(bug 32604) Some messages needs escaping of wikitext inside username

Change-Id: I223a5fb8d110ceace122acb7045bc6a925bfda66

diff --git a/RELEASE-NOTES-1.20 b/RELEASE-NOTES-1.20
index ceae45e..c796df3 100644 (file)
--- a/RELEASE-NOTES-1.20
+++ b/RELEASE-NOTES-1.20
@@ -97,6 +97,7 @@ upgrade PHP if you have not done so prior to upgrading MediaWiki.
 * (bug 35572) Blocks appear to succeed even if query fails due to wrong DB structure
 * (bug 31757) Add a word-separator between help-messages in HTMLForm
 * (bug 30410) Removed deprecated $wgFilterCallback and the 'filtered' API error.
+* (bug 32604) Some messages needs escaping of wikitext inside username
 
 === API changes in 1.20 ===
 * (bug 34316) Add ability to retrieve maximum upload size from MediaWiki API.

diff --git a/includes/specials/SpecialBlock.php b/includes/specials/SpecialBlock.php
index a58e62e..4d74fe1 100644 (file)
--- a/includes/specials/SpecialBlock.php
+++ b/includes/specials/SpecialBlock.php
@@ -277,7 +277,7 @@ class SpecialBlock extends FormSpecialPage {
                        }
 
                        $this->alreadyBlocked = true;
-                       $this->preErrors[] = array( 'ipb-needreblock', (string)$block->getTarget() );
+                       $this->preErrors[] = array( 'ipb-needreblock', wfEscapeWikiText( (string)$block->getTarget() ) );
                }
 
                # We always need confirmation to do HideUser
@@ -349,7 +349,7 @@ class SpecialBlock extends FormSpecialPage {
 
                # Link to unblock the specified user, or to a blank unblock form
                if( $this->target instanceof User ) {
-                       $message = $this->msg( 'ipb-unblock-addr', $this->target->getName() )->parse();
+                       $message = $this->msg( 'ipb-unblock-addr', wfEscapeWikiText( $this->target->getName() ) )->parse();
                        $list = SpecialPage::getTitleFor( 'Unblock', $this->target->getName() );
                } else {
                        $message = $this->msg( 'ipb-unblock' )->parse();
@@ -904,7 +904,7 @@ class SpecialBlock extends FormSpecialPage {
        public function onSuccess() {
                $out = $this->getOutput();
                $out->setPageTitle( $this->msg( 'blockipsuccesssub' ) );
-               $out->addWikiMsg( 'blockipsuccesstext',  $this->target );
+               $out->addWikiMsg( 'blockipsuccesstext', wfEscapeWikiText( $this->target ) );
        }
 }
 

diff --git a/includes/specials/SpecialUnblock.php b/includes/specials/SpecialUnblock.php
index fab21cd..fb2005b 100644 (file)
--- a/includes/specials/SpecialUnblock.php
+++ b/includes/specials/SpecialUnblock.php
@@ -60,14 +60,14 @@ class SpecialUnblock extends SpecialPage {
                        switch( $this->type ){
                                case Block::TYPE_USER:
                                case Block::TYPE_IP:
-                                       $out->addWikiMsg( 'unblocked',  $this->target );
+                                       $out->addWikiMsg( 'unblocked', wfEscapeWikiText( $this->target ) );
                                        break;
                                case Block::TYPE_RANGE:
-                                       $out->addWikiMsg( 'unblocked-range', $this->target );
+                                       $out->addWikiMsg( 'unblocked-range', wfEscapeWikiText( $this->target ) );
                                        break;
                                case Block::TYPE_ID:
                                case Block::TYPE_AUTO:
-                                       $out->addWikiMsg( 'unblocked-id', $this->target );
+                                       $out->addWikiMsg( 'unblocked-id', wfEscapeWikiText( $this->target ) );
                                        break;
                        }
                }

diff --git a/includes/specials/SpecialUndelete.php b/includes/specials/SpecialUndelete.php
index 06b578d..d1bb3f0 100644 (file)
--- a/includes/specials/SpecialUndelete.php
+++ b/includes/specials/SpecialUndelete.php
@@ -1015,7 +1015,7 @@ class SpecialUndelete extends SpecialPage {
                }
                $out->wrapWikiMsg(
                        "<div class='mw-undelete-pagetitle'>\n$1\n</div>\n",
-                       array( 'undeletepagetitle', $this->mTargetObj->getPrefixedText() )
+                       array( 'undeletepagetitle', wfEscapeWikiText( $this->mTargetObj->getPrefixedText() ) )
                );
 
                $archive = new PageArchive( $this->mTargetObj );