Check if user is blocked during upload process

[lhc/web/wiklou.git] / resources / src / mediawiki / api.js

diff --git a/resources/src/mediawiki/api.js b/resources/src/mediawiki/api.js
index 64e5976..9cef1c4 100644 (file)
--- a/resources/src/mediawiki/api.js
+++ b/resources/src/mediawiki/api.js
@@ -39,7 +39,12 @@
                        'import',
                        'options'
                ];
-               return $.inArray( action, csrfActions ) !== -1 ? 'csrf' : action;
+               if ( $.inArray( action, csrfActions ) !== -1 ) {
+                       mw.track( 'mw.deprecate', 'apitoken_' + action );
+                       mw.log.warn( 'Use of the "' + action + '" token is deprecated. Use "csrf" instead.' );
+                       return 'csrf';
+               }
+               return action;
        }
 
        // Pre-populate with fake ajax promises to save http requests for tokens
@@ -47,7 +52,7 @@
        promises[ defaultOptions.ajax.url ] = {};
        $.each( mw.user.tokens.get(), function ( key, value ) {
                // This requires #getToken to use the same key as user.tokens.
-               // Format: token-type + "Token" (eg. editToken, patrolToken, watchToken).
+               // Format: token-type + "Token" (eg. csrfToken, patrolToken, watchToken).
                promises[ defaultOptions.ajax.url ][ key ] = $.Deferred()
                        .resolve( value )
                        .promise( { abort: function () {} } );
@@ -207,16 +212,17 @@
                                // Prevent jQuery from overriding the Content-Type header
                                ajaxOptions.contentType = false;
                        } else {
-                               // Some deployed MediaWiki >= 1.17 forbid periods in URLs, due to an IE XSS bug
-                               // So let's escape them here. See bug #28235
                                // This works because jQuery accepts data as a query string or as an Object
-                               ajaxOptions.data = $.param( parameters ).replace( /\./g, '%2E' );
-
+                               ajaxOptions.data = $.param( parameters );
                                // If we extracted a token parameter, add it back in.
                                if ( token ) {
                                        ajaxOptions.data += '&token=' + encodeURIComponent( token );
                                }
 
+                               // Depending on server configuration, MediaWiki may forbid periods in URLs, due to an IE 6
+                               // XSS bug. So let's escape them here. See WebRequest::checkUrlExtension() and T30235.
+                               ajaxOptions.data = ajaxOptions.data.replace( /\./g, '%2E' );
+
                                if ( ajaxOptions.contentType === 'multipart/form-data' ) {
                                        // We were asked to emulate but can't, so drop the Content-Type header, otherwise
                                        // it'll be wrong and the server will fail to decode the POST body
@@ -269,7 +275,7 @@
                 * If we have a cached token try using that, and if it fails, blank out the
                 * cached token and start over. For example to change an user option you could do:
                 *
-                *     new mw.Api().postWithToken( 'options', {
+                *     new mw.Api().postWithToken( 'csrf', {
                 *         action: 'options',
                 *         optionname: 'gender',
                 *         optionvalue: 'female'
@@ -427,6 +433,8 @@
                'fileexists-shared-forbidden',
                'invalidtitle',
                'notloggedin',
+               'autoblocked',
+               'blocked',
 
                // Stash-specific errors - expanded
                'stashfailed',