| Index: trunk/phase3/includes/EditPage.php |
| — | — | @@ -556,8 +556,8 @@ |
| 557 | 557 | global $wgUser; |
| 558 | 558 | if( $wgUser->isAnon() ) { |
| 559 | 559 | # Anonymous users may not have a session |
| 560 | | - # open. Don't tokenize. |
| 561 | | - $this->mTokenOk = true; |
| | 560 | + # open. Check for suffix anyway. |
| | 561 | + $this->mTokenOk = ( EDIT_TOKEN_SUFFIX == $request->getVal( 'wpEditToken' ) ); |
| 562 | 562 | } else { |
| 563 | 563 | $this->mTokenOk = $wgUser->matchEditToken( $request->getVal( 'wpEditToken' ) ); |
| 564 | 564 | } |
| — | — | @@ -1247,19 +1247,25 @@ |
| 1248 | 1248 | </div> |
| 1249 | 1249 | " ); |
| 1250 | 1250 | |
| 1251 | | - if ( $wgUser->isLoggedIn() ) { |
| 1252 | | - /** |
| 1253 | | - * To make it harder for someone to slip a user a page |
| 1254 | | - * which submits an edit form to the wiki without their |
| 1255 | | - * knowledge, a random token is associated with the login |
| 1256 | | - * session. If it's not passed back with the submission, |
| 1257 | | - * we won't save the page, or render user JavaScript and |
| 1258 | | - * CSS previews. |
| 1259 | | - */ |
| | 1251 | + /** |
| | 1252 | + * To make it harder for someone to slip a user a page |
| | 1253 | + * which submits an edit form to the wiki without their |
| | 1254 | + * knowledge, a random token is associated with the login |
| | 1255 | + * session. If it's not passed back with the submission, |
| | 1256 | + * we won't save the page, or render user JavaScript and |
| | 1257 | + * CSS previews. |
| | 1258 | + * |
| | 1259 | + * For anon editors, who may not have a session, we just |
| | 1260 | + * include the constant suffix to prevent editing from |
| | 1261 | + * broken text-mangling proxies. |
| | 1262 | + */ |
| | 1263 | + if ( $wgUser->isLoggedIn() ) |
| 1260 | 1264 | $token = htmlspecialchars( $wgUser->editToken() ); |
| 1261 | | - $wgOut->addHTML( "\n<input type='hidden' value=\"$token\" name=\"wpEditToken\" />\n" ); |
| 1262 | | - } |
| | 1265 | + else |
| | 1266 | + $token = EDIT_TOKEN_SUFFIX; |
| | 1267 | + $wgOut->addHTML( "\n<input type='hidden' value=\"$token\" name=\"wpEditToken\" />\n" ); |
| 1263 | 1268 | |
| | 1269 | + |
| 1264 | 1270 | # If a blank edit summary was previously provided, and the appropriate |
| 1265 | 1271 | # user preference is active, pass a hidden tag here. This will stop the |
| 1266 | 1272 | # user being bounced back more than once in the event that a summary |
| Index: trunk/phase3/includes/User.php |
| — | — | @@ -11,6 +11,11 @@ |
| 12 | 12 | # Serialized record version |
| 13 | 13 | define( 'MW_USER_VERSION', 4 ); |
| 14 | 14 | |
| | 15 | +# Some punctuation to prevent editing from broken text-mangling proxies. |
| | 16 | +# FIXME: this is embedded unescaped into HTML attributes in various |
| | 17 | +# places, so we can't safely include ' or " even though we really should. |
| | 18 | +define( 'EDIT_TOKEN_SUFFIX', '\\' ); |
| | 19 | + |
| 15 | 20 | /** |
| 16 | 21 | * |
| 17 | 22 | * @package MediaWiki |
| — | — | @@ -2093,7 +2098,7 @@ |
| 2094 | 2099 | if( is_array( $salt ) ) { |
| 2095 | 2100 | $salt = implode( '|', $salt ); |
| 2096 | 2101 | } |
| 2097 | | - return md5( $token . $salt ); |
| | 2102 | + return md5( $token . $salt ) . EDIT_TOKEN_SUFFIX; |
| 2098 | 2103 | } |
| 2099 | 2104 | |
| 2100 | 2105 | /** |
