From 2fcd22493d517276a86b674efb0cafb5a0c7fbfc Mon Sep 17 00:00:00 2001
From: Fomafix <fomafix@googlemail.com>
Date: Sun, 27 Dec 2015 16:46:17 +0000
Subject: [PATCH] SpecialUserrights: Use session data instead of URL parameter
 for success

The session data gets set in the POST and gets removed in the GET.

This change avoids changing the URL for the success message.
A reload of the page does not show the success message again.

Bug: T60492
Change-Id: Iac8d4e6adc4dc93a3da645485f18770fcd2b3872
---
 includes/specials/SpecialUserrights.php | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/includes/specials/SpecialUserrights.php b/includes/specials/SpecialUserrights.php
index 6ded6d9dd7..89dcdad513 100644
--- a/includes/specials/SpecialUserrights.php
+++ b/includes/specials/SpecialUserrights.php
@@ -76,6 +76,7 @@ class UserrightsPage extends SpecialPage {
 	public function execute( $par ) {
 		$user = $this->getUser();
 		$request = $this->getRequest();
+		$session = $request->getSession();
 		$out = $this->getOutput();
 
 		if ( $par !== null ) {
@@ -99,7 +100,13 @@ class UserrightsPage extends SpecialPage {
 		}
 
 		// show a successbox, if the user rights was saved successfully
-		if ( $request->getCheck( 'success' ) && $this->mFetchedUser !== null ) {
+		if (
+			$session->get( 'specialUserrightsSaveSuccess' ) &&
+			$this->mFetchedUser !== null
+		) {
+			// Remove session data for the success message
+			$session->remove( 'specialUserrightsSaveSuccess' );
+
 			$out->addModules( [ 'mediawiki.special.userrights' ] );
 			$out->addModuleStyles( 'mediawiki.notification.convertmessagebox.styles' );
 			$out->addHTML(
@@ -167,6 +174,9 @@ class UserrightsPage extends SpecialPage {
 					$targetUser
 				);
 
+				// Set session data for the success message
+				$session->set( 'specialUserrightsSaveSuccess', 1 );
+
 				$out->redirect( $this->getSuccessURL() );
 
 				return;
@@ -180,7 +190,7 @@ class UserrightsPage extends SpecialPage {
 	}
 
 	function getSuccessURL() {
-		return $this->getPageTitle( $this->mTarget )->getFullURL( [ 'success' => 1 ] );
+		return $this->getPageTitle( $this->mTarget )->getFullURL();
 	}
 
 	/**
-- 
2.20.1