Skin.php: HTML escape message pipe-separator

This prevents HTML and JavaScript injections.

Change-Id: I6241dadf29e96aa1aa15324a3edc51538214345d

diff --git a/includes/skins/Skin.php b/includes/skins/Skin.php
index df7a9ed..eaee0d2 100644 (file)
--- a/includes/skins/Skin.php
+++ b/includes/skins/Skin.php
@@ -1611,7 +1611,7 @@ abstract class Skin extends ContextSource {
 
                $result .= implode(
                        '<span class="mw-editsection-divider">'
-                               . wfMessage( 'pipe-separator' )->inLanguage( $lang )->text()
+                               . wfMessage( 'pipe-separator' )->inLanguage( $lang )->escaped()
                                . '</span>',
                        $linksHtml
                );