| Index: trunk/phase3/includes/OutputPage.php |
| — | — | @@ -2628,8 +2628,7 @@ |
| 2629 | 2629 | |
| 2630 | 2630 | // Add user JS if enabled |
| 2631 | 2631 | if ( $wgAllowUserJs && $this->getUser()->isLoggedIn() ) { |
| 2632 | | - $action = $this->getRequest()->getVal( 'action', 'view' ); |
| 2633 | | - if( $this->getTitle() && $this->getTitle()->isJsSubpage() && $sk->userCanPreview( $action ) ) { |
| | 2632 | + if( $this->getTitle() && $this->getTitle()->isJsSubpage() && $sk->userCanPreview() ) { |
| 2634 | 2633 | # XXX: additional security check/prompt? |
| 2635 | 2634 | $scripts .= Html::inlineScript( "\n" . $this->getRequest()->getText( 'wpTextbox1' ) . "\n" ) . "\n"; |
| 2636 | 2635 | } else { |
| Index: trunk/phase3/includes/Title.php |
| — | — | @@ -1400,8 +1400,6 @@ |
| 1401 | 1401 | private function checkCSSandJSPermissions( $action, $user, $errors, $doExpensiveQueries, $short ) { |
| 1402 | 1402 | # Protect css/js subpages of user pages |
| 1403 | 1403 | # XXX: this might be better using restrictions |
| 1404 | | - # XXX: Find a way to work around the php bug that prevents using $this->userCanEditCssSubpage() |
| 1405 | | - # and $this->userCanEditJsSubpage() from working |
| 1406 | 1404 | # XXX: right 'editusercssjs' is deprecated, for backward compatibility only |
| 1407 | 1405 | if ( $action != 'patrol' && !$user->isAllowed( 'editusercssjs' ) |
| 1408 | 1406 | && !preg_match( '/^' . preg_quote( $user->getName(), '/' ) . '\//', $this->mTextform ) ) { |
| — | — | @@ -2006,11 +2004,12 @@ |
| 2007 | 2005 | * Protect css subpages of user pages: can $wgUser edit |
| 2008 | 2006 | * this page? |
| 2009 | 2007 | * |
| | 2008 | + * @deprecated in 1.19; will be removed in 1.20. Use getUserPermissionsErrors() instead. |
| 2010 | 2009 | * @return Bool |
| 2011 | | - * @todo XXX: this might be better using restrictions |
| 2012 | 2010 | */ |
| 2013 | 2011 | public function userCanEditCssSubpage() { |
| 2014 | 2012 | global $wgUser; |
| | 2013 | + wfDeprecated( __METHOD__ ); |
| 2015 | 2014 | return ( ( $wgUser->isAllowedAll( 'editusercssjs', 'editusercss' ) ) |
| 2016 | 2015 | || preg_match( '/^' . preg_quote( $wgUser->getName(), '/' ) . '\//', $this->mTextform ) ); |
| 2017 | 2016 | } |
| — | — | @@ -2019,11 +2018,12 @@ |
| 2020 | 2019 | * Protect js subpages of user pages: can $wgUser edit |
| 2021 | 2020 | * this page? |
| 2022 | 2021 | * |
| | 2022 | + * @deprecated in 1.19; will be removed in 1.20. Use getUserPermissionsErrors() instead. |
| 2023 | 2023 | * @return Bool |
| 2024 | | - * @todo XXX: this might be better using restrictions |
| 2025 | 2024 | */ |
| 2026 | 2025 | public function userCanEditJsSubpage() { |
| 2027 | 2026 | global $wgUser; |
| | 2027 | + wfDeprecated( __METHOD__ ); |
| 2028 | 2028 | return ( ( $wgUser->isAllowedAll( 'editusercssjs', 'edituserjs' ) ) |
| 2029 | 2029 | || preg_match( '/^' . preg_quote( $wgUser->getName(), '/' ) . '\//', $this->mTextform ) ); |
| 2030 | 2030 | } |
| Index: trunk/phase3/includes/SkinTemplate.php |
| — | — | @@ -1296,10 +1296,8 @@ |
| 1297 | 1297 | global $wgRequest, $wgJsMimeType; |
| 1298 | 1298 | wfProfileIn( __METHOD__ ); |
| 1299 | 1299 | |
| 1300 | | - $action = $wgRequest->getVal( 'action', 'view' ); |
| 1301 | | - |
| 1302 | 1300 | if( $allowUserJs && $this->loggedin ) { |
| 1303 | | - if( $this->getTitle()->isJsSubpage() and $this->userCanPreview( $action ) ) { |
| | 1301 | + if( $this->getTitle()->isJsSubpage() and $this->userCanPreview() ) { |
| 1304 | 1302 | # XXX: additional security check/prompt? |
| 1305 | 1303 | $this->userjsprev = '/*<![CDATA[*/ ' . $wgRequest->getText( 'wpTextbox1' ) . ' /*]]>*/'; |
| 1306 | 1304 | } else { |
| Index: trunk/phase3/includes/Skin.php |
| — | — | @@ -314,25 +314,21 @@ |
| 315 | 315 | * passed back with the preview request, we won't render |
| 316 | 316 | * the code. |
| 317 | 317 | * |
| 318 | | - * @param $action String: 'edit', 'submit' etc. |
| 319 | 318 | * @return bool |
| 320 | 319 | */ |
| 321 | | - public function userCanPreview( $action ) { |
| 322 | | - if ( $action != 'submit' ) { |
| 323 | | - return false; |
| | 320 | + public function userCanPreview() { |
| | 321 | + if ( $this->getRequest()->getVal( 'action' ) != 'submit' |
| | 322 | + || !$this->getRequest()->wasPosted() |
| | 323 | + || !$this->getUser()->matchEditToken( |
| | 324 | + $this->getRequest()->getVal( 'wpEditToken' ) ) |
| | 325 | + ) { |
| | 326 | + #return false; |
| 324 | 327 | } |
| 325 | | - if ( !$this->getRequest()->wasPosted() ) { |
| | 328 | + if ( !$this->getTitle()->isJsSubpage() && !$this->getTitle()->isCssSubpage() ) { |
| 326 | 329 | return false; |
| 327 | 330 | } |
| 328 | | - if ( !$this->getTitle()->userCanEditCssSubpage() ) { |
| 329 | | - return false; |
| 330 | | - } |
| 331 | | - if ( !$this->getTitle()->userCanEditJsSubpage() ) { |
| 332 | | - return false; |
| 333 | | - } |
| 334 | 331 | |
| 335 | | - return $this->getUser()->matchEditToken( |
| 336 | | - $this->getRequest()->getVal( 'wpEditToken' ) ); |
| | 332 | + return !count( $this->getTitle()->getUserPermissionsErrors( 'edit', $this->getUser() ) ); |
| 337 | 333 | } |
| 338 | 334 | |
| 339 | 335 | /** |
| — | — | @@ -386,7 +382,7 @@ |
| 387 | 383 | |
| 388 | 384 | // Per-user custom styles |
| 389 | 385 | if ( $wgAllowUserCss ) { |
| 390 | | - if ( $this->getTitle()->isCssSubpage() && $this->userCanPreview( $this->getRequest()->getVal( 'action' ) ) ) { |
| | 386 | + if ( $this->getTitle()->isCssSubpage() && $this->userCanPreview() ) { |
| 391 | 387 | // @todo FIXME: Properly escape the cdata! |
| 392 | 388 | $out->addInlineStyle( $this->getRequest()->getText( 'wpTextbox1' ) ); |
| 393 | 389 | } else { |