Merge "Special:Search: Remove token from URL when saving settings"

diff --combined includes/specials/SpecialSearch.php
index 71cd9ba,fb1f64b..59d65bc
--- 1/includes/specials/SpecialSearch.php
--- 2/includes/specials/SpecialSearch.php
+++ b/includes/specials/SpecialSearch.php
@@@ -82,8 -82,7 +82,8 @@@ class SpecialSearch extends SpecialPag
                $out = $this->getOutput();
                $out->allowClickjacking();
                $out->addModuleStyles( array(
 -                      'mediawiki.special', 'mediawiki.special.search', 'mediawiki.ui', 'mediawiki.ui.button'
 +                      'mediawiki.special', 'mediawiki.special.search', 'mediawiki.ui', 'mediawiki.ui.button',
 +                      'mediawiki.ui.input',
                ) );
  
                // Strip underscores from title parameter; most of the time we'll want
@@@ -96,6 -95,16 +96,16 @@@
                $search = str_replace( "\n", " ", $request->getText( 'search', $titleParam ) );
  
                $this->load();
+               if ( !is_null( $request->getVal( 'nsRemember' ) ) ) {
+                       $this->saveNamespaces();
+                       // Remove the token from the URL to prevent the user from inadvertently
+                       // exposing it (e.g. by pasting it into a public wiki page) or undoing
+                       // later settings changes (e.g. by reloading the page).
+                       $query = $request->getValues();
+                       unset( $query['title'], $query['nsRemember'] );
+                       $out->redirect( $this->getPageTitle()->getFullURL( $query ) );
+                       return;
+               }
  
                $this->searchEngineType = $request->getVal( 'srbackend' );
  
@@@ -186,11 -195,12 +196,11 @@@
                # No match, generate an edit URL
                $title = Title::newFromText( $term );
                if ( !is_null( $title ) ) {
 -                      global $wgGoToEdit;
                        wfRunHooks( 'SpecialSearchNogomatch', array( &$title ) );
                        wfDebugLog( 'nogomatch', $title->getFullText(), 'private' );
  
                        # If the feature is enabled, go straight to the edit page
 -                      if ( $wgGoToEdit ) {
 +                      if ( $this->getConfig()->get( 'GoToEdit' ) ) {
                                $this->getOutput()->redirect( $title->getFullURL( array( 'action' => 'edit' ) ) );
  
                                return;
@@@ -203,13 -213,12 +213,12 @@@
         * @param string $term
         */
        public function showResults( $term ) {
 -              global $wgDisableTextSearch, $wgSearchForwardUrl, $wgContLang, $wgScript;
 +              global $wgContLang;
  
                $profile = new ProfileSection( __METHOD__ );
                $search = $this->getSearchEngine();
                $search->setLimitOffset( $this->limit, $this->offset );
                $search->setNamespaces( $this->namespaces );
-               $this->saveNamespaces();
                $search->prefix = $this->mPrefix;
                $term = $search->transformSearchTerm( $term );
  
@@@ -219,10 -228,9 +228,10 @@@
  
                $out = $this->getOutput();
  
 -              if ( $wgDisableTextSearch ) {
 -                      if ( $wgSearchForwardUrl ) {
 -                              $url = str_replace( '$1', urlencode( $term ), $wgSearchForwardUrl );
 +              if ( $this->getConfig()->get( 'DisableTextSearch' ) ) {
 +                      $searchFowardUrl = $this->getConfig()->get( 'SearchForwardUrl' );
 +                      if ( $searchFowardUrl ) {
 +                              $url = str_replace( '$1', urlencode( $term ), $searchFowardUrl );
                                $out->redirect( $url );
                        } else {
                                $out->addHTML(
@@@ -304,7 -312,7 +313,7 @@@
                                array(
                                        'id' => ( $this->profile === 'advanced' ? 'powersearch' : 'search' ),
                                        'method' => 'get',
 -                                      'action' => $wgScript
 +                                      'action' => wfScript(),
                                )
                        )
                );
@@@ -347,9 -355,6 +356,9 @@@
                        // Show the create link ahead
                        $this->showCreateLink( $title, $num, $titleMatches, $textMatches );
                        if ( $totalRes > $this->limit || $this->offset ) {
 +                              if ( $this->searchEngineType !== null ) {
 +                                      $this->setExtraParam( 'srbackend', $this->searchEngineType );
 +                              }
                                $prevnext = $this->getLanguage()->viewPrevNext(
                                        $this->getPageTitle(),
                                        $this->offset,
@@@ -410,7 -415,7 +419,7 @@@
         * @param Title $title
         * @param int $num The number of search results found
         * @param null|SearchResultSet $titleMatches Results from title search
 -       * @param null|SearchResultSet $textMatches  Results from text search
 +       * @param null|SearchResultSet $textMatches Results from text search
         */
        protected function showCreateLink( $title, $num, $titleMatches, $textMatches ) {
                // show direct page/create link if applicable
@@@ -427,10 -432,8 +436,10 @@@
                        return;
                }
  
