Merge "Add test for bracketed external links with invalid template-generated target"

[lhc/web/wiklou.git] / includes / api / ApiQueryAllLinks.php

diff --git a/includes/api/ApiQueryAllLinks.php b/includes/api/ApiQueryAllLinks.php
index 70b6656..da4840f 100644 (file)
--- a/includes/api/ApiQueryAllLinks.php
+++ b/includes/api/ApiQueryAllLinks.php
@@ -4,7 +4,7 @@
  *
  * Created on July 7, 2007
  *
- * Copyright © 2006 Yuri Astrakhan <Firstname><Lastname>@gmail.com
+ * Copyright © 2006 Yuri Astrakhan "<Firstname><Lastname>@gmail.com"
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -77,17 +77,25 @@ class ApiQueryAllLinks extends ApiQueryGeneratorBase {
                }
                if ( !is_null( $params['continue'] ) ) {
                        $continueArr = explode( '|', $params['continue'] );
-                       if ( count( $continueArr ) != 2 ) {
-                               $this->dieUsage( 'Invalid continue parameter', 'badcontinue' );
-                       }
                        $op = $params['dir'] == 'descending' ? '<' : '>';
-                       $continueTitle = $db->addQuotes( $this->titleToKey( $continueArr[0] ) );
-                       $continueFrom = intval( $continueArr[1] );
-                       $this->addWhere(
-                               "pl_title $op $continueTitle OR " .
-                               "(pl_title = $continueTitle AND " .
-                               "pl_from $op= $continueFrom)"
-                       );
+                       if ( $params['unique'] ) {
+                               if ( count( $continueArr ) != 1 ) {
+                                       $this->dieUsage( 'Invalid continue parameter', 'badcontinue' );
+                               }
+                               $continueTitle = $db->addQuotes( $continueArr[0] );
+                               $this->addWhere( "pl_title $op= $continueTitle" );
+                       } else {
+                               if ( count( $continueArr ) != 2 ) {
+                                       $this->dieUsage( 'Invalid continue parameter', 'badcontinue' );
+                               }
+                               $continueTitle = $db->addQuotes( $continueArr[0] );
+                               $continueFrom = intval( $continueArr[1] );
+                               $this->addWhere(
+                                       "pl_title $op $continueTitle OR " .
+                                       "(pl_title = $continueTitle AND " .
+                                       "pl_from $op= $continueFrom)"
+                               );
+                       }
                }
 
                $from = ( is_null( $params['from'] ) ? null : $this->titlePartToKey( $params['from'] ) );
@@ -121,11 +129,10 @@ class ApiQueryAllLinks extends ApiQueryGeneratorBase {
                foreach ( $res as $row ) {
                        if ( ++ $count > $limit ) {
                                // We've reached the one extra which shows that there are additional pages to be had. Stop here...
-                               // TODO: Security issue - if the user has no right to view next title, it will still be shown
                                if ( $params['unique'] ) {
-                                       $this->setContinueEnumParameter( 'from', $this->keyToTitle( $row->pl_title ) );
+                                       $this->setContinueEnumParameter( 'continue', $row->pl_title );
                                } else {
-                                       $this->setContinueEnumParameter( 'continue', $this->keyToTitle( $row->pl_title ) . "|" . $row->pl_from );
+                                       $this->setContinueEnumParameter( 'continue', $row->pl_title . "|" . $row->pl_from );
                                }
                                break;
                        }
@@ -142,9 +149,9 @@ class ApiQueryAllLinks extends ApiQueryGeneratorBase {
                                $fit = $result->addValue( array( 'query', $this->getModuleName() ), null, $vals );
                                if ( !$fit ) {
                                        if ( $params['unique'] ) {
-                                               $this->setContinueEnumParameter( 'from', $this->keyToTitle( $row->pl_title ) );
+                                               $this->setContinueEnumParameter( 'continue', $row->pl_title );
                                        } else {
-                                               $this->setContinueEnumParameter( 'continue', $this->keyToTitle( $row->pl_title ) . "|" . $row->pl_from );
+                                               $this->setContinueEnumParameter( 'continue', $row->pl_title . "|" . $row->pl_from );
                                        }
                                        break;
                                }