No OneTemporary
Actions

Size

1 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/includes/search/searchwidgets/FullSearchResultWidget.php b/includes/search/searchwidgets/FullSearchResultWidget.php
	index 593ce8b20b5..ac8fbc0b5e0 100644
	--- a/includes/search/searchwidgets/FullSearchResultWidget.php
	+++ b/includes/search/searchwidgets/FullSearchResultWidget.php
	@@ -11,6 +11,7 @@ use MediaWiki\HookContainer\HookRunner;
	use MediaWiki\Html\Html;
	use MediaWiki\Linker\LinkRenderer;
	use MediaWiki\MainConfigNames;
	+use MediaWiki\Parser\Sanitizer;
	use MediaWiki\Search\Entity\SearchResultThumbnail;
	use MediaWiki\Search\SearchResultThumbnailProvider;
	use MediaWiki\Specials\SpecialSearch;
	@@ -312,9 +313,14 @@ class FullSearchResultWidget implements SearchResultWidget {
	return [ $html, null, $this->generateThumbnailHtml( $result ) ];
	}

	+ // File::getShortDesc() is documented to return HTML, but many handlers used to incorrectly
	+ // return plain text (T395834), so sanitize it in case the same bug is present in extensions.
	+ $unsafeShortDesc = $img->getShortDesc();
	+ $shortDesc = Sanitizer::removeSomeTags( $unsafeShortDesc );
	+
	return [
	$html,
	- $this->specialPage->msg( 'parentheses' )->rawParams( $img->getShortDesc() )->escaped(),
	+ $this->specialPage->msg( 'parentheses' )->rawParams( $shortDesc )->escaped(),
	$this->generateThumbnailHtml( $result, $thumbnail )
	];
	}