ApiEditPage: Test for bad redirect targets

[lhc/web/wiklou.git] / includes / api / ApiEditPage.php

diff --git a/includes/api/ApiEditPage.php b/includes/api/ApiEditPage.php
index fdf9cf1..c5fe9c8 100644 (file)
--- a/includes/api/ApiEditPage.php
+++ b/includes/api/ApiEditPage.php
@@ -20,7 +20,8 @@
  * @file
  */
 
-use MediaWiki\Storage\RevisionRecord;
+use MediaWiki\MediaWikiServices;
+use MediaWiki\Revision\RevisionRecord;
 
 /**
  * A module that allows for editing and creating pages.
@@ -62,7 +63,7 @@ class ApiEditPage extends ApiBase {
 
                                /** @var Title $newTitle */
                                foreach ( $titles as $id => $newTitle ) {
-                                       $titles[ $id - 1 ] = $titles[ $id - 1 ] ?? $oldTitle;
+                                       $titles[$id - 1] = $titles[$id - 1] ?? $oldTitle;
 
                                        $redirValues[] = [
                                                'from' => $titles[$id - 1]->getPrefixedText(),
@@ -70,6 +71,20 @@ class ApiEditPage extends ApiBase {
                                        ];
 
                                        $titleObj = $newTitle;
+
+                                       // T239428: Check whether the new title is valid
+                                       if ( $titleObj->isExternal() || !$titleObj->canExist() ) {
+                                               $redirValues[count( $redirValues ) - 1]['to'] = $titleObj->getFullText();
+                                               $this->dieWithError(
+                                                       [
+                                                               'apierror-edit-invalidredirect',
+                                                               Message::plaintextParam( $oldTitle->getPrefixedText() ),
+                                                               Message::plaintextParam( $titleObj->getFullText() ),
+                                                       ],
+                                                       'edit-invalidredirect',
+                                                       [ 'redirects' => $redirValues ]
+                                               );
+                                       }
                                }
 
                                ApiResult::setIndexedTagName( $redirValues, 'r' );
@@ -239,11 +254,15 @@ class ApiEditPage extends ApiBase {
                        $params['text'] = $newContent->serialize( $contentFormat );
                        // If no summary was given and we only undid one rev,
                        // use an autosummary
-                       if ( is_null( $params['summary'] ) &&
-                               $titleObj->getNextRevisionID( $undoafterRev->getId() ) == $params['undo']
-                       ) {
-                               $params['summary'] = wfMessage( 'undo-summary' )
-                                       ->params( $params['undo'], $undoRev->getUserText() )->inContentLanguage()->text();
+
+                       if ( is_null( $params['summary'] ) ) {
+                               $nextRev = MediaWikiServices::getInstance()->getRevisionLookup()
+                                       ->getNextRevision( $undoafterRev->getRevisionRecord() );
+                               if ( $nextRev && $nextRev->getId() == $params['undo'] ) {
+                                       $params['summary'] = wfMessage( 'undo-summary' )
+                                               ->params( $params['undo'], $undoRev->getUserText() )
+                                               ->inContentLanguage()->text();
+                               }
                        }
                }