ChangesList: HTML escape the timestamp

Bug: T197002
Change-Id: Ib695674b9dc28a2f864f330e578cee6a1a7a4219

diff --git a/includes/changes/ChangesList.php b/includes/changes/ChangesList.php
index facf29e..ac8b3d4 100644 (file)
--- a/includes/changes/ChangesList.php
+++ b/includes/changes/ChangesList.php
@@ -531,10 +531,10 @@ class ChangesList extends ContextSource {
        public function getTimestamp( $rc ) {
                // @todo FIXME: Hard coded ". .". Is there a message for this? Should there be?
                return $this->message['semicolon-separator'] . '<span class="mw-changeslist-date">' .
-                       $this->getLanguage()->userTime(
+                       htmlspecialchars( $this->getLanguage()->userTime(
                                $rc->mAttribs['rc_timestamp'],
                                $this->getUser()
-                       ) . '</span> <span class="mw-changeslist-separator">. .</span> ';
+                       ) ) . '</span> <span class="mw-changeslist-separator">. .</span> ';
        }
 
        /**