Merge "(bug 36938) XSS in uselang parameter"

[lhc/web/wiklou.git] / includes / SkinTemplate.php

diff --git a/includes/SkinTemplate.php b/includes/SkinTemplate.php
index b74f7c5..aee2e83 100644 (file)
--- a/includes/SkinTemplate.php
+++ b/includes/SkinTemplate.php
@@ -294,7 +294,11 @@ class SkinTemplate extends Skin {
                $tpl->set( 'specialpageattributes', '' ); # obsolete
 
                if ( $userlang !== $wgContLang->getHtmlCode() || $userdir !== $wgContLang->getDir() ) {
-                       $attrs = " lang='$userlang' dir='$userdir'";
+                       $escUserlang = htmlspecialchars( $userlang );
+                       $escUserdir = htmlspecialchars( $userdir );
+                       // Attributes must be in double quotes because htmlspecialchars() doesn't
+                       // escape single quotes
+                       $attrs = " lang=\"$escUserlang\" dir=\"$escUserdir\"";
                        $tpl->set( 'userlangattributes', $attrs );
                }