SECURITY: Add data attribute to patrol links so it can't be spoofed by user

[lhc/web/wiklou.git] / includes / Category.php

diff --git a/includes/Category.php b/includes/Category.php
index 3a21e25..6209a1a 100644 (file)
--- a/includes/Category.php
+++ b/includes/Category.php
@@ -52,9 +52,9 @@ class Category {
                if ( $this->mName === null && $this->mID === null ) {
                        throw new MWException( __METHOD__ . ' has both names and IDs null' );
                } elseif ( $this->mID === null ) {
-                       $where = array( 'cat_title' => $this->mName );
+                       $where = [ 'cat_title' => $this->mName ];
                } elseif ( $this->mName === null ) {
-                       $where = array( 'cat_id' => $this->mID );
+                       $where = [ 'cat_id' => $this->mID ];
                } else {
                        # Already initialized
                        return true;
@@ -63,7 +63,7 @@ class Category {
                $dbr = wfGetDB( DB_SLAVE );
                $row = $dbr->selectRow(
                        'category',
-                       array( 'cat_id', 'cat_title', 'cat_pages', 'cat_subcats', 'cat_files' ),
+                       [ 'cat_id', 'cat_title', 'cat_pages', 'cat_subcats', 'cat_files' ],
                        $where,
                        __METHOD__
                );
@@ -257,8 +257,8 @@ class Category {
 
                $dbr = wfGetDB( DB_SLAVE );
 
-               $conds = array( 'cl_to' => $this->getName(), 'cl_from = page_id' );
-               $options = array( 'ORDER BY' => 'cl_sortkey' );
+               $conds = [ 'cl_to' => $this->getName(), 'cl_from = page_id' ];
+               $options = [ 'ORDER BY' => 'cl_sortkey' ];
 
                if ( $limit ) {
                        $options['LIMIT'] = $limit;
@@ -270,9 +270,9 @@ class Category {
 
                $result = TitleArray::newFromResult(
                        $dbr->select(
-                               array( 'page', 'categorylinks' ),
-                               array( 'page_id', 'page_namespace', 'page_title', 'page_len',
-                                       'page_is_redirect', 'page_latest' ),
+                               [ 'page', 'categorylinks' ],
+                               [ 'page_id', 'page_namespace', 'page_title', 'page_len',
+                                       'page_is_redirect', 'page_latest' ],
                                $conds,
                                __METHOD__,
                                $options
@@ -304,54 +304,62 @@ class Category {
                        return false;
                }
 
-               # Note, we must use names for this, since categorylinks does.
-               if ( $this->mName === null ) {
-                       if ( !$this->initialize() ) {
-                               return false;
-                       }
+               # If we have just a category name, find out whether there is an
+               # existing row. Or if we have just an ID, get the name, because
+               # that's what categorylinks uses.
+               if ( !$this->initialize() ) {
+                       return false;
                }
 
                $dbw = wfGetDB( DB_MASTER );
                $dbw->startAtomic( __METHOD__ );
 
-               # Insert the row if it doesn't exist yet (e.g., this is being run via
-               # update.php from a pre-1.16 schema).  TODO: This will cause lots and
-               # lots of gaps on some non-MySQL DBMSes if you run populateCategory.php
-               # repeatedly.  Plus it's an extra query that's unneeded almost all the
-               # time.  This should be rewritten somehow, probably.
-               $seqVal = $dbw->nextSequenceValue( 'category_cat_id_seq' );
-               $dbw->insert(
-                       'category',
-                       array(
-                               'cat_id' => $seqVal,
-                               'cat_title' => $this->mName
-                       ),
-                       __METHOD__,
-                       'IGNORE'
-               );
-
-               $cond1 = $dbw->conditional( array( 'page_namespace' => NS_CATEGORY ), 1, 'NULL' );
-               $cond2 = $dbw->conditional( array( 'page_namespace' => NS_FILE ), 1, 'NULL' );
+               $cond1 = $dbw->conditional( [ 'page_namespace' => NS_CATEGORY ], 1, 'NULL' );
+               $cond2 = $dbw->conditional( [ 'page_namespace' => NS_FILE ], 1, 'NULL' );
                $result = $dbw->selectRow(
-                       array( 'categorylinks', 'page' ),
-                       array( 'pages' => 'COUNT(*)',
+                       [ 'categorylinks', 'page' ],
+                       [ 'pages' => 'COUNT(*)',
                                'subcats' => "COUNT($cond1)",
                                'files' => "COUNT($cond2)"
-                       ),
-                       array( 'cl_to' => $this->mName, 'page_id = cl_from' ),
+                       ],
+                       [ 'cl_to' => $this->mName, 'page_id = cl_from' ],
                        __METHOD__,
-                       array( 'LOCK IN SHARE MODE' )
-               );
-               $ret = $dbw->update(
-                       'category',
-                       array(
-                               'cat_pages' => $result->pages,
-                               'cat_subcats' => $result->subcats,
-                               'cat_files' => $result->files
-                       ),
-                       array( 'cat_title' => $this->mName ),
-                       __METHOD__
+                       [ 'LOCK IN SHARE MODE' ]
                );
+
+               if ( $this->mID ) {
+                       # The category row already exists, so do a plain UPDATE instead
+                       # of INSERT...ON DUPLICATE KEY UPDATE to avoid creating a gap
+                       # in the cat_id sequence. The row may or may not be "affected".
+                       $dbw->update(
+                               'category',
+                               [
+                                       'cat_pages' => $result->pages,
+                                       'cat_subcats' => $result->subcats,
+                                       'cat_files' => $result->files
+                               ],
+                               [ 'cat_title' => $this->mName ],
+                               __METHOD__
+                       );
+               } else {
+                       $dbw->upsert(
+                               'category',
+                               [
+                                       'cat_title' => $this->mName,
+                                       'cat_pages' => $result->pages,
+                                       'cat_subcats' => $result->subcats,
+                                       'cat_files' => $result->files
+                               ],
+                               [ 'cat_title' ],
+                               [
+                                       'cat_pages' => $result->pages,
+                                       'cat_subcats' => $result->subcats,
+                                       'cat_files' => $result->files
+                               ],
+                               __METHOD__
+                       );
+               }
+
                $dbw->endAtomic( __METHOD__ );
 
                # Now we should update our local counts.
@@ -359,6 +367,6 @@ class Category {
                $this->mSubcats = $result->subcats;
                $this->mFiles = $result->files;
 
-               return $ret;
+               return true;
        }
 }