $msg);
-				$msg .= "Use <pre>".h(imageLinkText($dstName))."</pre> to refer to it!";
+				$msg .= sprintf(__('Use %s to refer to it!'), "<pre>".h(imageLinkText($dstName))."</pre>");
 			}
 		}
 		else
@@ -680,15 +680,15 @@ function destroy_session()
 			{
 				// Likely a permissions issue
 				error_log("W2: can't write upload to $path");
-				$msg .= __('Upload error') .": Can't write to the uploads folder<br/><br/>\n".
-					"Check that your permissions are set correctly.";
+				$msg .= __('Upload error') .": ".__("Can't write to the uploads folder")."<br/><br/>\n".
+					__('Check that your permissions are set correctly.');
 			}
 			else
 			{
 				// Give generic error message
 				$msg .= __('Upload error').", error #".$error_code."<br/><br/>\n".
-					"Please see <a href=\"https://www.php.net/manual/en/features.file-upload.errors.php\">here</a> for more information.<br/><br/>\n".
-					"If you see this message, please <a href=\"https://github.com/codeling/w2wiki/issues\">file a bug to improve w2wiki</a>";
+					sprintf(__('Please see %s for more information.'), "<a href=\"https://www.php.net/manual/en/features.file-upload.errors.php\">".__('here')."</a>")."<br/><br/>\n".
+					sprintf(__('If you see this message, please %s'), "<a href=\"https://github.com/codeling/w2wiki/issues\">".__('file a bug to improve w2wiki')."</a>");
 			}
 		}
 	}
diff --git a/locales/de.php b/locales/de.php
index aca09ba..d397947 100644
--- a/locales/de.php
+++ b/locales/de.php
@@ -76,6 +76,28 @@
 	"Error creating page '%s' - it already exists! Please choose a different name, or %s the existing page (this discards current text!)!" => "Fehler beim Anlegen der Seite '%s' - sie existiert bereits! Bitte wähle einen anderen Namen oder %s die bestehende Seite (der aktuelle Text geht dabei verloren!)!",
 	"Error creating page '%s' - invalid page name! Page names must not start with '%s/', or contain empty or hidden ('.'-prefixed) folder names." => "Fehler beim Anlegen der Seite '%s' - ungültiger Seitenname! Seitennamen dürfen nicht mit '%s/' beginnen und keine leeren oder versteckten (mit '.' beginnenden) Ordnernamen enthalten.",
 	'Error saving changes! Make sure your web server has write access to the pages folder.' => 'Fehler beim Speichern der Änderungen! Stelle sicher, dass der Webserver Schreibzugriff auf den Seitenordner hat.',
+	'Note' => 'Hinweis',
+	'Found similar page %s. Maybe you meant to edit this instead?' => 'Ähnliche Seite gefunden: %s. Vielleicht wolltest du stattdessen diese bearbeiten?',
+	"Page %s does not exist, redirected instead to first page in a subfolder with matching filename (%s)" => "Die Seite %s existiert nicht, stattdessen wurde auf die erste Seite in einem Unterordner mit passendem Dateinamen weitergeleitet (%s)",
+	'Login is disabled while the default password is configured; please set W2_PASSWORD_HASH (or W2_PASSWORD) in config.php.' => 'Das Einloggen ist gesperrt, solange das Standardpasswort eingestellt ist; bitte setze W2_PASSWORD_HASH (oder W2_PASSWORD) in config.php.',
+	'Invalid request: missing or wrong security token. Please go back, reload the page and try again.' => 'Ungültige Anfrage: Das Sicherheitstoken fehlt oder ist falsch. Bitte gehe zurück, lade die Seite neu und versuche es erneut.',
+	'Invalid access. Uploads are disabled in the configuration.' => 'Ungültiger Zugriff. Hochladen ist in der Konfiguration deaktiviert.',
+	"Error executing git command (return value: %s); see the web server's error log for details." => "Fehler beim Ausführen des git-Befehls (Rückgabewert: %s); Details stehen im Fehlerprotokoll des Webservers.",
+	'Access from IP address %s is not allowed' => 'Zugriff von der IP-Adresse %s ist nicht erlaubt',
+	'%s already exists!' => '%s existiert bereits!',
+	"File '%s' uploaded!" => "Datei '%s' hochgeladen!",
+	'Original size was %s, resized to %s.' => 'Ursprüngliche Größe war %s, verkleinert auf %s.',
+	'Resizing file failed!' => 'Verkleinern der Datei fehlgeschlagen!',
+	'Image rotated by %s°.' => 'Bild um %s° gedreht.',
+	'Converted to format %s.' => 'In das Format %s umgewandelt.',
+	'%s could not be processed (is it a valid image?)' => '%s konnte nicht verarbeitet werden (ist es ein gültiges Bild?)',
+	'Use %s to refer to it!' => 'Verwende %s, um darauf zu verweisen!',
+	"Can't write to the uploads folder" => 'Der Upload-Ordner ist nicht beschreibbar',
+	'Check that your permissions are set correctly.' => 'Prüfe, ob die Berechtigungen richtig gesetzt sind.',
+	'Please see %s for more information.' => 'Weitere Informationen stehen %s.',
+	'here' => 'hier',
+	'If you see this message, please %s' => 'Wenn du diese Meldung siehst, bitte %s',
+	'file a bug to improve w2wiki' => 'melde einen Fehler, um w2wiki zu verbessern',
 	// Override TITLE_DATE and TITLE_DATE_NO_TIME if set.
