From 87758d8700ceeba4897abac76f73d55fffa07506 Mon Sep 17 00:00:00 2001
From: Fomafix <fomafix@googlemail.com>
Date: Mon, 29 Jan 2018 09:38:35 +0100
Subject: [PATCH] mediawiki.api.edit: Fix errors

* Use title = String( title ) to support title with type mw.Title also on the
  POST request.
* Use titles: [ title ] instead of titles: title to ensure that a '|' in the
  title is not interpreted as multi value separator.
* Reject on invalid === true to prevent processing invalid titles.

Change-Id: Ia6a3d9b4b658a89f8969f0d64bf06a53638eb553
---
 resources/src/mediawiki/api/edit.js           | 10 ++-
 .../mediawiki.api/mediawiki.api.edit.test.js  | 67 +++++++++++++++++++
 2 files changed, 75 insertions(+), 2 deletions(-)

diff --git a/resources/src/mediawiki/api/edit.js b/resources/src/mediawiki/api/edit.js
index 21fad5e573..21c55c7001 100644
--- a/resources/src/mediawiki/api/edit.js
+++ b/resources/src/mediawiki/api/edit.js
@@ -120,11 +120,14 @@
 		edit: function ( title, transform ) {
 			var basetimestamp, curtimestamp,
 				api = this;
+
+			title = String( title );
+
 			return api.get( {
 				action: 'query',
 				prop: 'revisions',
 				rvprop: [ 'content', 'timestamp' ],
-				titles: String( title ),
+				titles: [ title ],
 				formatversion: '2',
 				curtimestamp: true
 			} )
@@ -134,7 +137,10 @@
 						return $.Deferred().reject( 'unknown' );
 					}
 					page = data.query.pages[ 0 ];
-					if ( !page || page.missing ) {
+					if ( !page || page.invalid ) {
+						return $.Deferred().reject( 'invalidtitle' );
+					}
+					if ( page.missing ) {
 						return $.Deferred().reject( 'nocreate-missing' );
 					}
 					revision = page.revisions[ 0 ];
diff --git a/tests/qunit/suites/resources/mediawiki.api/mediawiki.api.edit.test.js b/tests/qunit/suites/resources/mediawiki.api/mediawiki.api.edit.test.js
index 13d7dcc287..4ce7c5db03 100644
--- a/tests/qunit/suites/resources/mediawiki.api/mediawiki.api.edit.test.js
+++ b/tests/qunit/suites/resources/mediawiki.api/mediawiki.api.edit.test.js
@@ -47,6 +47,47 @@
 			} );
 	} );
 
+	QUnit.test( 'edit( mw.Title, transform String )', function ( assert ) {
+		this.server.respond( function ( req ) {
+			if ( /query.+titles=Sandbox/.test( req.url ) ) {
+				req.respond( 200, { 'Content-Type': 'application/json' }, JSON.stringify( {
+					curtimestamp: '2016-01-02T12:00:00Z',
+					query: {
+						pages: [ {
+							pageid: 1,
+							ns: 0,
+							title: 'Sandbox',
+							revisions: [ {
+								timestamp: '2016-01-01T12:00:00Z',
+								contentformat: 'text/x-wiki',
+								contentmodel: 'wikitext',
+								content: 'Sand.'
+							} ]
+						} ]
+					}
+				} ) );
+			}
+			if ( /edit.+basetimestamp=2016-01-01.+starttimestamp=2016-01-02.+text=Box%2E/.test( req.requestBody ) ) {
+				req.respond( 200, { 'Content-Type': 'application/json' }, JSON.stringify( {
+					edit: {
+						result: 'Success',
+						oldrevid: 11,
+						newrevid: 13,
+						newtimestamp: '2016-01-03T12:00:00Z'
+					}
+				} ) );
+			}
+		} );
+
+		return new mw.Api()
+			.edit( new mw.Title( 'Sandbox' ), function ( revision ) {
+				return revision.content.replace( 'Sand', 'Box' );
+			} )
+			.then( function ( edit ) {
+				assert.equal( edit.newrevid, 13 );
+			} );
+	} );
+
 	QUnit.test( 'edit( title, transform Promise )', function ( assert ) {
 		this.server.respond( function ( req ) {
 			if ( /query.+titles=Async/.test( req.url ) ) {
@@ -129,6 +170,32 @@
 			} );
 	} );
 
+	QUnit.test( 'edit( invalid-title, transform String )', function ( assert ) {
+		this.server.respond( function ( req ) {
+			if ( /query.+titles=%1F%7C/.test( req.url ) ) {
+				req.respond( 200, { 'Content-Type': 'application/json' }, JSON.stringify( {
+					query: {
+						pages: [ {
+							title: '|',
+							invalidreason: 'The requested page title contains invalid characters: "|".',
+							invalid: true
+						} ]
+					}
+				} ) );
+			}
+		} );
+
+		return new mw.Api()
+			.edit( '|', function ( revision ) {
+				return revision.content.replace( 'Sand', 'Box' );
+			} )
+			.then( function () {
+				return $.Deferred().reject( 'Unexpected success' );
+			}, function ( reason ) {
+				assert.equal( reason, 'invalidtitle' );
+			} );
+	} );
+
 	QUnit.test( 'create( title, content )', function ( assert ) {
 		this.server.respond( function ( req ) {
 			if ( /edit.+text=Sand/.test( req.requestBody ) ) {
-- 
2.20.1