From 1ea145eb335ff10fb83c9f35ac2d6e31df3271fd Mon Sep 17 00:00:00 2001
From: Daimona Eaytoy <daimona.wiki@gmail.com>
Date: Thu, 29 May 2025 23:22:25 +0200
Subject: [PATCH] SECURITY: do not return result of Message::text() in
 validation-callback

Return Message objects instead for proper escaping.

Bug: T395622
Change-Id: I79160924409a12c85d2915629ae3b52528f94155
---
 src/Special/AbstractEventRegistrationSpecialPage.php | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/src/Special/AbstractEventRegistrationSpecialPage.php b/src/Special/AbstractEventRegistrationSpecialPage.php
index 8997729d..3b267992 100644
--- a/src/Special/AbstractEventRegistrationSpecialPage.php
+++ b/src/Special/AbstractEventRegistrationSpecialPage.php
@@ -326,7 +326,7 @@ abstract class AbstractEventRegistrationSpecialPage extends FormSpecialPage {
 						$this->invalidOrganizerNames = $validationStatus->getValue();
 					}
 					$msg = $validationStatus->getMessages()[0];
-					return $this->msg( $msg )->text();
+					return $this->msg( $msg );
 				}
 
 				return true;
@@ -455,9 +455,7 @@ abstract class AbstractEventRegistrationSpecialPage extends FormSpecialPage {
 						return true;
 					} catch ( InvalidToolURLException $e ) {
 						$baseURL = rtrim( $e->getExpectedBaseURL(), '/' ) . '/courses';
-						return $this->msg( 'campaignevents-error-invalid-dashboard-url' )
-							->params( $baseURL )
-							->text();
+						return $this->msg( 'campaignevents-error-invalid-dashboard-url' )->params( $baseURL );
 					}
 				},
 				'section' => self::DETAILS_SECTION,
-- 
2.43.0