 	'date_format'         => 'd.m.Y H:i',
 	'date_format_no_time' => 'd.m.Y',
diff --git a/tests/Integration/LocaleTest.php b/tests/Integration/LocaleTest.php
index da749cc..52651b4 100644
--- a/tests/Integration/LocaleTest.php
+++ b/tests/Integration/LocaleTest.php
@@ -147,4 +147,47 @@ public function testPageCreationErrorsAreTranslated(string $locale): void
 			$locale
 		);
 	}
+
+	#[DataProvider('locales')]
+	public function testUploadMessagesAreTranslated(string $locale): void
+	{
+		$words = self::words($locale);
+		$upload = fn() => $this->upload('a.gif', self::gif());
+		$note = $this->noteAfter($upload());
+		$this->assertStringContainsString(html_entity_decode(sprintf(self::text($words, "File '%s' uploaded!"), 'a.gif'), ENT_QUOTES), $note, $locale);
+		$this->assertStringContainsString(
+			html_entity_decode(sprintf(self::text($words, 'Use %s to refer to it!'), '![' . ($words['Image Description'] ?? 'Image Description') . '](/images/a.gif)'), ENT_QUOTES),
+			$note,
+			$locale
+		);
+		$note = $this->noteAfter($upload());
+		$this->assertStringContainsString(html_entity_decode(sprintf(self::text($words, '%s already exists!'), 'a.gif'), ENT_QUOTES), $note, $locale);
+	}
+
+	#[DataProvider('locales')]
+	public function testSimilarPageNoteIsTranslated(string $locale): void
+	{
+		$words = self::words($locale);
+		$this->savePage('Similar Page', 'x');
+		$body = $this->http->get($this->pageUrl('Simular Page'))->body;
+		$this->assertStringContainsString('<strong>' . self::text($words, 'Note') . ':</strong>', $body, $locale);
+		$this->assertStringContainsString(
+			sprintf(self::text($words, 'Found similar page %s. Maybe you meant to edit this instead?'), '<a href="/index.php/Similar%20Page">Similar Page</a>'),
+			$body,
+			$locale
+		);
+	}
+
+	#[DataProvider('locales')]
+	public function testMessagesOfRejectedRequestsAreTranslated(string $locale): void
+	{
+		$words = self::words($locale);
+		$response = $this->http->post('/index.php', ['action' => 'save', 'page' => 'X', 'newText' => 'x']);
+		$this->assertSame(403, $response->status);
+		$this->assertStringContainsString(
+			self::text($words, 'Invalid request: missing or wrong security token. Please go back, reload the page and try again.'),
+			$response->body,
+			$locale
+		);
+	}
 }

From 9f314d1ca55243e0ef56e33f02f7f8491f81c389 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sat, 3 Oct 2026 21:19:25 +0000
Subject: [PATCH 5/5] Translate the examples of the Markdown help

Also fixes the underscore emphasis example, which was closed with an asterisk.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UnF3JNHe2m9RQM1BRKdBMY
---
 index.php                        | 28 ++++++++++++++--------------
 locales/de.php                   | 10 ++++++++++
 tests/Integration/LocaleTest.php | 21 +++++++++++++++++++++
 3 files changed, 45 insertions(+), 14 deletions(-)

diff --git a/index.php b/index.php
index 9f61a19..6b7a174 100644
--- a/index.php
+++ b/index.php
@@ -68,26 +68,26 @@ function printDrawer()
 		"###### ".__('Header')." 6<br/>".
 		"<br/>".
 		"*".__('Emphasize')."* - <em>".__('Emphasize')."</em><br/>".
-		"_".__('Emphasize')."* - <em>".__('Emphasize')."</em><br/>".
+		"_".__('Emphasize')."_ - <em>".__('Emphasize')."</em><br/>".