 +              $linkClass = 'mw-search-createlink';
                if ( $title->isKnown() ) {
                        $messageName = 'searchmenu-exists';
 +                      $linkClass = 'mw-search-exists';
                } elseif ( $title->quickUserCan( 'create', $this->getUser() ) ) {
                        $messageName = 'searchmenu-new';
                } else {
@@@ -445,7 -448,7 +454,7 @@@
  
                // Extensions using the hook might still return an empty $messageName
                if ( $messageName ) {
 -                      $this->getOutput()->wrapWikiMsg( "<p class=\"mw-search-createlink\">\n$1</p>", $params );
 +                      $this->getOutput()->wrapWikiMsg( "<p class=\"$linkClass\">\n$1</p>", $params );
                } else {
                        // preserve the paragraph for margins etc...
                        $this->getOutput()->addHtml( '<p></p>' );
@@@ -516,9 -519,8 +525,8 @@@
                $request = $this->getRequest();
  
                if ( $user->isLoggedIn() &&
-                       !is_null( $request->getVal( 'nsRemember' ) ) &&
                        $user->matchEditToken(
-                               $request->getVal( 'nsToken' ),
+                               $request->getVal( 'nsRemember' ),
                                'searchnamespace',
                                $request
                        )
@@@ -528,7 -530,7 +536,7 @@@
                        foreach ( MWNamespace::getValidNamespaces() as $n ) {
                                $user->setOption( 'searchNs' . $n, false );
                        }
-                       // The request parameters include all the namespaces we just searched.
+                       // The request parameters include all the namespaces to be searched.
                        // Even if they're the same as an existing profile, they're not eaten.
                        foreach ( $this->namespaces as $n ) {
                                $user->setOption( 'searchNs' . $n, true );
@@@ -651,6 -653,16 +659,6 @@@
  
                $lang = $this->getLanguage();
  
 -              // format score
 -              if ( is_null( $result->getScore() ) ) {
 -                      // Search engine doesn't report scoring info
 -                      $score = '';
 -              } else {
 -                      $percent = sprintf( '%2.1f', $result->getScore() * 100 );
 -                      $score = $this->msg( 'search-result-score' )->numParams( $percent )->text()
 -                              . ' - ';
 -              }
 -
                // format description
                $byteSize = $result->getByteSize();
                $wordCount = $result->getWordCount();
@@@ -710,9 -722,9 +718,9 @@@
                                                $thumb->toHtml( array( 'desc-link' => true ) ) .
                                                '</td>' .
                                                '<td style="vertical-align: top;">' .
 -                                              "{$link} {$fileMatch}" .
 +                                              "{$link} {$redirect} {$section} {$fileMatch}" .
                                                $extract .
 -                                              "<div class='mw-search-result-data'>{$score}{$desc} - {$date}{$related}</div>" .
 +                                              "<div class='mw-search-result-data'>{$desc} - {$date}{$related}</div>" .
                                                '</td>' .
                                                '</tr>' .
                                                '</table>' .
@@@ -723,7 -735,6 +731,7 @@@
  
                $html = null;
  
 +              $score = '';
                if ( wfRunHooks( 'ShowSearchHit', array(
                        $this, $result, $terms,
                        &$link, &$redirect, &$section, &$extract,
@@@ -732,7 -743,7 +740,7 @@@
                ) ) ) {
                        $html = "<li><div class='mw-search-result-heading'>" .
                                "{$link} {$redirect} {$section} {$fileMatch}</div> {$extract}\n" .
 -                              "<div class='mw-search-result-data'>{$score}{$size} - {$date}{$related}</div>" .
 +                              "<div class='mw-search-result-data'>{$size} - {$date}{$related}</div>" .
                                "</li>\n";
                }
  
