WatchAction: Require POST for index.php action=watch

[lhc/web/wiklou.git] / includes / actions / WatchAction.php

diff --git a/includes/actions/WatchAction.php b/includes/actions/WatchAction.php
index 8b6e329..51108c0 100644 (file)
--- a/includes/actions/WatchAction.php
+++ b/includes/actions/WatchAction.php
@@ -35,6 +35,9 @@ class WatchAction extends FormAction {
                return false;
        }
 
+       /**
+        * @return string HTML
+        */
        protected function getDescription() {
                return $this->msg( 'addwatch' )->escaped();
        }
@@ -63,17 +66,9 @@ class WatchAction extends FormAction {
                // This will throw exceptions if there's a problem
                $this->checkCanExecute( $user );
 
-               // Must have valid token for this action/title
-               $salt = array( $this->getName(), $this->getTitle()->getPrefixedDBkey() );
-
-               if ( $user->matchEditToken( $this->getRequest()->getVal( 'token' ), $salt ) ) {
-                       $this->onSubmit( array() );
+               $form = $this->getForm();
+               if ( $form->show() ) {
                        $this->onSuccess();
-               } else {
-                       $form = $this->getForm();
-                       if ( $form->show() ) {
-                               $this->onSuccess();
-                       }
                }
        }
 
@@ -86,6 +81,21 @@ class WatchAction extends FormAction {
                parent::checkCanExecute( $user );
        }
 
+       protected function alterForm( HTMLForm $form ) {
+               $form->setSubmitTextMsg( 'confirm-watch-button' );
+               $form->setTokenSalt( 'watch' );
+       }
+
+       protected function preText() {
+               return $this->msg( 'confirm-watch-top' )->parse();
+       }
+
+       public function onSuccess() {
+               $this->getOutput()->addWikiMsg( 'addedwatchtext', $this->getTitle()->getPrefixedText() );
+       }
+
+       /* Static utility methods */
+
        /**
         * Watch or unwatch a page
         * @since 1.22
@@ -176,11 +186,8 @@ class WatchAction extends FormAction {
                if ( $action != 'unwatch' ) {
                        $action = 'watch';
                }
-               $salt = array( $action, $title->getPrefixedDBkey() );
-
-               // This token stronger salted and not compatible with ApiWatch
-               // It's title/action specific because index.php is GET and API is POST
-               return $user->getEditToken( $salt );
+               // Match ApiWatch and ResourceLoaderUserTokensModule
+               return $user->getEditToken( $action );
        }
 
        /**
@@ -195,16 +202,4 @@ class WatchAction extends FormAction {
        public static function getUnwatchToken( Title $title, User $user, $action = 'unwatch' ) {
                return self::getWatchToken( $title, $user, $action );
        }
-
-       protected function alterForm( HTMLForm $form ) {
-               $form->setSubmitTextMsg( 'confirm-watch-button' );
-       }
-
-       protected function preText() {
-               return $this->msg( 'confirm-watch-top' )->parse();
-       }
-
-       public function onSuccess() {
-               $this->getOutput()->addWikiMsg( 'addedwatchtext', $this->getTitle()->getPrefixedText() );
-       }
 }