Maniphest T148462

Centralauth-rename-abortlogin message shouldn't be HTML escaped
Open, Needs TriagePublic
Actions

Description

Reported by @Maxlath at https://fr.wikipedia.org/w/index.php?title=Sp%C3%A9cial:Connexion&returnto=Wikip%C3%A9dia%3AAccueil+principal or at https://fr.wikipedia.org/wiki/Special:CentralLogin/complete?token=....

When an account is renamed, this error message could occur:

It's HTML escaped, but should be printed raw.

Formatting happens in core AuthenticationResponse::newFail method.

Event Timeline

Dereckson claimed this task.Oct 17 2016, 8:01 PM

Dereckson added a subscriber: Dereckson.

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptOct 17 2016, 8:01 PM

Reedy added a project: MediaWiki-extensions-CentralAuth.Oct 17 2016, 8:02 PM

Reedy set Security to None.

Dereckson updated the task description. (Show Details)Oct 17 2016, 8:02 PM

Dereckson added a project: MediaWiki-Authentication-and-authorization.Oct 17 2016, 8:16 PM

Dereckson updated the task description. (Show Details)

Dereckson updated the task description. (Show Details)Oct 18 2016, 6:23 PM

I've this information in my Phabricator comment box, probably the relevant message key: authmanager-authn-autocreate-failed