fixed potential XSS vulnerability

diff --git a/includes/MessageCache.php b/includes/MessageCache.php
index 8af4484..6d4b788 100755 (executable)
--- a/includes/MessageCache.php
+++ b/includes/MessageCache.php
@@ -234,7 +234,7 @@ class MessageCache
                }
                # If uninitialised, someone is trying to call this halfway through Setup.php
                if( !$this->mInitialised ) {
-                       return "<$key>";
+                       return '<' . htmlspecialchars($key) . '>';
                }
                # If cache initialization was deferred, start it now.
                if( $this->mDeferred ) {
@@ -277,7 +277,7 @@ class MessageCache
                
                # Final fallback
                if( !$message ) {
-                       $message = "<$key>";
+                       return '<' . htmlspecialchars($key) . '>';
                }
 
                # Replace brace tags