From 9ef7c32f0a86377e785158b414998eac8a80580c Mon Sep 17 00:00:00 2001
From: Daimona Eaytoy <daimona.wiki@gmail.com>
Date: Tue, 24 Feb 2026 16:24:53 +0100
Subject: [PATCH] SECURITY: EventContributionsPager: escape wiki names for
 display

Bug: T418254
Change-Id: I82c71621fcd822f4b9270019a36a830e7ef161bf
---
 src/Pager/EventContributionsPager.php | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/src/Pager/EventContributionsPager.php b/src/Pager/EventContributionsPager.php
index 66e4a67f..fbd6b9d2 100644
--- a/src/Pager/EventContributionsPager.php
+++ b/src/Pager/EventContributionsPager.php
@@ -320,10 +320,12 @@ class EventContributionsPager extends CodexTablePager {
 	}
 
 	private function formatWiki( stdClass $row ): string {
-		static $wikiNameCache = [];
+		static $escapedNamesCache = [];
 		$wikiID = $row->cec_wiki;
-		$wikiNameCache[$wikiID] ??= $this->wikiLookup->getLocalizedNames( [ $wikiID ] )[$wikiID];
-		return $wikiNameCache[$wikiID];
+		$escapedNamesCache[$wikiID] ??= htmlspecialchars(
+			$this->wikiLookup->getLocalizedNames( [ $wikiID ] )[$wikiID]
+		);
+		return $escapedNamesCache[$wikiID];
 	}
 
 	/**
-- 
2.43.0