From c73d48de269faa7867827a9c340c8a9c4b01d7fc Mon Sep 17 00:00:00 2001
From: sbassett <sbassett@wikimedia.org>
Date: Mon, 18 Oct 2021 14:09:29 -0500
Subject: [PATCH] SECURITY: html-escape caption field data within mustache
 template

Bug: T293556
---
 templates/filepage/CaptionsPanel.mustache+dom | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/filepage/CaptionsPanel.mustache+dom b/templates/filepage/CaptionsPanel.mustache+dom
index c6fe17b9..9b928736 100644
--- a/templates/filepage/CaptionsPanel.mustache+dom
+++ b/templates/filepage/CaptionsPanel.mustache+dom
@@ -5,7 +5,7 @@
 	<div class="wbmi-entityview-caption"{{^show}} style="display: none;"{{/show}}>
 		<div class="wbmi-language-label">{{{language}}}</div>
 		<div class="wbmi-caption-value{{#empty}}  wbmi-entityview-emptyCaption{{/empty}}" dir="{{textDirection}}" lang="{{langCode}}">
-			{{{caption}}}
+			{{caption}}
 			{{#inputError}}<div class="wbmi-caption-publishError">{{{inputError}}}</div>{{/inputError}}
 				{{#inputWarning}}<div class="wbmi-caption-publishWarning">{{inputWarning}}</div>{{/inputWarning}}
 		</div>
-- 
2.30.2