Raw HTML in Special:ProtectedPages
Closed, InvalidPublic
Actions

Assigned To

None

Authored By

	TTO
	Jun 1 2016, 1:05 PM

Description

pagesize message is raw HTML. Check if other ones are too

		Status	Subtype	Assigned	Task
		Open		None	T2212 Some MediaWiki: messages not safe in HTML (tracking)
		Invalid		None	T136700 Raw HTML in Special:ProtectedPages

TTO triaged this task as Low priority.Jun 1 2016, 1:06 PM

I only found one usage of pagesize:

Xml::label( $this->msg( 'pagesize' )->text(), 'wpsize' )

https://github.com/wikimedia/mediawiki/blob/master/includes/specials/SpecialProtectedpages.php#L205
And as far as I can see, Xml::label escapes the contents of $label with htmlspecialchars() :/ Are there any other usages or things I don't see?

@TTO Do I miss something? The task looks like invalid for me :/

I'll look later today to see if I can figure out what I was talking about :)

No idea what I was talking about. Clearly it works correctly.