Page MenuHomePhabricator
Files F2880385

patrol.patch
Bawolff (Brian Wolff)
Actions

Authored By
Bawolff
Oct 27 2015, 9:28 AM
Size
2 KB
Referenced Files
None
Subscribers
None

patrol.patch
View Options

From 195a3cefc6ba5cd1289829068d34c0727a6075d3 Mon Sep 17 00:00:00 2001
From: Brian Wolff <bawolff+wn@gmail.com>
Date: Tue, 27 Oct 2015 02:31:00 -0600
Subject: [PATCH] Add class to <a> for patrol links so it can't be spoofed by
user
Javascript used to look just for the patrollinks class, which
could be set by the user in order to patrol an arbitrary page.
Requiring the class on the <a> tag prevents the user from setting
it.
Change-Id: I13fcc3ce479c0a4a90a6217c2e5244f051eaf862
---
includes/diff/DifferenceEngine.php | 2 +-
includes/page/Article.php | 2 +-
resources/src/mediawiki/page/patrol.js | 2 +-
3 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/includes/diff/DifferenceEngine.php b/includes/diff/DifferenceEngine.php
index ae610fa..f5ff44f 100644
--- a/includes/diff/DifferenceEngine.php
+++ b/includes/diff/DifferenceEngine.php
@@ -510,7 +510,7 @@ class DifferenceEngine extends ContextSource {
$this->mMarkPatrolledLink = ' <span class="patrollink">[' . Linker::linkKnown(
$this->mNewPage,
$this->msg( 'markaspatrolleddiff' )->escaped(),
- array(),
+ array( 'class' => 'mw-patrollink' ),
array(
'action' => 'markpatrolled',
'rcid' => $rcid,
diff --git a/includes/page/Article.php b/includes/page/Article.php
index 5d6435e..408b532 100644
--- a/includes/page/Article.php
+++ b/includes/page/Article.php
@@ -1167,7 +1167,7 @@ class Article implements Page {
$link = Linker::linkKnown(
$this->getTitle(),
wfMessage( 'markaspatrolledtext' )->escaped(),
- array(),
+ array( 'class' => 'mw-patrollink' ),
array(
'action' => 'markpatrolled',
'rcid' => $rcid,
diff --git a/resources/src/mediawiki/page/patrol.js b/resources/src/mediawiki/page/patrol.js
index f9b0d35..e0307b7 100644
--- a/resources/src/mediawiki/page/patrol.js
+++ b/resources/src/mediawiki/page/patrol.js
@@ -12,7 +12,7 @@
return;
}
$( function () {
- var $patrolLinks = $( '.patrollink a' );
+ var $patrolLinks = $( '.patrollink a.mw-patrollink' );
$patrolLinks.on( 'click', function ( e ) {
var $spinner, href, rcid, apiRequest;
--
2.0.1

File Metadata

Mime Type
text/x-diff
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
2892012
Default Alt Text
patrol.patch (2 KB)

Event Timeline

Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL