In T45646: "MediaWiki:Copyright" message allows raw HTML (MW 1.43) we introduced a replacement and deprecated them. They should be removed in a future MediaWiki release.
Set
$wgRightsPage = 'Foo';
Edit MediaWiki:Copyright
with
EVIL EVIL $1 unless otherwise noted.<img src="http://my_host/index.php?title=Special:UserLogout"/><script>alert('evil!');</script>Load any page
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | None | T2212 Some MediaWiki: messages not safe in HTML (tracking) | |||
| Resolved | matmarex | T376295 Remove deprecated raw HTML localisation messages 'copyright' and 'history_copyright' and the hook 'SkinCopyrightFooter' | |||
| Resolved | matmarex | T45646 "MediaWiki:Copyright" message allows raw HTML |
Change #1145324 had a related patch set uploaded (by Bartosz Dziewoński; author: Bartosz Dziewoński):
[mediawiki/core@master] Remove raw HTML messages 'copyright' and 'history_copyright'
Change #1145324 merged by jenkins-bot:
[mediawiki/core@master] Remove raw HTML messages 'copyright' and 'history_copyright'
Change #1146109 had a related patch set uploaded (by Bartosz Dziewoński; author: Bartosz Dziewoński):
[mediawiki/core@REL1_44] Change $wgAllowRawHtmlCopyrightMessages to default false, deprecate
Change #1146109 merged by jenkins-bot:
[mediawiki/core@REL1_44] Change $wgAllowRawHtmlCopyrightMessages to default false, deprecate