Security tweaks:

[lhc/web/wiklou.git] / includes / Skin.php

diff --git a/includes/Skin.php b/includes/Skin.php
index 33b4a7e..b6b7a4d 100644 (file)
--- a/includes/Skin.php
+++ b/includes/Skin.php
@@ -194,6 +194,30 @@ class Skin extends Linker {
                return $r;
        }
 
+       /**
+        * To make it harder for someone to slip a user a fake
+        * user-JavaScript or user-CSS preview, a random token
+        * is associated with the login session. If it's not
+        * passed back with the preview request, we won't render
+        * the code.
+        *
+        * @param string $action
+        * @return bool
+        * @access private
+        */
+       function userCanPreview( $action ) {
+               global $wgTitle, $wgRequest, $wgUser;
+               
+               if( $action != 'submit' )
+                       return false;
+               if( !$wgRequest->wasPosted() )
+                       return false;
+               if( !$wgTitle->userCanEditCssJsSubpage() ) 
+                       return false;
+               return $wgUser->matchEditToken(
+                       $wgRequest->getVal( 'wpEditToken' ) );
+       }
+       
        # get the user/site-specific stylesheet, SkinPHPTal called from RawPage.php (settings are cached that way)
        function getUserStylesheet() {
                global $wgOut, $wgStylePath, $wgContLang, $wgUser, $wgRequest, $wgTitle, $wgAllowUserCss;
@@ -202,7 +226,7 @@ class Skin extends Linker {
                $s = "@import \"$wgStylePath/$sheet\";\n";
                if($wgContLang->isRTL()) $s .= "@import \"$wgStylePath/common/common_rtl.css\";\n";
                if( $wgAllowUserCss && $wgUser->getID() != 0 ) { # logged in
-                       if($wgTitle->isCssSubpage() and $action == 'submit' and  $wgTitle->userCanEditCssJsSubpage()) {
+                       if($wgTitle->isCssSubpage() && $this->userCanPreview( $action ) ) {
                                $s .= $wgRequest->getText('wpTextbox1');
                        } else {
                                $userpage = $wgContLang->getNsText( Namespace::getUser() ) . ":" . $wgUser->getName();