Merge "Don't "preview" (i.e. execute) user JS on non-preview requests"
authorjenkins-bot <jenkins-bot@gerrit.wikimedia.org>
Fri, 20 Nov 2015 23:59:02 +0000 (23:59 +0000)
committerGerrit Code Review <gerrit@wikimedia.org>
Fri, 20 Nov 2015 23:59:02 +0000 (23:59 +0000)
includes/OutputPage.php

index 81724c5..c35204d 100644 (file)
@@ -3309,7 +3309,11 @@ class OutputPage extends ContextSource {
         */
        public function userCanPreview() {
                $request = $this->getRequest();
-               if ( $request->getVal( 'action' ) !== 'submit' || !$request->wasPosted() ) {
+               if (
+                       $request->getVal( 'action' ) !== 'submit' ||
+                       !$request->getCheck( 'wpPreview' ) ||
+                       !$request->wasPosted()
+               ) {
                        return false;
                }