SpecialPreferences: Escape HTML in tab titles in legacy form

They shouldn't intentionally contain HTML (except by abuse of
PreferencesGetLegend hook), and other than trivial formatting,
it wouldn't display correctly because they are styled as links.

It is already being escaped in OOUI form.

Change-Id: I303afe92fcb0208d1a2b040321866c0c95f27aa9

diff --git a/includes/specials/SpecialPreferences.php b/includes/specials/SpecialPreferences.php
index 0490cbb..08b33c1 100644 (file)
--- a/includes/specials/SpecialPreferences.php
+++ b/includes/specials/SpecialPreferences.php
@@ -130,7 +130,7 @@ class SpecialPreferences extends SpecialPage {
                                                'role' => 'presentation',
                                                'class' => ( $key === 'personal' ) ? 'selected' : null
                                        ],
-                                       Html::rawElement( 'a',
+                                       Html::element( 'a',
                                                [
                                                        'id' => 'preftab-' . $key,
                                                        'role' => 'tab',