HTML escape parameter 'text' of hook 'SkinEditSectionLinks'

[lhc/web/wiklou.git] / includes / api / ApiMessageTrait.php

diff --git a/includes/api/ApiMessageTrait.php b/includes/api/ApiMessageTrait.php
index 18b6bc4..6894d28 100644 (file)
--- a/includes/api/ApiMessageTrait.php
+++ b/includes/api/ApiMessageTrait.php
@@ -105,12 +105,15 @@ trait ApiMessageTrait {
                        } else {
                                $this->apiCode = $key;
                        }
+
+                       // Ensure the code is actually valid
+                       $this->apiCode = preg_replace( '/[^a-zA-Z0-9_-]/', '_', $this->apiCode );
                }
                return $this->apiCode;
        }
 
        public function setApiCode( $code, array $data = null ) {
-               if ( $code !== null && !( is_string( $code ) && $code !== '' ) ) {
+               if ( $code !== null && !ApiErrorFormatter::isValidApiCode( $code ) ) {
                        throw new InvalidArgumentException( "Invalid code \"$code\"" );
                }