r41155 MediaWiki - Code Review archive

Repository:MediaWiki
Revision:r41154‎ | r41155 | r41156 >
Date:14:37, 22 September 2008
Author:aaron
Status:old
Tags:
Comment:
rev_deleted security improvements as well as fix for rawpages
Modified paths:
  • /trunk/phase3/includes/Linker.php (modified) (history)
  • /trunk/phase3/includes/Revision.php (modified) (history)
  • /trunk/phase3/includes/api/ApiParse.php (modified) (history)
  • /trunk/phase3/includes/diff/DifferenceEngine.php (modified) (history)
  • /trunk/phase3/includes/specials/SpecialUndelete.php (modified) (history)

Diff [purge]

Index: trunk/phase3/includes/diff/DifferenceEngine.php
@@ -176,7 +176,7 @@
177177 $change = RecentChange::newFromConds(
178178 array(
179179 // Add redundant user,timestamp condition so we can use the existing index
180 - 'rc_user_text' => $this->mNewRev->getRawUserText(),
 180+ 'rc_user_text' => $this->mNewRev->getUserText(false),
181181 'rc_timestamp' => $db->timestamp( $this->mNewRev->getTimestamp() ),
182182 'rc_this_oldid' => $this->mNewid,
183183 'rc_last_oldid' => $this->mOldid,
Index: trunk/phase3/includes/Linker.php
@@ -1113,7 +1113,7 @@
11141114 if( $rev->isDeleted( Revision::DELETED_USER ) && $isPublic ) {
11151115 $link = wfMsgHtml( 'rev-deleted-user' );
11161116 } else if( $rev->userCan( Revision::DELETED_USER ) ) {
1117 - $link = $this->userLink( $rev->getRawUser(), $rev->getRawUserText() );
 1117+ $link = $this->userLink( $rev->getUser(false), $rev->getUserText(false) );
11181118 } else {
11191119 $link = wfMsgHtml( 'rev-deleted-user' );
11201120 }
@@ -1133,8 +1133,8 @@
11341134 if( $rev->isDeleted( Revision::DELETED_USER ) && $isPublic ) {
11351135 $link = wfMsgHtml( 'rev-deleted-user' );
11361136 } else if( $rev->userCan( Revision::DELETED_USER ) ) {
1137 - $link = $this->userLink( $rev->getRawUser(), $rev->getRawUserText() ) .
1138 - ' ' . $this->userToolLinks( $rev->getRawUser(), $rev->getRawUserText() );
 1137+ $link = $this->userLink( $rev->getUser(false), $rev->getUserText(false) ) .
 1138+ ' ' . $this->userToolLinks( $rev->getUser(false), $rev->getUserText(false) );
11391139 } else {
11401140 $link = wfMsgHtml( 'rev-deleted-user' );
11411141 }
@@ -1340,7 +1340,7 @@
13411341 if( $rev->isDeleted( Revision::DELETED_COMMENT ) && $isPublic ) {
13421342 $block = " <span class=\"comment\">" . wfMsgHtml( 'rev-deleted-comment' ) . "</span>";
13431343 } else if( $rev->userCan( Revision::DELETED_COMMENT ) ) {
1344 - $block = $this->commentBlock( $rev->getRawComment(), $rev->getTitle(), $local );
 1344+ $block = $this->commentBlock( $rev->getComment(false), $rev->getTitle(), $local );
13451345 } else {
13461346 $block = " <span class=\"comment\">" . wfMsgHtml( 'rev-deleted-comment' ) . "</span>";
13471347 }
Index: trunk/phase3/includes/api/ApiParse.php
@@ -63,7 +63,7 @@
6464 $this->dieUsage("There is no revision ID $oldid", 'missingrev');
6565 if(!$rev->userCan(Revision::DELETED_TEXT))
6666 $this->dieUsage("You don't have permission to view deleted revisions", 'permissiondenied');
67 - $text = $rev->getRawText();
 67+ $text = $rev->getText(false);
6868 $titleObj = $rev->getTitle();
6969 $p_result = $wgParser->parse($text, $titleObj, $popts);
7070 }
Index: trunk/phase3/includes/Revision.php
@@ -430,9 +430,11 @@
431431 * Fetch revision's user id if it's available to all users
432432 * @return int
433433 */
434 - public function getUser() {
435 - if( $this->isDeleted( self::DELETED_USER ) ) {
 434+ public function getUser( $isPublic = true ) {
 435+ if( $isPublic && $this->isDeleted( self::DELETED_USER ) ) {
436436 return 0;
 437+ } else if( !$this->userCan( self::DELETED_USER ) ) {
 438+ return 0;
437439 } else {
438440 return $this->mUser;
439441 }
@@ -450,9 +452,11 @@
451453 * Fetch revision's username if it's available to all users
452454 * @return string
453455 */
454 - public function getUserText() {
455 - if( $this->isDeleted( self::DELETED_USER ) ) {
 456+ public function getUserText( $isPublic = true ) {
 457+ if( $isPublic && $this->isDeleted( self::DELETED_USER ) ) {
456458 return "";
 459+ } else if( !$this->userCan( self::DELETED_USER ) ) {
 460+ return "";
457461 } else {
458462 return $this->mUserText;
459463 }
@@ -470,9 +474,11 @@
471475 * Fetch revision comment if it's available to all users
472476 * @return string
473477 */
474 - function getComment() {
475 - if( $this->isDeleted( self::DELETED_COMMENT ) ) {
 478+ function getComment( $isPublic = true ) {
 479+ if( $isPublic && $this->isDeleted( self::DELETED_COMMENT ) ) {
476480 return "";
 481+ } else if( !$this->userCan( self::DELETED_COMMENT ) ) {
 482+ return "";
477483 } else {
478484 return $this->mComment;
479485 }
Index: trunk/phase3/includes/specials/SpecialUndelete.php
@@ -1223,8 +1223,8 @@
12241224 if( !$file->userCan(File::DELETED_USER) ) {
12251225 return '<span class="history-deleted">' . wfMsgHtml( 'rev-deleted-user' ) . '</span>';
12261226 } else {
1227 - $link = $sk->userLink( $file->getRawUser(), $file->getRawUserText() ) .
1228 - $sk->userToolLinks( $file->getRawUser(), $file->getRawUserText() );
 1227+ $link = $sk->userLink( $file->getUser(false), $file->getUserText(false) ) .
 1228+ $sk->userToolLinks( $file->getUser(false), $file->getUserText(false) );
12291229 if( $file->isDeleted(File::DELETED_USER) )
12301230 $link = '<span class="history-deleted">' . $link . '</span>';
12311231 return $link;

Follow-up revisions

RevisionCommit summaryAuthorDate
r41222Fixes for r41154 and r41155:...tstarling09:44, 24 September 2008