Merge "build: Bump most devDependencies to latest"

[lhc/web/wiklou.git] / languages / Language.php

diff --git a/languages/Language.php b/languages/Language.php
index eab09a1..85daa14 100644 (file)
--- a/languages/Language.php
+++ b/languages/Language.php
@@ -4194,8 +4194,13 @@ class Language {
        /**
         * convert text to different variants of a language.
         *
-        * @param string $text
-        * @return string
+        * @warning Glossary state is maintained between calls. This means
+        *  if you pass unescaped text to this method it can cause an XSS
+        *  in later calls to this method, even if the later calls have properly
+        *  escaped the input. Never feed this method user controlled text that
+        *  is not properly escaped!
+        * @param string $text Content that has been already escaped for use in HTML
+        * @return string HTML
         */
        public function convert( $text ) {
                return $this->mConverter->convert( $text );