Page MenuHomePhabricator

XML-escaping needed for Page Schemas values
Open, Needs TriagePublic

Description

If you put any of the five characters that are "XML predefined entities" (&<>",) into almost any of the inputs when editing a schema, it will cause the form to crash when you hit "Save" at the bottom. Clearly most of the values being submitted need to be XML-escaped, i.e. "&" changes to "&amp;", before they get saved to the page. Presumably the best way to do this is with the htmlspecialchars() function, which already handles just these five characters.

Event Timeline

Change #1278469 had a related patch set uploaded (by Dumbledore; author: Dumbledore):

[mediawiki/extensions/PageSchemas@master] XML-escaping needed for Page Schemas values

https://gerrit.wikimedia.org/r/1278469

Change #1278469 merged by jenkins-bot:

[mediawiki/extensions/PageSchemas@master] XML-escaping needed for Page Schemas values

https://gerrit.wikimedia.org/r/1278469