| Index: trunk/extensions/UploadWizard/includes/specials/SpecialUploadCampaigns.php |
| — | — | @@ -66,7 +66,8 @@ |
| 67 | 67 | && $wgRequest->getCheck( 'newcampaign' ) ) { |
| 68 | 68 | $this->getOutput()->redirect( SpecialPage::getTitleFor( 'UploadCampaign', $wgRequest->getVal( 'newcampaign' ) )->getLocalURL() ); |
| 69 | 69 | } |
| 70 | | - elseif ( count( $subPage ) == 2 && $subPage[0] == 'del' ) { |
| | 70 | + elseif ( count( $subPage ) == 2 && $subPage[0] == 'del' |
| | 71 | + && $wgUser->matchEditToken( $wgRequest->getVal( 'wpEditToken' ) ) ) { |
| 71 | 72 | $campaign = UploadWizardCampaign::newFromName( $subPage[1], false ); |
| 72 | 73 | $campaign->deleteFromDB(); |
| 73 | 74 | $this->getOutput()->redirect( $this->getTitle()->getLocalURL() ); |
| — | — | @@ -171,6 +172,9 @@ |
| 172 | 173 | |
| 173 | 174 | $out->addHTML( '<tbody>' ); |
| 174 | 175 | |
| | 176 | + global $wgUser; |
| | 177 | + $editToken = array( 'wpEditToken' => $wgUser->editToken() ); |
| | 178 | + |
| 175 | 179 | foreach ( $campaigns as $campaign ) { |
| 176 | 180 | $out->addHTML( |
| 177 | 181 | '<tr>' . |
| — | — | @@ -197,7 +201,7 @@ |
| 198 | 202 | Html::element( |
| 199 | 203 | 'a', |
| 200 | 204 | array( |
| 201 | | - 'href' => SpecialPage::getTitleFor( 'UploadCampaigns', 'del/' . $campaign->campaign_name )->getLocalURL(), |
| | 205 | + 'href' => SpecialPage::getTitleFor( 'UploadCampaigns', 'del/' . $campaign->campaign_name )->getLocalURL( $editToken ), |
| 202 | 206 | 'onclick' => 'return confirm( "' . wfMsg( 'mwe-upwiz-campaigns-confdel' ) . '" )' |
| 203 | 207 | ), |
| 204 | 208 | wfMsg( 'mwe-upwiz-campaigns-delete' ) |