* Escape the output of magic variables that return page name or part of it

diff --git a/RELEASE-NOTES b/RELEASE-NOTES
index f0e1147..aad8ed5 100644 (file)
--- a/RELEASE-NOTES
+++ b/RELEASE-NOTES
@@ -174,7 +174,7 @@ it from source control: http://www.mediawiki.org/wiki/Download_from_SVN
   {{LOCAL*}} functions return local time per server config or $wgLocaltimezone.
   Signature dates for Japanese and other languages including weekday now show
   the correct day to match the rest of the time in local time.
-
+* Escape the output of magic variables that return page name or part of it
 
 == API changes since 1.10 ==
 

diff --git a/includes/Parser.php b/includes/Parser.php
index eb6739f..20d8e93 100644 (file)
--- a/includes/Parser.php
+++ b/includes/Parser.php
@@ -2455,25 +2455,25 @@ class Parser
                        case 'localday2':
                                return $varCache[$index] = $wgContLang->formatNum( $localDay2 );
                        case 'pagename':
-                               return $this->mTitle->getText();
+                               return wfEscapeWikiText( $this->mTitle->getText() );
                        case 'pagenamee':
                                return $this->mTitle->getPartialURL();
                        case 'fullpagename':
-                               return $this->mTitle->getPrefixedText();
+                               return wfEscapeWikiText( $this->mTitle->getPrefixedText() );
                        case 'fullpagenamee':
                                return $this->mTitle->getPrefixedURL();
                        case 'subpagename':
-                               return $this->mTitle->getSubpageText();
+                               return wfEscapeWikiText( $this->mTitle->getSubpageText() );
                        case 'subpagenamee':
                                return $this->mTitle->getSubpageUrlForm();
                        case 'basepagename':
-                               return $this->mTitle->getBaseText();
+                               return wfEscapeWikiText( $this->mTitle->getBaseText() );
                        case 'basepagenamee':
                                return wfUrlEncode( str_replace( ' ', '_', $this->mTitle->getBaseText() ) );
                        case 'talkpagename':
                                if( $this->mTitle->canTalk() ) {
                                        $talkPage = $this->mTitle->getTalkPage();
-                                       return $talkPage->getPrefixedText();
+                                       return wfEscapeWikiText( $talkPage->getPrefixedText() );
                                } else {
                                        return '';
                                }
@@ -2486,7 +2486,7 @@ class Parser
                                }
                        case 'subjectpagename':
                                $subjPage = $this->mTitle->getSubjectPage();
-                               return $subjPage->getPrefixedText();
+                               return wfEscapeWikiText( $subjPage->getPrefixedText() );
                        case 'subjectpagenamee':
                                $subjPage = $this->mTitle->getSubjectPage();
                                return $subjPage->getPrefixedUrl();