@@ -696,6 +699,7 @@ class PreferencesForm {

+ \n" ); } } diff --git a/includes/SpecialUndelete.php b/includes/SpecialUndelete.php index dbfe7cced7..9d874d4f8f 100644 --- a/includes/SpecialUndelete.php +++ b/includes/SpecialUndelete.php @@ -275,10 +275,13 @@ class UndeleteForm { var $mTargetTimestamp; function UndeleteForm( &$request, $par = "" ) { + global $wgUser; $this->mAction = $request->getText( 'action' ); $this->mTarget = $request->getText( 'target' ); $this->mTimestamp = $request->getText( 'timestamp' ); - $this->mRestore = $request->getCheck( 'restore' ) && $request->wasPosted(); + $this->mRestore = $request->getCheck( 'restore' ) && + $request->wasPosted() && + $wgUser->matchEditToken( $request->getVal( 'wpEditToken' ) ); if( $par != "" ) { $this->mTarget = $par; } @@ -376,11 +379,13 @@ class UndeleteForm { $action = $titleObj->escapeLocalURL( "action=submit" ); $encTarget = htmlspecialchars( $this->mTarget ); $button = htmlspecialchars( wfMsg("undeletebtn") ); + $token = htmlspecialchars( $wgUser->editToken() ); $wgOut->addHTML("

+ "); # Show relevant lines from the deletion log: diff --git a/includes/SpecialUnlockdb.php b/includes/SpecialUnlockdb.php index 222a32417a..9184ab0360 100644 --- a/includes/SpecialUnlockdb.php +++ b/includes/SpecialUnlockdb.php @@ -18,9 +18,14 @@ function wfSpecialUnlockdb() { $action = $wgRequest->getVal( 'action' ); $f = new DBUnlockForm(); - if ( "success" == $action ) { $f->showSuccess(); } - else if ( "submit" == $action && $wgRequest->wasPosted() ) { $f->doSubmit(); } - else { $f->showForm( "" ); } + if ( "success" == $action ) { + $f->showSuccess(); + } else if ( "submit" == $action && $wgRequest->wasPosted() && + $wgUser->matchEditToken( $wgRequest->getVal( 'wpEditToken' ) ) ) { + $f->doSubmit(); + } else { + $f->showForm( "" ); + } } /** @@ -44,6 +49,7 @@ class DBUnlockForm { $lb = htmlspecialchars( wfMsg( "unlockbtn" ) ); $titleObj = Title::makeTitle( NS_SPECIAL, "Unlockdb" ); $action = $titleObj->escapeLocalURL( "action=submit" ); + $token = htmlspecialchars( $wgUser->editToken() ); $wgOut->addHTML( << + END ); diff --git a/includes/SpecialUpload.php b/includes/SpecialUpload.php index 2a9bd399e3..75b12a367f 100644 --- a/includes/SpecialUpload.php +++ b/includes/SpecialUpload.php @@ -595,7 +595,8 @@ class UploadForm { * @return bool */ function verify( $tmpfile, $extension ) { - if( $this->triggersIEbug( $tmpfile ) ) { + if( $this->triggersIEbug( $tmpfile ) || + $this->triggersSafariBug( $tmpfile ) ) { return false; } @@ -681,10 +682,18 @@ class UploadForm { */ function triggersIEbug( $filename ) { $file = fopen( $filename, 'rb' ); - $chunk = strtolower( fread( $file, 200 ) ); + $chunk = strtolower( fread( $file, 256 ) ); fclose( $file ); - $tags = array( ' diff --git a/includes/User.php b/includes/User.php index 27bb4491d4..81f8130cb6 100644 --- a/includes/User.php +++ b/includes/User.php @@ -1210,15 +1210,22 @@ class User { * login credentials aren't being hijacked with a foreign form * submission. * + * @param mixed $salt - Optional function-specific data for hash. + * Use a string or an array of strings. * @return string * @access public */ - function editToken() { + function editToken( $salt = '' ) { if( !isset( $_SESSION['wsEditToken'] ) ) { $token = dechex( mt_rand() ) . dechex( mt_rand() ); $_SESSION['wsEditToken'] = $token; + } else { + $token = $_SESSION['wsEditToken']; + } + if( is_array( $salt ) ) { + $salt = implode( '|', $salt ); } - return $_SESSION['wsEditToken']; + return md5( $token . $salt ); } /** @@ -1227,14 +1234,13 @@ class User { * user's own login session, not a form submission from a third-party * site. * - * @param string $val + * @param string $val - the input value to compare + * @param string $salt - Optional function-specific data for hash * @return bool * @access public */ - function matchEditToken( $val ) { - if( !isset( $_SESSION['wsEditToken'] ) ) - return false; - return $_SESSION['wsEditToken'] == $val; + function matchEditToken( $val, $salt = '' ) { + return ( $val == $this->editToken( $salt ) ); } } diff --git a/languages/Language.php b/languages/Language.php index fb32735462..99d33c6a75 100644 --- a/languages/Language.php +++ b/languages/Language.php @@ -1300,6 +1300,9 @@ Last edit was by [[User:$3|$3]] ([[User talk:$3|Talk]]). ", # only shown if there is an edit comment 'editcomment' => "The edit comment was: \"$1\".", 'revertpage' => "Reverted edit of $2, changed back to last version by $1", +'sessionfailure' => 'There seems to be a problem with your login session; +this action has been canceled as a precaution against session hijacking. +Please hit "back" and reload the page you came from, then try again.', 'protectlogpage' => 'Protection_log', 'protectlogtext' => "Below is a list of page locks/unlocks. See [[Project:Protected page]] for more information.",