* Process the form. At this point we know that the user passes all the criteria in
* userCanExecute(), and if the data array contains 'Username', etc, then Username
* resets are allowed.
- * @param $data array
+ * @param array $data
* @throws MWException
* @throws ThrottledError|PermissionsError
- * @return Bool|Array
+ * @return bool|array
*/
public function onSubmit( array $data ) {
global $wgAuth;
$firstUser = $users[0];
if ( !$firstUser instanceof User || !$firstUser->getID() ) {
- return array( array( 'nosuchuser', $data['Username'] ) );
+ // Don't parse username as wikitext (bug 65501)
+ return array( array( 'nosuchuser', wfEscapeWikiText( $data['Username'] ) ) );
}
// Check against the rate limiter
// All the users will have the same email address
if ( $firstUser->getEmail() == '' ) {
// This won't be reachable from the email route, so safe to expose the username
- return array( array( 'noemail', $firstUser->getName() ) );
+ return array( array( 'noemail', wfEscapeWikiText( $firstUser->getName() ) ) );
}
// We need to have a valid IP address for the hook, but per bug 18347, we should
/**
* Hide the password reset page if resets are disabled.
- * @return Bool
+ * @return bool
*/
function isListed() {
if ( $this->canChangePassword( $this->getUser() ) === true ) {