Made loadFromFileCache() always disable $wgOut regardless of whether compression...

[lhc/web/wiklou.git] / includes / HTMLForm.php

diff --git a/includes/HTMLForm.php b/includes/HTMLForm.php
index 41a12c1..678babc 100644 (file)
--- a/includes/HTMLForm.php
+++ b/includes/HTMLForm.php
@@ -108,6 +108,13 @@ class HTMLForm extends ContextSource {
        protected $mTitle;
        protected $mMethod = 'post';
 
+       /**
+        * Form action URL. false means we will use the URL to set Title
+        * @since 1.19
+        * @var bool|string
+        */
+       protected $mAction = false;
+
        protected $mUseMultipart = false;
        protected $mHiddenFields = array();
        protected $mButtons = array();
@@ -233,12 +240,27 @@ class HTMLForm extends ContextSource {
         * @return Status|boolean
         */
        function tryAuthorizedSubmit() {
-               $editToken = $this->getRequest()->getVal( 'wpEditToken' );
-
                $result = false;
-               if ( $this->getMethod() != 'post' || $this->getUser()->matchEditToken( $editToken ) ) {
+
+               $submit = false;
+               if ( $this->getMethod() != 'post' ) {
+                       $submit = true; // no session check needed
+               } elseif ( $this->getRequest()->wasPosted() ) {
+                       $editToken = $this->getRequest()->getVal( 'wpEditToken' );
+                       if ( $this->getUser()->isLoggedIn() || $editToken != null ) {
+                               // Session tokens for logged-out users have no security value.
+                               // However, if the user gave one, check it in order to give a nice 
+                               // "session expired" error instead of "permission denied" or such.
+                               $submit = $this->getUser()->matchEditToken( $editToken );
+                       } else {
+                               $submit = true;
+                       }
+               }
+
+               if ( $submit ) {
                        $result = $this->trySubmit();
                }
+
                return $result;
        }
 
@@ -472,7 +494,7 @@ class HTMLForm extends ContextSource {
                        : 'application/x-www-form-urlencoded';
                # Attributes
                $attribs = array(
-                       'action'  => $this->getTitle()->getFullURL(),
+                       'action'  => $this->mAction === false ? $this->getTitle()->getFullURL() : $this->mAction,
                        'method'  => $this->mMethod,
                        'class'   => 'visualClear',
                        'enctype' => $encType,
@@ -845,6 +867,19 @@ class HTMLForm extends ContextSource {
        public function getLegend( $key ) {
                return wfMsg( "{$this->mMessagePrefix}-$key" );
        }
+
+       /**
+        * Set the value for the action attribute of the form.
+        * When set to false (which is the default state), the set title is used.
+        *
+        * @since 1.19
+        *
+        * @param string|bool $action
+        */
+       public function setAction( $action ) {
+               $this->mAction = $action;
+       }
+
 }
 
 /**