MS Office creates vulnerabilities also, per comment on r72890.

[lhc/web/wiklou.git] / includes / HistoryPage.php

diff --git a/includes/HistoryPage.php b/includes/HistoryPage.php
index 1b7ad22..27c1153 100644 (file)
--- a/includes/HistoryPage.php
+++ b/includes/HistoryPage.php
@@ -81,7 +81,7 @@ class HistoryPage {
                $wgOut->setRobotPolicy( 'noindex,nofollow' );
                $wgOut->setSyndicated( true );
                $wgOut->setFeedAppendQuery( 'action=history' );
-               $wgOut->addScriptFile( 'history.js' );
+               $wgOut->addModules( array( 'mediawiki.legacy.history' ) );
 
                $logPage = SpecialPage::getTitleFor( 'Log' );
                $logLink = $this->skin->link(
@@ -148,8 +148,8 @@ class HistoryPage {
                        ) .
                        Xml::hidden( 'title', $this->title->getPrefixedDBKey() ) . "\n" .
                        Xml::hidden( 'action', 'history' ) . "\n" .
-                       Xml::dateMenu( $year, $month ) . ' ' .
-                       ( $tagSelector ? ( implode( ' ', $tagSelector ) . ' ' ) : '' ) .
+                       Xml::dateMenu( $year, $month ) . ' ' .
+                       ( $tagSelector ? ( implode( ' ', $tagSelector ) . ' ' ) : '' ) .
                        $checkDeleted .
                        Xml::submitButton( wfMsg( 'allpagessubmit' ) ) . "\n" .
                        '</fieldset></form>'
@@ -374,17 +374,25 @@ class HistoryPager extends ReverseChronologicalPager {
                $this->counter = 1;
                $this->oldIdChecked = 0;
 
-               $wgOut->wrapWikiMsg( "<div class='mw-history-legend'>\n$1</div>", 'histlegend' );
-               $s = Xml::openElement( 'form', array( 'action' => $wgScript,
+               $wgOut->wrapWikiMsg( "<div class='mw-history-legend'>\n$1\n</div>", 'histlegend' );
+               $s = Html::openElement( 'form', array( 'action' => $wgScript,
                        'id' => 'mw-history-compare' ) ) . "\n";
-               $s .= Xml::hidden( 'title', $this->title->getPrefixedDbKey() ) . "\n";
-               $s .= Xml::hidden( 'action', 'historysubmit' ) . "\n";
+               $s .= Html::hidden( 'title', $this->title->getPrefixedDbKey() ) . "\n";
+               $s .= Html::hidden( 'action', 'historysubmit' ) . "\n";
 
+               $s .= '<div>' . $this->submitButton( wfMsg( 'compareselectedversions'),
+                       array( 'class' => 'historysubmit' ) ) . "\n";
+               
                $this->buttons = '<div>';
+               $this->buttons .= $this->submitButton( wfMsg( 'compareselectedversions'),
+                       array( 'class' => 'historysubmit' )
+                               + $wgUser->getSkin()->tooltipAndAccessKeyAttribs( 'compareselectedversions' )
+               ) . "\n";
+               
                if( $wgUser->isAllowed('deleterevision') ) {
                        $float = $wgContLang->alignEnd();
                        # Note bug #20966, <button> is non-standard in IE<8
-                       $this->buttons .= Xml::element( 'button',
+                       $element = Html::element( 'button',
                                array(
                                        'type' => 'submit',
                                        'name' => 'revisiondelete',
@@ -394,16 +402,27 @@ class HistoryPager extends ReverseChronologicalPager {
                                ),
                                wfMsg( 'showhideselectedversions' )
                        ) . "\n";
+                       $s .= $element;
+                       $this->buttons .= $element;
+               }
+               if( $wgUser->isAllowed( 'revisionmove' ) ) {
+                       $float = $wgContLang->alignEnd();
+                       # Note bug #20966, <button> is non-standard in IE<8
+                       $element = Html::element( 'button',
+                               array(
+                                       'type' => 'submit',
+                                       'name' => 'revisionmove',
+                                       'value' => '1',
+                                       'style' => "float: $float;",
+                                       'class' => 'mw-history-revisionmove-button',
+                               ),
+                               wfMsg( 'revisionmoveselectedversions' )
+                       ) . "\n";
+                       $s .= $element;
+                       $this->buttons .= $element;
                }
-               $this->buttons .= $this->submitButton( wfMsg( 'compareselectedversions'),
-                       array(
-                               'class'     => 'historysubmit',
-                               'accesskey' => wfMsg( 'accesskey-compareselectedversions' ),
-                               'title'     => wfMsg( 'tooltip-compareselectedversions' ),
-                       )
-               ) . "\n";
                $this->buttons .= '</div>';
-               $s .= $this->buttons . '<ul id="pagehistory">' . "\n";
+               $s .= '</div><ul id="pagehistory">' . "\n";
                return $s;
        }
 
@@ -486,10 +505,11 @@ class HistoryPager extends ReverseChronologicalPager {
                $classes = array();
 
                $del = '';
-               // User can delete revisions...
-               if( $wgUser->isAllowed( 'deleterevision' ) ) {
+               // Show checkboxes for each revision
+               if( $wgUser->isAllowed( 'deleterevision' ) || $wgUser->isAllowed( 'revisionmove' ) ) {
                        // If revision was hidden from sysops, disable the checkbox
-                       if( !$rev->userCan( Revision::DELETED_RESTRICTED ) ) {
+                       // However, if the user has revisionmove rights, we cannot disable the checkbox
+                       if( !$rev->userCan( Revision::DELETED_RESTRICTED ) && !$wgUser->isAllowed( 'revisionmove' ) ) {
                                $del = Xml::check( 'deleterevisions', false, array( 'disabled' => 'disabled' ) );
                        // Otherwise, enable the checkbox...
                        } else {