SECURITY: Add data attribute to patrol links so it can't be spoofed by user
authorBrian Wolff <bawolff+wn@gmail.com>
Tue, 27 Oct 2015 08:31:00 +0000 (02:31 -0600)
committerChad Horohoe <chadh@wikimedia.org>
Fri, 20 May 2016 16:25:35 +0000 (09:25 -0700)
commit17b36599950e57cf852fba672435f7686237bb30
treed6dcd9e02fe66acbcdc3053aa14e17a96a7acc5a
parent9ec1ef7308acc0366e92f8e6af10ce3cb22b5065
SECURITY: Add data attribute to patrol links so it can't be spoofed by user

Javascript used to look just for the patrollinks class, which
could be set by the user in order to patrol an arbitrary page.

Bug: T103239
Change-Id: I13fcc3ce479c0a4a90a6217c2e5244f051eaf862

Signed-off-by: Chad Horohoe <chadh@wikimedia.org>
includes/diff/DifferenceEngine.php
includes/page/Article.php
resources/src/mediawiki/page/patrol.ajax.js