Fix injection/cross-site scripting issue (report from Nick Jenkins)

diff --git a/includes/SpecialIpblocklist.php b/includes/SpecialIpblocklist.php
index 97ace8d..cc5c805 100644 (file)
--- a/includes/SpecialIpblocklist.php
+++ b/includes/SpecialIpblocklist.php
@@ -18,7 +18,7 @@ function wfSpecialIpblocklist() {
        $ipu = new IPUnblockForm( $ip, $reason );
 
        if ( "success" == $action ) {
-               $ipu->showList( wfMsgWikiHtml( 'unblocked', $ip ) );
+               $ipu->showList( wfMsgWikiHtml( 'unblocked', htmlspecialchars( $ip ) ) );
        } else if ( "submit" == $action && $wgRequest->wasPosted() &&
                $wgUser->matchEditToken( $wgRequest->getVal( 'wpEditToken' ) ) ) {
                if ( ! $wgUser->isAllowed('block') ) {