fix sidebar HTML escaping in CologneBlue

In my defense, it wasn't documented anywhere that it isn't safe to output.
I added docs in If56df0a7.

Change-Id: I6df92c628e46666efab3012073bf06673f844a0b

diff --git a/skins/CologneBlue.php b/skins/CologneBlue.php
index 32aa902..68d92ce 100644 (file)
--- a/skins/CologneBlue.php
+++ b/skins/CologneBlue.php
@@ -647,7 +647,7 @@ class CologneBlueTemplate extends BaseTemplate {
 
                                        $headingMsg = wfMessage( $heading );
                                        $any_link = false;
-                                       $t = $this->menuHead( $headingMsg->exists() ? $headingMsg->text() : $heading );
+                                       $t = $this->menuHead( $headingMsg->exists() ? $headingMsg->text() : htmlspecialchars( $heading ) );
 
                                        foreach ( $links as $key => $link ) {
                                                // Can be empty due to rampant sidebar massaging we're doing above