Last modified: 2012-03-09 11:27:09 UTC
If you create a group with an HTML entity in it, say A&B, the group name is displayed on Special:Userrights as A&B. This is because the groupCheckboxes function in SpecialUserrights.php calls htmlspecialchars on the group name and then calls Xml::checkLabel which does another htmlspecialchars. I haven't tested this on 1.16.5 but a quick glance at the code shows that the problem still exists in trunk.
Group names are expected to be plaintext, I think...
Seems like the code should either not allow group names with entities or display them correctly. Incidentally, group names with entities works fine everywhere else.
(In reply to comment #1) > Group names are expected to be plaintext, I think... So, is this WONTFIX or ... ?
Hmm, I think the correct action would be 'validate group names'. A central place to validate the names, and calling that to check on various group-related entry points, should show up bad entries pretty quick. If there's any UI allowing to create or specify group names by hand those should call the validation as well.
Another place these group names doesn't work is on Special:Statistics. You get no results for users in that group.