Escape sidebar ID's. Bug 18688

diff --git a/includes/Skin.php b/includes/Skin.php
index d571350..2f2cc5c 100644 (file)
--- a/includes/Skin.php
+++ b/includes/Skin.php
@@ -1330,7 +1330,7 @@ abstract class Skin {
                                        $bar[$heading][] = array_merge( array(
                                                'text' => $text,
                                                'href' => $href,
-                                               'id' => 'n-' . strtr( $line[1], ' ', '-' ),
+                                               'id' => 'n-' . Sanitizer::escapeId( strtr( $line[1], ' ', '-' ) ),
                                                'active' => false
                                        ), $extraAttribs );
                                } elseif ( ( substr( $line, 0, 2 ) == '{{' ) && ( substr( $line, -2 ) == '}}' ) ) {