@@@ -795,7 -806,7 +803,7 @@@
         * @param SearchResult $result
         * @param string $lastInterwiki
         * @param string $query
 -       * @param array $customCaptions iw prefix -> caption
 +       * @param array $customCaptions Interwiki prefix -> caption
         *
         * @return string
         */
@@@ -890,7 -901,9 +898,7 @@@
                        }
  
                        $rows[$subject] .=
 -                              Xml::openElement(
 -                                      'td', array( 'style' => 'white-space: nowrap' )
 -                              ) .
 +                              Xml::openElement( 'td' ) .
                                Xml::checkLabel(
                                        $name,
                                        "ns{$namespace}",
@@@ -932,26 -945,28 +940,25 @@@
                $remember = '';
                $user = $this->getUser();
                if ( $user->isLoggedIn() ) {
-                       $remember .= Html::hidden(
-                               'nsToken',
-                               $user->getEditToken(
-                                       'searchnamespace',
-                                       $this->getRequest()
-                               )
-                       ) .
-                       Xml::checkLabel(
+                       $remember .= Xml::checkLabel(
                                wfMessage( 'powersearch-remember' )->text(),
                                'nsRemember',
                                'mw-search-powersearch-remember',
-                               false
+                               false,
+                               // The token goes here rather than in a hidden field so it
+                               // is only sent when necessary (not every form submission).
+                               array( 'value' => $user->getEditToken(
+                                       'searchnamespace',
+                                       $this->getRequest()
+                               ) )
                        );
                }
  
                // Return final output
 -              return Xml::openElement(
 -                      'fieldset',
 -                      array( 'id' => 'mw-searchoptions', 'style' => 'margin:0em;' )
 -              ) .
 +              return Xml::openElement( 'fieldset', array( 'id' => 'mw-searchoptions' ) ) .
                        Xml::element( 'legend', null, $this->msg( 'powersearch-legend' )->text() ) .
                        Xml::tags( 'h4', null, $this->msg( 'powersearch-ns' )->parse() ) .
 -                      Html::element( 'div', array( 'id' => 'mw-search-togglebox' ) ) .
 +                      Xml::element( 'div', array( 'id' => 'mw-search-togglebox' ), '', false ) .
                        Xml::element( 'div', array( 'class' => 'divider' ), '', false ) .
                        implode( Xml::element( 'div', array( 'class' => 'divider' ), '', false ), $showSections ) .
                        $hidden .
@@@ -1068,8 -1083,6 +1075,8 @@@
  
        /**
         * @param string $term
 +       * @param int $resultsShown
 +       * @param int $totalNum
         * @return string
         */
        protected function shortDialog( $term, $resultsShown, $totalNum ) {
@@@ -1080,7 -1093,7 +1087,7 @@@
                        'id' => $this->profile === 'advanced' ? 'powerSearchText' : 'searchText',
                        'size' => '50',
                        'autofocus',
 -                      'class' => 'mw-ui-input',
 +                      'class' => 'mw-ui-input mw-ui-input-inline',
                ) ) . "\n";
                $out .= Html::hidden( 'fulltext', 'Search' ) . "\n";
                $out .= Xml::submitButton(
@@@ -1089,14 -1102,14 +1096,14 @@@
                ) . "\n";
  
                // Results-info
 -              if ( $totalNum > 0 ) {
 +              if ( $totalNum > 0 && $this->offset < $totalNum ) {
                        $top = $this->msg( 'showingresultsheader' )
                                ->numParams( $this->offset + 1, $this->offset + $resultsShown, $totalNum )
                                ->params( wfEscapeWikiText( $term ) )
                                ->numParams( $resultsShown )
                                ->parse();
                        $out .= Xml::tags( 'div', array( 'class' => 'results-info' ), $top ) .
 -                              Xml::element( 'div', array( 'style' => 'clear:both' ) );
 +                              Xml::element( 'div', array( 'style' => 'clear:both' ), '', false );
                }
  
                return $out . $this->didYouMeanHtml;