| Index: trunk/extensions/Comments/SpecialCommentIgnoreList.php |
| — | — | @@ -42,6 +42,7 @@ |
| 43 | 43 | $out .= $this->displayCommentBlockList(); |
| 44 | 44 | } else { |
| 45 | 45 | if( $wgRequest->wasPosted() ) { |
| | 46 | + $user_name = htmlspecialchars_decode( $user_name ); |
| 46 | 47 | $user_id = User::idFromName( $user_name ); |
| 47 | 48 | // Anons can be comment-blocked, but idFromName returns nothing |
| 48 | 49 | // for an anon, so... |
| — | — | @@ -112,9 +113,9 @@ |
| 113 | 114 | wfMsg( 'comment-ignore-remove-message', $user_name ) . |
| 114 | 115 | '</div> |
| 115 | 116 | <div> |
| 116 | | - <form action="" method="post" name="comment_block"> |
| 117 | | - <input type="hidden" name="user" value="' . $user_name . '" /> |
| 118 | | - <input type="button" class="site-button" value="' . wfMsg( 'comment-ignore-unblock' ) . '" onclick="document.comment_block.submit()" /> |
| | 117 | + <form action="" method="post" name="comment_block">' . |
| | 118 | + Html::hidden( 'user', htmlspecialchars( $user_name, ENT_QUOTES ) ) . |
| | 119 | + '<input type="button" class="site-button" value="' . wfMsg( 'comment-ignore-unblock' ) . '" onclick="document.comment_block.submit()" /> |
| 119 | 120 | <input type="button" class="site-button" value="' . wfMsg( 'comment-ignore-cancel' ) . '" onclick="history.go(-1)" /> |
| 120 | 121 | </form> |
| 121 | 122 | </div>'; |