 		"**".__('Bold')."** - <strong>".__('Bold')."</strong><br/>".
 		"__".__('Bold')."__ - <strong>".__('Bold')."</strong><br/>".
 		"<br/>".
-		"[[Link to page]]<br/>".
+		"[[".__('Link to page')."]]<br/>".
 		"&lt;http://example.com/&gt;<br/>".
-		"[link text](http://url)<br/><br/>".
-		"![Alt text](/images/image.jpg)<br/>".
-		"![Alt text](/images/image.jpg \"Optional title\")<br/>".
+		"[".__('link text')."](http://url)<br/><br/>".
+		"![".__('Alt text')."](/images/image.jpg)<br/>".
+		"![".__('Alt text')."](/images/image.jpg \"".__('Optional title')."\")<br/>".
 		"<br/>".
-		"- Unordered list<br/>".
-		"+ Unordered list<br/>".
-		"* Unordered list<br/>".
-		"1. Ordered list<br/>".
+		"- ".__('Unordered list')."<br/>".
+		"+ ".__('Unordered list')."<br/>".
+		"* ".__('Unordered list')."<br/>".
+		"1. ".__('Ordered list')."<br/>".
 		"<br/>".
-		"> Blockquote<br/>".// <blockquote>Blockquotes</blockquote>\n".
-		"```Code```<br/>". //<pre>Code</pre>\n\n".
-		"`inline-code`<br/><br/>".
-		"*** Horizontal rule<br/>".
-		"--- Horizontal rule<br/>\n".
+		"> ".__('Blockquote')."<br/>".
+		"```".__('Code')."```<br/>".
+		"`".__('Inline code')."`<br/><br/>".
+		"*** ".__('Horizontal rule')."<br/>".
+		"--- ".__('Horizontal rule')."<br/>\n".
 		"        </div>\n".
 		"      </div>\n".
 		"      <a id=\"drawer-control\" href=\"\" onclick=\"toggleDrawer(); return false;\">\n".
diff --git a/locales/de.php b/locales/de.php
index d397947..7a4d74f 100644
--- a/locales/de.php
+++ b/locales/de.php
@@ -98,6 +98,16 @@
 	'here' => 'hier',
 	'If you see this message, please %s' => 'Wenn du diese Meldung siehst, bitte %s',
 	'file a bug to improve w2wiki' => 'melde einen Fehler, um w2wiki zu verbessern',
+	'Link to page' => 'Link auf Seite',
+	'link text' => 'Linktext',
+	'Alt text' => 'Alternativtext',
+	'Optional title' => 'Optionaler Titel',
+	'Unordered list' => 'Aufzählung',
+	'Ordered list' => 'Nummerierte Liste',
+	'Blockquote' => 'Zitat',
+	'Code' => 'Code',
+	'Inline code' => 'Code im Text',
+	'Horizontal rule' => 'Horizontale Linie',
 	// Override TITLE_DATE and TITLE_DATE_NO_TIME if set.
 	'date_format'         => 'd.m.Y H:i',
 	'date_format_no_time' => 'd.m.Y',
diff --git a/tests/Integration/LocaleTest.php b/tests/Integration/LocaleTest.php
index 52651b4..aec8db8 100644
--- a/tests/Integration/LocaleTest.php
+++ b/tests/Integration/LocaleTest.php
@@ -190,4 +190,25 @@ public function testMessagesOfRejectedRequestsAreTranslated(string $locale): voi
 			$locale
 		);
 	}
+
+	#[DataProvider('locales')]
+	public function testMarkdownHelpExamplesAreTranslated(string $locale): void
+	{
+		$words = self::words($locale);
+		$body = $this->http->get('/index.php?action=edit&page=Home')->body;
+		$expected = [
+			'[[' . self::text($words, 'Link to page') . ']]',
+			'[' . self::text($words, 'link text') . '](http://url)',
+			'![' . self::text($words, 'Alt text') . '](/images/image.jpg "' . self::text($words, 'Optional title') . '")',
+			'- ' . self::text($words, 'Unordered list') . '<br/>',
+			'1. ' . self::text($words, 'Ordered list') . '<br/>',
+			'```' . self::text($words, 'Code') . '```',
+			'`' . self::text($words, 'Inline code') . '`',
+			'--- ' . self::text($words, 'Horizontal rule') . '<br/>',
+		];
+		foreach ($expected as $text) {
+			// (quotes are escaped by __(), the example title is in quotes of the markup)
+			$this->assertStringContainsString(str_replace('&quot;', '"', $text), str_replace('&quot;', '"', $body), $locale);
+		}
+	}
 }