jenkins-bot has submitted this change and it was merged.
Change subject: SECURITY: Escape thread subject on history page
......................................................................
SECURITY: Escape thread subject on history page
Prevent users from being able to have other people's browsers (e.g.) run
malicious scripts
Bug: 53320
Change-Id: I2b74a412fc260f67adfde859d83653e81b457963
(cherry picked from commit fc1672e4cf373dc29fe84c50cc5ff03f45da7dee)
---
M pages/TalkpageHistoryView.php
1 file changed, 1 insertion(+), 1 deletion(-)
Approvals:
Siebrand: Looks good to me, approved
jenkins-bot: Verified
diff --git a/pages/TalkpageHistoryView.php b/pages/TalkpageHistoryView.php
index afdb1bf..c8e2f36 100644
--- a/pages/TalkpageHistoryView.php
+++ b/pages/TalkpageHistoryView.php
@@ -101,7 +101,7 @@
$link = $linker->link(
$title,
- $value,
+ htmlspecialchars( $value ),
array(),
array(),
array( 'known' )
--
To view, visit https://gerrit.wikimedia.org/r/82574
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: merged
Gerrit-Change-Id: I2b74a412fc260f67adfde859d83653e81b457963
Gerrit-PatchSet: 1
Gerrit-Project: mediawiki/extensions/LiquidThreads
Gerrit-Branch: REL1_19
Gerrit-Owner: CSteipp <[email protected]>
Gerrit-Reviewer: Alex Monk <[email protected]>
Gerrit-Reviewer: Siebrand <[email protected]>
Gerrit-Reviewer: jenkins-bot
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
