Escape retrievedfrom message in the skin

Change-Id: Ifd696ecd93c76e56cb21b3f2645367beeeeb5ba0

diff --git a/includes/skins/Skin.php b/includes/skins/Skin.php
index 1a4ec98..04c02d6 100644 (file)
--- a/includes/skins/Skin.php
+++ b/includes/skins/Skin.php
@@ -646,8 +646,9 @@ abstract class Skin extends ContextSource {
                        $url = htmlspecialchars( wfExpandIRI( $this->getTitle()->getCanonicalURL() ) );
                }
 
-               return $this->msg( 'retrievedfrom', '<a dir="ltr" href="' . $url
-                       . '">' . $url . '</a>' )->text();
+               return $this->msg( 'retrievedfrom' )
+                       ->rawParams( '<a dir="ltr" href="' . $url. '">' . $url . '</a>' )
+                       ->escaped();
        }
 
        /**