SECURITY: Do not allow user scripts on Special:PasswordReset

Bug: T192134
Change-Id: If5e91452f2e569476626bcf650ba4efaa122952c

diff --git a/includes/specials/SpecialPasswordReset.php b/includes/specials/SpecialPasswordReset.php
index c1d30ee..63490e4 100644 (file)
--- a/includes/specials/SpecialPasswordReset.php
+++ b/includes/specials/SpecialPasswordReset.php
@@ -74,6 +74,15 @@ class SpecialPasswordReset extends FormSpecialPage {
                parent::checkExecutePermissions( $user );
        }
 
+       /**
+        * @param string $par
+        */
+       public function execute( $par ) {
+               $out = $this->getOutput();
+               $out->disallowUserJs();
+               parent::execute( $par );
+       }
+
        protected function getFormFields() {
                $resetRoutes = $this->getConfig()->get( 'PasswordResetRoutes' );
                $a = [];