Use a data attribute to better future proof
No One
Actions

Authored By

	Bawolff
	Nov 13 2015, 4:44 AM

Size

2 KB

Referenced Files

None

Subscribers

None

Use a data attribute to better future proof
View Options

	From 89032664861fce796e68a2268d16b2374556c322 Mon Sep 17 00:00:00 2001
	From: Brian Wolff <bawolff+wn@gmail.com>
	Date: Tue, 27 Oct 2015 02:31:00 -0600
	Subject: [PATCH] Add data attribute to <a> for patrol links so it can't be
	spoofed by user

	Javascript used to look just for the patrollinks class, which
	could be set by the user in order to patrol an arbitrary page.

	Requiring the attribute on the <a> tag prevents the user from setting
	it.

	Change-Id: I13fcc3ce479c0a4a90a6217c2e5244f051eaf862
	---
	includes/diff/DifferenceEngine.php \| 2 +-
	includes/page/Article.php \| 2 +-
	resources/src/mediawiki/page/patrol.js \| 2 +-
	3 files changed, 3 insertions(+), 3 deletions(-)

	diff --git a/includes/diff/DifferenceEngine.php b/includes/diff/DifferenceEngine.php
	index ae610fa..30d02f4 100644
	--- a/includes/diff/DifferenceEngine.php
	+++ b/includes/diff/DifferenceEngine.php
	@@ -510,7 +510,7 @@ class DifferenceEngine extends ContextSource {
	$this->mMarkPatrolledLink = ' <span class="patrollink">[' . Linker::linkKnown(
	$this->mNewPage,
	$this->msg( 'markaspatrolleddiff' )->escaped(),
	- array(),
	+ array( 'data-mw-patrollink' => 'yes' ),
	array(
	'action' => 'markpatrolled',
	'rcid' => $rcid,
	diff --git a/includes/page/Article.php b/includes/page/Article.php
	index 5d6435e..58fa3ea 100644
	--- a/includes/page/Article.php
	+++ b/includes/page/Article.php
	@@ -1167,7 +1167,7 @@ class Article implements Page {
	$link = Linker::linkKnown(
	$this->getTitle(),
	wfMessage( 'markaspatrolledtext' )->escaped(),
	- array(),
	+ array( 'data-mw-patrollink' => 'yes' ),
	array(
	'action' => 'markpatrolled',
	'rcid' => $rcid,
	diff --git a/resources/src/mediawiki/page/patrol.js b/resources/src/mediawiki/page/patrol.js
	index f9b0d35..2156dc1 100644
	--- a/resources/src/mediawiki/page/patrol.js
	+++ b/resources/src/mediawiki/page/patrol.js
	@@ -12,7 +12,7 @@
	return;
	}
	$( function () {
	- var $patrolLinks = $( '.patrollink a' );
	+ var $patrolLinks = $( '.patrollink a[data-mw-patrollink]' );
	$patrolLinks.on( 'click', function ( e ) {
	var $spinner, href, rcid, apiRequest;

	--
	2.0.1

File Metadata

Mime Type: text/x-diff
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 2968661
Default Alt Text: Use a data attribute to better future proof (2 KB)

Use a data attribute to better future proofNo OneActions

Use a data attribute to better future proofView Options

File Metadata

Event Timeline

Use a data attribute to better future proof
No One
Actions

Use a data attribute to better future proof
View Options