(bug 33992) - "Allow anon a formless purge with POST". Changed HTMLForm::tryAuthorize...

diff --git a/includes/HTMLForm.php b/includes/HTMLForm.php
index acc6b23..7326bf5 100644 (file)
--- a/includes/HTMLForm.php
+++ b/includes/HTMLForm.php
@@ -240,12 +240,27 @@ class HTMLForm extends ContextSource {
         * @return Status|boolean
         */
        function tryAuthorizedSubmit() {
-               $editToken = $this->getRequest()->getVal( 'wpEditToken' );
-
                $result = false;
-               if ( $this->getMethod() != 'post' || $this->getUser()->matchEditToken( $editToken ) ) {
+
+               $submit = false;
+               if ( $this->getMethod() != 'post' ) {
+                       $submit = true; // no session check needed
+               } elseif ( $this->getRequest()->wasPosted() ) {
+                       $editToken = $this->getRequest()->getVal( 'wpEditToken' );
+                       if ( $this->getUser()->isLoggedIn() || $editToken != null ) {
+                               // Session tokens for logged-out users have no security value.
+                               // However, if the user gave one, check it in order to give a nice 
+                               // "session expired" error instead of "permission denied" or such.
+                               $submit = $this->getUser()->matchEditToken( $editToken );
+                       } else {
+                               $submit = true;
+                       }
+               }
+
+               if ( $submit ) {
                        $result = $this->trySubmit();
                }
+
                return $result;
        }