Fix bug http://bugzilla.wikipedia.org/show_bug.cgi?id=705

[lhc/web/wiklou.git] / includes / SpecialMovepage.php

diff --git a/includes/SpecialMovepage.php b/includes/SpecialMovepage.php
index bbb2de9..b7e6e2b 100644 (file)
--- a/includes/SpecialMovepage.php
+++ b/includes/SpecialMovepage.php
@@ -1,8 +1,19 @@
 <?php
+/**
+ *
+ * @package MediaWiki
+ * @subpackage SpecialPage
+ */
+
+/**
+ *
+ */
 require_once( "LinksUpdate.php" );
 
-function wfSpecialMovepage()
-{
+/**
+ * Constructor
+ */
+function wfSpecialMovepage() {
        global $wgUser, $wgOut, $wgRequest, $action, $wgOnlySysopMayMove;
 
        # check rights. We don't want newbies to move pages to prevents possible attack
@@ -23,6 +34,11 @@ function wfSpecialMovepage()
        else { $f->showForm( '' ); }
 }
 
+/**
+ *
+ * @package MediaWiki
+ * @subpackage SpecialPage
+ */
 class MovePageForm {
        var $oldTitle, $newTitle; # Text input
                
@@ -32,19 +48,24 @@ class MovePageForm {
                $this->newTitle = $wgRequest->getText( 'wpNewTitle' );
        }
        
-       function showForm( $err )
-       {
+       function showForm( $err ) {
                global $wgOut, $wgUser, $wgLang;
 
                $wgOut->setPagetitle( wfMsg( 'movepage' ) );
 
-               if ( empty( $this->oldTitle ) ) {
+               if ( $this->oldTitle == "" ) {
                        $wgOut->errorpage( 'notargettitle', 'notargettext' );
                        return;
                }
                
                $encOldTitle = htmlspecialchars( $this->oldTitle );
-               $encNewTitle = htmlspecialchars( $this->newTitle );
+               if( $this->newTitle == "" ) {
+                       # Show the current title as a default
+                       # when the form is first opened.
+                       $encNewTitle = $encOldTitle;
+               } else {
+                       $encNewTitle = htmlspecialchars( $this->newTitle );
+               }
                $ot = Title::newFromURL( $this->oldTitle );
                $ott = $ot->getPrefixedText();
 
@@ -101,8 +122,7 @@ class MovePageForm {
 
        }
 
-       function doSubmit()
-       {
+       function doSubmit() {
                global $wgOut, $wgUser, $wgLang;
                global $wgDeferredUpdateList, $wgMessageCache;
                global  $wgUseSquid, $wgRequest;
@@ -115,28 +135,37 @@ class MovePageForm {
                $ot = Title::newFromText( $this->oldTitle );
                $nt = Title::newFromText( $this->newTitle );
 
+               # don't allow moving to pages with # in
+               if ( !$nt || $nt->getFragment() != '' ) {
+                       $this->showForm( wfMsg( "badtitletext" ) );
+                       return;
+               }
+
                $error = $ot->moveTo( $nt );
                if ( $error !== true ) {
                        $this->showForm( wfMsg( $error ) );
                        return;
                }
                
-               # Update counters if the article got moved in or out of NS_MAIN namespace
+               # Update counters if the article got moved into or out of NS_MAIN namespace
                $ons = $ot->getNamespace();
                $nns = $nt->getNamespace();
                
-               # moved out of article namespace ?
+               # moved out of article namespace?
                if ( $ons == NS_MAIN and $nns != NS_MAIN ) {
                        $u = new SiteStatsUpdate( 0, 1, -1); # not viewed, edited, removing
                }
-               # moved in article namespace ?
+               # moved into article namespace?
                elseif ( $ons != NS_MAIN and $nns == NS_MAIN ) {
                        $u = new SiteStatsUpdate( 0, 1, +1 ); # not viewed, edited, adding
+               } else {
+                       $u = false;
+               }
+               if ( $u !== false ) {
+                       # save it for later update
+                       array_push( $wgDeferredUpdateList, $u );
+                       unset($u);
                }
-               
-               # save it for later update
-               array_push( $wgDeferredUpdateList, $u );
-               unset($u);
                
                # Move talk page if
                # (1) the checkbox says to,
@@ -176,9 +205,8 @@ class MovePageForm {
                $wgOut->redirect( $success );
        }
 
-       function showSuccess()
-       {
-               global $wgOut, $wgUser, $wgRequest;
+       function showSuccess() {
+               global $wgOut, $wgUser, $wgRequest, $wgRawHtml;
 
                $wgOut->setPagetitle( wfMsg( 'movepage' ) );
                $wgOut->setSubtitle( wfMsg( 'pagemovedsub' ) );
@@ -187,7 +215,12 @@ class MovePageForm {
                $talkmoved = $wgRequest->getVal('talkmoved');
 
                $text = wfMsg( 'pagemovedtext', $oldtitle, $newtitle );
+               
+               # Temporarily disable raw html wikitext option out of XSS paranoia
+               $marchingantofdoom = $wgRawHtml;
+               $wgRawHtml = false;
                $wgOut->addWikiText( $text );
+               $wgRawHtml = $marchingantofdoom;
 
                if ( $talkmoved == 1 ) {
                        $wgOut->addHTML( "\n<p>" . wfMsg( 'talkpagemoved' ) . "</p>\n" );