From 24c6fc6efea75fb867842bf759caff8c082acaaa Mon Sep 17 00:00:00 2001
From: =?utf-8?q?Bartosz=20Dziewo=C5=84ski?= <dziewonski@fastmail.fm>
Date: Sun, 15 Feb 2026 01:47:56 +0100
Subject: [PATCH] SECURITY: Validate link target for protection indicators help
 page

Bug: T416090
Change-Id: I5fa630ca3d00e3bc98b732320ab9ffc8ff95491c
---
 includes/Page/Article.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/includes/Page/Article.php b/includes/Page/Article.php
index e618a9ceaff..40570f7bfff 100644
--- a/includes/Page/Article.php
+++ b/includes/Page/Article.php
@@ -659,7 +659,7 @@ class Article implements Page {
 		if ( $protectionHelpLink->isDisabled() ) {
 			$protectionHelpLink = 'https://mediawiki.org/wiki/Special:MyLanguage/Help:Protection';
 		} else {
-			$protectionHelpLink = $protectionHelpLink->text();
+			$protectionHelpLink = Skin::makeInternalOrExternalUrl( $protectionHelpLink->text() );
 		}
 
 		$outputPage->setIndicators( [
-- 
2.45.1.windows.1