r108295 MediaWiki - Code Review archive

Repository:MediaWiki
Revision:r108294‎ | r108295 | r108296 >
Date:00:39, 7 January 2012
Author:ashley
Status:ok (Comments)
Tags:
Comment:
Comments: allow removing anonymous users from your ignore list. User::idFromName() returns null for anons, so we have to handle that here.
Modified paths:
  • /trunk/extensions/Comments/SpecialCommentIgnoreList.php (modified) (history)

Diff [purge]

Index: trunk/extensions/Comments/SpecialCommentIgnoreList.php
@@ -43,6 +43,11 @@
4444 } else {
4545 if( $wgRequest->wasPosted() ) {
4646 $user_id = User::idFromName( $user_name );
 47+ // Anons can be comment-blocked, but idFromName returns nothing
 48+ // for an anon, so...
 49+ if ( !$user_id ) {
 50+ $user_id = 0;
 51+ }
4752 $c = new Comment( 0 );
4853 $c->deleteBlock( $wgUser->getID(), $user_id );
4954 if( $user_id && class_exists( 'UserStatsTrack' ) ) {
@@ -108,7 +113,7 @@
109114 '</div>
110115 <div>
111116 <form action="" method="post" name="comment_block">
112 - <input type="hidden" name="' . $user_name . '" />
 117+ <input type="hidden" name="user" value="' . $user_name . '" />
113118 <input type="button" class="site-button" value="' . wfMsg( 'comment-ignore-unblock' ) . '" onclick="document.comment_block.submit()" />
114119 <input type="button" class="site-button" value="' . wfMsg( 'comment-ignore-cancel' ) . '" onclick="history.go(-1)" />
115120 </form>

Follow-up revisions

RevisionCommit summaryAuthorDate
r108320Comments: follow-up to r108295: XSS fixashley15:09, 7 January 2012

Comments

#Comment by Nikerabbit (talk | contribs)   10:25, 7 January 2012

How about fixing the glaring XSS holes in there?

#Comment by Jack Phoenix (talk | contribs)   15:10, 7 January 2012

Ouch, thanks for spotting that! Should be fixed in the follow-up revision, r108320.

Status & tagging log