Merge "(bug 37587) Enforce language codes to be html safe"

diff --combined languages/Language.php
index 3ee959e,4d73acb..430209d
--- 1/languages/Language.php
--- 2/languages/Language.php
+++ b/languages/Language.php
@@@ -246,7 -246,11 +246,11 @@@ class Language 
         */
        public static function isValidCode( $code ) {
                return
-                       strcspn( $code, ":/\\\000" ) === strlen( $code )
+                       // People think language codes are html safe, so enforce it.
+                       // Ideally we should only allow a-zA-Z0-9-
+                       // but, .+ and other chars are often used for {{int:}} hacks
+                       // see bugs 37564, 37587, 36938
+                       strcspn( $code, ":/\\\000&<>'\"" ) === strlen( $code )
                        && !preg_match( Title::getTitleInvalidRegex(), $code );
        }
  
@@@ -3907,7 -3911,7 +3911,7 @@@
        /**
         * Decode an expiry (block, protection, etc) which has come from the DB
         *
 -       * @FIXME: why are we returnings DBMS-dependent strings???
 +       * @todo FIXME: why are we returnings DBMS-dependent strings???
         *
         * @param $expiry String: Database expiry String
         * @param $format Bool|Int true to process using language functions, or TS_ constant