From 60be0e4cdf37fce9a83d9df0bd1497107bc5f940 Mon Sep 17 00:00:00 2001
From: grunny <mwgrunny@gmail.com>
Date: Sun, 21 Mar 2021 14:35:58 +1000
Subject: [PATCH] Escape rcfilters-filter-* messages on ChangesList pages

The rcfilters-filter-*-label messages are output as raw HTML on
ChangesList pages like RecentChanges and Watchlist. If there is
a wrapping label message, the label is properly escaped, but
when there is not, it is appended as raw HTML. This escapes the
label at output by switching to .text().

Change-Id: I7106aedced51343439fc54d5bb91620d8a0362f9
---
 resources/src/mediawiki.rcfilters/ui/TagItemWidget.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/resources/src/mediawiki.rcfilters/ui/TagItemWidget.js b/resources/src/mediawiki.rcfilters/ui/TagItemWidget.js
index 5d45d18..ba7b920 100644
--- a/resources/src/mediawiki.rcfilters/ui/TagItemWidget.js
+++ b/resources/src/mediawiki.rcfilters/ui/TagItemWidget.js
@@ -94,7 +94,7 @@ TagItemWidget.prototype.updateUiBasedOnState = function () {
 		).contents() );
 	} else {
 		this.setLabel(
-			$( '<bdi>' ).append(
+			$( '<bdi>' ).text(
 				this.itemModel.getLabel()
 			)
 		);
-- 
2.7.4