T395622.patch
Daimona
Actions

Authored By

	Daimona
	May 29 2025, 9:24 PM

Size

1 KB

Referenced Files

None

Subscribers

None

T395622.patch
View Options

	From 1ea145eb335ff10fb83c9f35ac2d6e31df3271fd Mon Sep 17 00:00:00 2001
	From: Daimona Eaytoy <daimona.wiki@gmail.com>
	Date: Thu, 29 May 2025 23:22:25 +0200
	Subject: [PATCH] SECURITY: do not return result of Message::text() in
	validation-callback

	Return Message objects instead for proper escaping.

	Bug: T395622
	Change-Id: I79160924409a12c85d2915629ae3b52528f94155
	---
	src/Special/AbstractEventRegistrationSpecialPage.php \| 6 ++----
	1 file changed, 2 insertions(+), 4 deletions(-)

	diff --git a/src/Special/AbstractEventRegistrationSpecialPage.php b/src/Special/AbstractEventRegistrationSpecialPage.php
	index 8997729d..3b267992 100644
	--- a/src/Special/AbstractEventRegistrationSpecialPage.php
	+++ b/src/Special/AbstractEventRegistrationSpecialPage.php
	@@ -326,7 +326,7 @@ abstract class AbstractEventRegistrationSpecialPage extends FormSpecialPage {
	$this->invalidOrganizerNames = $validationStatus->getValue();
	}
	$msg = $validationStatus->getMessages()[0];
	- return $this->msg( $msg )->text();
	+ return $this->msg( $msg );
	}

	return true;
	@@ -455,9 +455,7 @@ abstract class AbstractEventRegistrationSpecialPage extends FormSpecialPage {
	return true;
	} catch ( InvalidToolURLException $e ) {
	$baseURL = rtrim( $e->getExpectedBaseURL(), '/' ) . '/courses';
	- return $this->msg( 'campaignevents-error-invalid-dashboard-url' )
	- ->params( $baseURL )
	- ->text();
	+ return $this->msg( 'campaignevents-error-invalid-dashboard-url' )->params( $baseURL );
	}
	},
	'section' => self::DETAILS_SECTION,
	--
	2.43.0