| Index: trunk/phase3/includes/diff/DifferenceInterface.php |
| — | — | @@ -236,13 +236,15 @@ |
| 237 | 237 | } |
| 238 | 238 | // Build the link |
| 239 | 239 | if( $rcid ) { |
| | 240 | + $token = $wgUser->editToken( $rcid ); |
| 240 | 241 | $patrol = ' <span class="patrollink">[' . $sk->link( |
| 241 | 242 | $this->mTitle, |
| 242 | 243 | wfMsgHtml( 'markaspatrolleddiff' ), |
| 243 | 244 | array(), |
| 244 | 245 | array( |
| 245 | 246 | 'action' => 'markpatrolled', |
| 246 | | - 'rcid' => $rcid |
| | 247 | + 'rcid' => $rcid, |
| | 248 | + 'token' => $token, |
| 247 | 249 | ), |
| 248 | 250 | array( |
| 249 | 251 | 'known', |
| — | — | @@ -461,6 +463,7 @@ |
| 462 | 464 | # Add redundant patrol link on bottom... |
| 463 | 465 | if( $this->mRcidMarkPatrolled && $this->mTitle->quickUserCan('patrol') ) { |
| 464 | 466 | $sk = $wgUser->getSkin(); |
| | 467 | + $token = $wgUser->editToken( $this->mRcidMarkPatrolled ); |
| 465 | 468 | $wgOut->addHTML( |
| 466 | 469 | "<div class='patrollink'>[" . $sk->link( |
| 467 | 470 | $this->mTitle, |
| — | — | @@ -468,7 +471,8 @@ |
| 469 | 472 | array(), |
| 470 | 473 | array( |
| 471 | 474 | 'action' => 'markpatrolled', |
| 472 | | - 'rcid' => $this->mRcidMarkPatrolled |
| | 475 | + 'rcid' => $this->mRcidMarkPatrolled, |
| | 476 | + 'token' => $token, |
| 473 | 477 | ) |
| 474 | 478 | ) . ']</div>' |
| 475 | 479 | ); |
| Index: trunk/phase3/includes/Article.php |
| — | — | @@ -1316,6 +1316,7 @@ |
| 1317 | 1317 | } |
| 1318 | 1318 | |
| 1319 | 1319 | $sk = $wgUser->getSkin(); |
| | 1320 | + $token = $wgUser->editToken( $rcid ); |
| 1320 | 1321 | |
| 1321 | 1322 | $wgOut->addHTML( |
| 1322 | 1323 | "<div class='patrollink'>" . |
| — | — | @@ -1327,7 +1328,8 @@ |
| 1328 | 1329 | array(), |
| 1329 | 1330 | array( |
| 1330 | 1331 | 'action' => 'markpatrolled', |
| 1331 | | - 'rcid' => $rcid |
| | 1332 | + 'rcid' => $rcid, |
| | 1333 | + 'token' => $token, |
| 1332 | 1334 | ), |
| 1333 | 1335 | array( 'known', 'noclasses' ) |
| 1334 | 1336 | ) |
| — | — | @@ -2358,12 +2360,18 @@ |
| 2359 | 2361 | * Mark this particular edit/page as patrolled |
| 2360 | 2362 | */ |
| 2361 | 2363 | public function markpatrolled() { |
| 2362 | | - global $wgOut, $wgRequest; |
| | 2364 | + global $wgOut, $wgUser, $wgRequest; |
| 2363 | 2365 | |
| 2364 | 2366 | $wgOut->setRobotPolicy( 'noindex,nofollow' ); |
| 2365 | 2367 | |
| 2366 | 2368 | # If we haven't been given an rc_id value, we can't do anything |
| 2367 | 2369 | $rcid = (int) $wgRequest->getVal( 'rcid' ); |
| | 2370 | + |
| | 2371 | + if ( !$wgUser->matchEditToken( $wgRequest->getVal( 'token' ), $rcid ) ) { |
| | 2372 | + $wgOut->showErrorPage( 'sessionfailure-title', 'sessionfailure' ); |
| | 2373 | + return; |
| | 2374 | + } |
| | 2375 | + |
| 2368 | 2376 | $rc = RecentChange::newFromId( $rcid ); |
| 2369 | 2377 | |
| 2370 | 2378 | if ( is_null( $rc ) ) { |
| Index: trunk/phase3/RELEASE-NOTES |
| — | — | @@ -122,6 +122,7 @@ |
| 123 | 123 | * (bug 671) The <dfn> element has been whitelisted in user input. |
| 124 | 124 | * (bug 24563) Entries on Special:WhatLinksHere now have a link to their history |
| 125 | 125 | * (bug 21503) There's now a "reason" field when creating account for other users |
| | 126 | +* (bug 24418) action=markpatrolled now requires a token |
| 126 | 127 | |
| 127 | 128 | === Bug fixes in 1.17 === |
| 128 | 129 | * (bug 17560) Half-broken deletion moved image files to deletion archive |