| Index: trunk/phase3/includes/HTMLForm.php |
| — | — | @@ -240,12 +240,27 @@ |
| 241 | 241 | * @return Status|boolean |
| 242 | 242 | */ |
| 243 | 243 | function tryAuthorizedSubmit() { |
| 244 | | - $editToken = $this->getRequest()->getVal( 'wpEditToken' ); |
| | 244 | + $result = false; |
| 245 | 245 | |
| 246 | | - $result = false; |
| 247 | | - if ( $this->getMethod() != 'post' || $this->getUser()->matchEditToken( $editToken ) ) { |
| | 246 | + $submit = false; |
| | 247 | + if ( $this->getMethod() != 'post' ) { |
| | 248 | + $submit = true; // no session check needed |
| | 249 | + } elseif ( $this->getRequest()->wasPosted() ) { |
| | 250 | + $editToken = $this->getRequest()->getVal( 'wpEditToken' ); |
| | 251 | + if ( $this->getUser()->isLoggedIn() || $editToken != null ) { |
| | 252 | + // Session tokens for logged-out users have no security value. |
| | 253 | + // However, if the user gave one, check it in order to give a nice |
| | 254 | + // "session expired" error instead of "permission denied" or such. |
| | 255 | + $submit = $this->getUser()->matchEditToken( $editToken ); |
| | 256 | + } else { |
| | 257 | + $submit = true; |
| | 258 | + } |
| | 259 | + } |
| | 260 | + |
| | 261 | + if ( $submit ) { |
| 248 | 262 | $result = $this->trySubmit(); |
| 249 | 263 | } |
| | 264 | + |
| 250 | 265 | return $result; |
| 251 | 266 | } |
| 252 | 267 | |