From b3920da02193f8215925542c986ad6d6e8cce2b0 Mon Sep 17 00:00:00 2001
From: Brian Wolff <bawolff+wn@gmail.com>
Date: Tue, 27 Oct 2015 02:31:00 -0600
Subject: [PATCH] SECURITY: Add class to <a> for patrol links so it can't be
 spoofed by user

Javascript used to look just for the patrollinks class, which
could be set by the user in order to patrol an arbitrary page.

Requiring the class on the <a> tag prevents the user from setting
it.

Bug: T103239
Change-Id: I13fcc3ce479c0a4a90a6217c2e5244f051eaf862
---
 includes/diff/DifferenceEngine.php                         | 2 +-
 includes/page/Article.php                                  | 2 +-
 resources/src/mediawiki.page/mediawiki.page.patrol.ajax.js | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/includes/diff/DifferenceEngine.php b/includes/diff/DifferenceEngine.php
index c138eec..1438b13 100644
--- a/includes/diff/DifferenceEngine.php
+++ b/includes/diff/DifferenceEngine.php
@@ -511,7 +511,7 @@ class DifferenceEngine extends ContextSource {
 					$this->mMarkPatrolledLink = ' <span class="patrollink">[' . Linker::linkKnown(
 						$this->mNewPage,
 						$this->msg( 'markaspatrolleddiff' )->escaped(),
-						array(),
+						array( 'class' => 'mw-patrollink' ),
 						array(
 							'action' => 'markpatrolled',
 							'rcid' => $rcid,
diff --git a/includes/page/Article.php b/includes/page/Article.php
index 56b9520..97412dc 100644
--- a/includes/page/Article.php
+++ b/includes/page/Article.php
@@ -1168,7 +1168,7 @@ class Article implements Page {
 		$link = Linker::linkKnown(
 			$this->getTitle(),
 			wfMessage( 'markaspatrolledtext' )->escaped(),
-			array(),
+			array( 'class' => 'mw-patrollink' ),
 			array(
 				'action' => 'markpatrolled',
 				'rcid' => $rcid,
diff --git a/resources/src/mediawiki.page/mediawiki.page.patrol.ajax.js b/resources/src/mediawiki.page/mediawiki.page.patrol.ajax.js
index f9b0d35..e0307b7 100644
--- a/resources/src/mediawiki.page/mediawiki.page.patrol.ajax.js
+++ b/resources/src/mediawiki.page/mediawiki.page.patrol.ajax.js
@@ -12,7 +12,7 @@
 		return;
 	}
 	$( function () {
-		var $patrolLinks = $( '.patrollink a' );
+		var $patrolLinks = $( '.patrollink a.mw-patrollink' );
 		$patrolLinks.on( 'click', function ( e ) {
 			var $spinner, href, rcid, apiRequest;
 
-- 
2.6.6