Html escape the timestamp in Special:Undelete

Change-Id: I377effe4050d961ec6295a9fe684e4ff6a71bc77

diff --git a/includes/specials/SpecialUndelete.php b/includes/specials/SpecialUndelete.php
index 740207d..62a48c6 100644 (file)
--- a/includes/specials/SpecialUndelete.php
+++ b/includes/specials/SpecialUndelete.php
@@ -969,7 +969,7 @@ class SpecialUndelete extends SpecialPage {
                        $key = urlencode( $row->fa_storage_key );
                        $pageLink = $this->getFileLink( $file, $this->getPageTitle(), $ts, $key );
                } else {
-                       $pageLink = $this->getLanguage()->userTimeAndDate( $ts, $user );
+                       $pageLink = htmlspecialchars( $this->getLanguage()->userTimeAndDate( $ts, $user ) );
                }
                $userLink = $this->getFileUser( $file );
                $data = $this->msg( 'widthheight' )->numParams( $row->fa_width, $row->fa_height )->text();
@@ -1049,7 +1049,7 @@ class SpecialUndelete extends SpecialPage {
                $time = $this->getLanguage()->userTimeAndDate( $ts, $user );
 
                if ( !$file->userCan( File::DELETED_FILE, $user ) ) {
-                       return '<span class="history-deleted">' . $time . '</span>';
+                       return '<span class="history-deleted">' . htmlspecialchars( $time ) . '</span>';
                }
 
                $link = $this->getLinkRenderer()->makeKnownLink(