From 89032664861fce796e68a2268d16b2374556c322 Mon Sep 17 00:00:00 2001 From: Brian Wolff Date: Tue, 27 Oct 2015 02:31:00 -0600 Subject: [PATCH] Add data attribute to for patrol links so it can't be spoofed by user Javascript used to look just for the patrollinks class, which could be set by the user in order to patrol an arbitrary page. Requiring the attribute on the tag prevents the user from setting it. Change-Id: I13fcc3ce479c0a4a90a6217c2e5244f051eaf862 --- includes/diff/DifferenceEngine.php | 2 +- includes/page/Article.php | 2 +- resources/src/mediawiki/page/patrol.js | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/includes/diff/DifferenceEngine.php b/includes/diff/DifferenceEngine.php index ae610fa..30d02f4 100644 --- a/includes/diff/DifferenceEngine.php +++ b/includes/diff/DifferenceEngine.php @@ -510,7 +510,7 @@ class DifferenceEngine extends ContextSource { $this->mMarkPatrolledLink = ' [' . Linker::linkKnown( $this->mNewPage, $this->msg( 'markaspatrolleddiff' )->escaped(), - array(), + array( 'data-mw-patrollink' => 'yes' ), array( 'action' => 'markpatrolled', 'rcid' => $rcid, diff --git a/includes/page/Article.php b/includes/page/Article.php index 5d6435e..58fa3ea 100644 --- a/includes/page/Article.php +++ b/includes/page/Article.php @@ -1167,7 +1167,7 @@ class Article implements Page { $link = Linker::linkKnown( $this->getTitle(), wfMessage( 'markaspatrolledtext' )->escaped(), - array(), + array( 'data-mw-patrollink' => 'yes' ), array( 'action' => 'markpatrolled', 'rcid' => $rcid, diff --git a/resources/src/mediawiki/page/patrol.js b/resources/src/mediawiki/page/patrol.js index f9b0d35..2156dc1 100644 --- a/resources/src/mediawiki/page/patrol.js +++ b/resources/src/mediawiki/page/patrol.js @@ -12,7 +12,7 @@ return; } $( function () { - var $patrolLinks = $( '.patrollink a' ); + var $patrolLinks = $( '.patrollink a[data-mw-patrollink]' ); $patrolLinks.on( 'click', function ( e ) { var $spinner, href, rcid, apiRequest; -- 2.0.1