Use token for reseting the update markers on the watchlist
Closed, DuplicatePublic
Actions

Assigned To

None

Authored By

	duplicatebug
	Jan 31 2013, 7:19 PM

Description

Since fix of T25655 adding a page to the watchlist needs a token.
The api module setnotificationtimestamp also required a token.
MediaWiki should force a token at least for the reset="all" on the watchlist.

Version: 1.21.x
Severity: normal

Details

Reference: bz44563

Related Objects

Mentioned Here: T25655: ArticleSaveComplete hook should allow hook functions to cause the display of a customizable "Action complete" screen instead of rendering the revised page

Event Timeline

• bzimport raised the priority of this task from to High.Nov 22 2014, 1:26 AM

• bzimport added a project: MediaWiki-Watchlist.

• bzimport set Reference to bz44563.

• bzimport added a subscriber: Unknown Object (MLST).

duplicatebug created this task.Jan 31 2013, 7:19 PM

should force a token

What is currently the problem? Things don't work?

The reset option does write actions on the database, so this should be protected against CSRF or so. You can submit a post against https://www.mediawiki.org/wiki/Special:Watchlist?reset=all and the show marker on the watclist of the logged in user gets cleared.

duplicatebug unsubscribed.Dec 13 2014, 4:10 PM

Aklapper lowered the priority of this task from High to Low.Nov 27 2019, 5:12 PM

Aklapper edited subscribers, added: Aklapper; removed: • wikibugs-l-list.

Restricted Application added a project: Growth-Team. · View Herald TranscriptNov 27 2019, 5:12 PM

Aklapper updated the task description. (Show Details)Nov 27 2019, 5:12 PM

MBinder_WMF added a project: Growth-Team-Filtering.Apr 15 2021, 7:05 PM

Umherirrender closed this task as a duplicate of T150044: "Mark all pages visited" on the watchlist does not require a CSRF token.Aug 19 2021, 10:17 PM

Use token for reseting the update markers on the watchlistClosed, DuplicatePublicActions

Description

Details

Related Objects

Event Timeline

Use token for reseting the update markers on the watchlist
Closed, DuplicatePublic
Actions