Thijs/wiki.techinc.nl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

SECURITY: Parse messages instead of inserting them as HTML

Browse source 
CVE-2025-61640

This fixes a stored i18n XSS vulnerability in
Special:RecentChangesLinked.

Bug: T402075
Change-Id: I94d89e3f14920122cfd2f949850027122d1e2b6b
This commit is contained in:
SomeRandomDeveloper 2025-08-16 10:43:02 +02:00 committed by Reedy
parent 5f21cc528e
commit d2d60515fb
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
resources/src/mediawiki.rcfilters/ui/RclToOrFromWidget.js
View file

@ -17,11 +17,11 @@ const RclToOrFromWidget = function MwRcfiltersUiRclToOrFromWidget(
this.showLinkedFrom = new OO.ui.MenuOptionWidget( {
data: 'from', // default (showlinkedto=0)
label: new OO.ui.HtmlSnippet( mw.msg( 'rcfilters-filter-showlinkedfrom-option-label' ) )
label: new OO.ui.HtmlSnippet( mw.message( 'rcfilters-filter-showlinkedfrom-option-label' ).parse() )
} );
this.showLinkedTo = new OO.ui.MenuOptionWidget( {
data: 'to', // showlinkedto=1
label: new OO.ui.HtmlSnippet( mw.msg( 'rcfilters-filter-showlinkedto-option-label' ) )
label: new OO.ui.HtmlSnippet( mw.message( 'rcfilters-filter-showlinkedto-option-label' ).parse() )
} );
// Parent