SECURITY: Add data attribute to patrol links so it can't be spoofed by user

[lhc/web/wiklou.git] / resources / src / mediawiki / page / patrol.ajax.js

diff --git a/resources/src/mediawiki/page/patrol.ajax.js b/resources/src/mediawiki/page/patrol.ajax.js
index ec68b3c..e78bd4e 100644 (file)
--- a/resources/src/mediawiki/page/patrol.ajax.js
+++ b/resources/src/mediawiki/page/patrol.ajax.js
@@ -12,7 +12,7 @@
                return;
        }
        $( function () {
-               var $patrolLinks = $( '.patrollink a' );
+               var $patrolLinks = $( '.patrollink[data-mw="interface"] a' );
                $patrolLinks.on( 'click', function ( e ) {
                        var $spinner, rcid, apiRequest;