Bump to 1.5alpha21.5.0alpha2

2 files changed, 15 insertions, 1 deletions

diff --git a/includes/DefaultSettings.php b/includes/DefaultSettings.php
index bba8c6dc3811..ffb26c194be9 100644
--- a/includes/DefaultSettings.php
+++ b/includes/DefaultSettings.php
@@ -18,7 +18,7 @@ if( !defined( 'MEDIAWIKI' ) ) {
 }
 
 /** MediaWiki version number */
-$wgVersion			= '1.5alpha1';
+$wgVersion			= '1.5alpha2';
 
 /** Name of the site. It must be changed in LocalSettings.php */
 $wgSitename         = 'MediaWiki';
diff --git a/includes/Sanitizer.php b/includes/Sanitizer.php
index 40016d93b2d1..9f05ed87cd86 100644
--- a/includes/Sanitizer.php
+++ b/includes/Sanitizer.php
@@ -539,6 +539,20 @@ class Sanitizer {
 				continue;
 			}
 			
+			# Templates and links may be expanded in later parsing,
+			# creating invalid or dangerous output. Suppress this.
+			$value = strtr( $value, array(
+				'{'    => '{',
+				'['    => '[',
+				"''"   => '''',
+				'ISBN' => 'ISBN',
+				'RFC'  => 'RFC',
+				'PMID' => 'PMID',
+			) );
+			$value = preg_replace(
+				'/(' . URL_PROTOCOLS . '):/',
+				'\\1:', $value );
+			
 			if( !isset( $attribs[$attribute] ) ) {
 				$attribs[$attribute] = "$attribute=\"$value\"";
 			}