Display a distinctive message when the edit token suffix is mangled. On report of...

diff --git a/includes/EditPage.php b/includes/EditPage.php
index a6b589a..4b44012 100644 (file)
--- a/includes/EditPage.php
+++ b/includes/EditPage.php
@@ -20,6 +20,7 @@ class EditPage {
        var $firsttime;
        var $lastDelete;
        var $mTokenOk = false;
+       var $mTokenOkExceptSuffix = false;
        var $mTriedSave = false;
        var $tooBig = false;
        var $kblength = false;
@@ -576,7 +577,9 @@ class EditPage {
         */
        function tokenOk( &$request ) {
                global $wgUser;
-               $this->mTokenOk = $wgUser->matchEditToken( $request->getVal( 'wpEditToken' ) );
+               $token = $request->getVal( 'wpEditToken' );
+               $this->mTokenOk = $wgUser->matchEditToken( $token );
+               $this->mTokenOkExceptSuffix = $wgUser->matchEditTokenNoSuffix( $token );
                return $this->mTokenOk;
        }
 
@@ -1369,7 +1372,11 @@ END
                wfProfileIn( $fname );
 
                if ( $this->mTriedSave && !$this->mTokenOk ) {
-                       $msg = 'session_fail_preview';
+                       if ( $this->mTokenOkExceptSuffix ) {
+                               $msg = 'token_suffix_mismatch';
+                       } else {
+                               $msg = 'session_fail_preview';
+                       }
                } else {
                        $msg = 'previewnote';
                }

diff --git a/includes/User.php b/includes/User.php
index 2f5a089..e17c253 100644 (file)
--- a/includes/User.php
+++ b/includes/User.php
@@ -2312,7 +2312,6 @@ class User {
         * @public
         */
        function matchEditToken( $val, $salt = '' ) {
-               global $wgMemc;
                $sessionToken = $this->editToken( $salt );
                if ( $val != $sessionToken ) {
                        wfDebug( "User::matchEditToken: broken session data\n" );
@@ -2320,6 +2319,14 @@ class User {
                return $val == $sessionToken;
        }
 
+       /**
+        * Check whether the edit token is fine except for the suffix
+        */
+       function matchEditTokenNoSuffix( $val, $salt = '' ) {
+               $sessionToken = $this->editToken( $salt );
+               return substr( $sessionToken, 0, 32 ) == substr( $val, 0, 32 );
+       }
+
        /**
         * Generate a new e-mail confirmation token and send a confirmation
         * mail to the user's given address.

diff --git a/languages/messages/MessagesEn.php b/languages/messages/MessagesEn.php
index 6d07492..a5a164e 100644 (file)
--- a/languages/messages/MessagesEn.php
+++ b/languages/messages/MessagesEn.php
@@ -995,6 +995,9 @@ Please try again. If it still doesn't work, try logging out and logging back in.
 ''Because this wiki has raw HTML enabled, the preview is hidden as a precaution against JavaScript attacks.''
 
 <strong>If this is a legitimate edit attempt, please try again. If it still doesn't work, try logging out and logging back in.</strong>",
+'token_suffix_mismatch'     => '<strong>Your edit has been rejected because your client mangled the punctuation characters 
+in the edit token. The edit has been rejected to prevent corruption of the article text. 
+This sometimes happens when you are using a buggy web-based anonymous proxy service.</strong>',
 'importing'                 => 'Importing $1',
 'editing'                   => 'Editing $1',
 'editinguser'               => 'Editing user <b>$1</b>',