From 3f6432ff1edc107e25f60874df50e3fc1656c093 Mon Sep 17 00:00:00 2001
From: Alexandre Emsenhuber <ialex@users.mediawiki.org>
Date: Sun, 1 Aug 2010 15:50:30 +0000
Subject: [PATCH] * (bug 24418) action=markpatrolled now requires a token

---
 RELEASE-NOTES                         |  1 +
 includes/Article.php                  | 12 ++++++++++--
 includes/diff/DifferenceInterface.php |  8 ++++++--
 3 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/RELEASE-NOTES b/RELEASE-NOTES
index 33ee8da527..185247d355 100644
--- a/RELEASE-NOTES
+++ b/RELEASE-NOTES
@@ -122,6 +122,7 @@ it from source control: http://www.mediawiki.org/wiki/Download_from_SVN
 * (bug 671) The <dfn> element has been whitelisted in user input.
 * (bug 24563) Entries on Special:WhatLinksHere now have a link to their history
 * (bug 21503) There's now a "reason" field when creating account for other users
+* (bug 24418) action=markpatrolled now requires a token
 
 === Bug fixes in 1.17 ===
 * (bug 17560) Half-broken deletion moved image files to deletion archive
diff --git a/includes/Article.php b/includes/Article.php
index c979c45759..f134099be0 100644
--- a/includes/Article.php
+++ b/includes/Article.php
@@ -1316,6 +1316,7 @@ class Article {
 		}
 
 		$sk = $wgUser->getSkin();
+		$token = $wgUser->editToken( $rcid );
 
 		$wgOut->addHTML(
 			"<div class='patrollink'>" .
@@ -1327,7 +1328,8 @@ class Article {
 						array(),
 						array(
 							'action' => 'markpatrolled',
-							'rcid' => $rcid
+							'rcid' => $rcid,
+							'token' => $token,
 						),
 						array( 'known', 'noclasses' )
 					)
@@ -2358,12 +2360,18 @@ class Article {
 	 * Mark this particular edit/page as patrolled
 	 */
 	public function markpatrolled() {
-		global $wgOut, $wgRequest;
+		global $wgOut, $wgUser, $wgRequest;
 
 		$wgOut->setRobotPolicy( 'noindex,nofollow' );
 
 		# If we haven't been given an rc_id value, we can't do anything
 		$rcid = (int) $wgRequest->getVal( 'rcid' );
+
+		if ( !$wgUser->matchEditToken( $wgRequest->getVal( 'token' ), $rcid ) ) {
+			$wgOut->showErrorPage( 'sessionfailure-title', 'sessionfailure' );
+			return;
+		}
+
 		$rc = RecentChange::newFromId( $rcid );
 
 		if ( is_null( $rc ) ) {
diff --git a/includes/diff/DifferenceInterface.php b/includes/diff/DifferenceInterface.php
index 490d76ded0..c75c7c029c 100644
--- a/includes/diff/DifferenceInterface.php
+++ b/includes/diff/DifferenceInterface.php
@@ -236,13 +236,15 @@ CONTROL;
 			}
 			// Build the link
 			if( $rcid ) {
+				$token = $wgUser->editToken( $rcid );
 				$patrol = ' <span class="patrollink">[' . $sk->link(
 					$this->mTitle, 
 					wfMsgHtml( 'markaspatrolleddiff' ),
 					array(),
 					array(
 						'action' => 'markpatrolled',
-						'rcid' => $rcid
+						'rcid' => $rcid,
+						'token' => $token,
 					),
 					array(
 						'known',
@@ -461,6 +463,7 @@ CONTROL;
 		# Add redundant patrol link on bottom...
 		if( $this->mRcidMarkPatrolled && $this->mTitle->quickUserCan('patrol') ) {
 			$sk = $wgUser->getSkin();
+			$token = $wgUser->editToken( $this->mRcidMarkPatrolled );
 			$wgOut->addHTML(
 				"<div class='patrollink'>[" . $sk->link(
 					$this->mTitle,
@@ -468,7 +471,8 @@ CONTROL;
 					array(),
 					array(
 						'action' => 'markpatrolled',
-						'rcid' => $this->mRcidMarkPatrolled
+						'rcid' => $this->mRcidMarkPatrolled,
+						'token' => $token,
 					)
 				) . ']</div>'
 			 );
-- 
2.20.1