SECURITY: rate-limit and prevent blocked users from changing email

[lhc/web/wiklou.git] / includes / api / ApiSetNotificationTimestamp.php

diff --git a/includes/api/ApiSetNotificationTimestamp.php b/includes/api/ApiSetNotificationTimestamp.php
index f7dc4a7..d2bbe7b 100644 (file)
--- a/includes/api/ApiSetNotificationTimestamp.php
+++ b/includes/api/ApiSetNotificationTimestamp.php
@@ -22,6 +22,7 @@
  *
  * @file
  */
+
 use MediaWiki\MediaWikiServices;
 
 /**
@@ -73,10 +74,12 @@ class ApiSetNotificationTimestamp extends ApiBase {
                        if ( $params['entirewatchlist'] || $pageSet->getGoodTitleCount() > 1 ) {
                                $this->dieWithError( [ 'apierror-multpages', $this->encodeParamName( 'torevid' ) ] );
                        }
-                       $title = reset( $pageSet->getGoodTitles() );
+                       $titles = $pageSet->getGoodTitles();
+                       $title = reset( $titles );
                        if ( $title ) {
-                               $timestamp = Revision::getTimestampFromId(
-                                       $title, $params['torevid'], Revision::READ_LATEST );
+                               // XXX $title isn't actually used, can we just get rid of the previous six lines?
+                               $timestamp = MediaWikiServices::getInstance()->getRevisionStore()
+                                       ->getTimestampFromId( $params['torevid'], IDBAccessObject::READ_LATEST );
                                if ( $timestamp ) {
                                        $timestamp = $dbw->timestamp( $timestamp );
                                } else {
@@ -87,12 +90,14 @@ class ApiSetNotificationTimestamp extends ApiBase {
                        if ( $params['entirewatchlist'] || $pageSet->getGoodTitleCount() > 1 ) {
                                $this->dieWithError( [ 'apierror-multpages', $this->encodeParamName( 'newerthanrevid' ) ] );
                        }
-                       $title = reset( $pageSet->getGoodTitles() );
+                       $titles = $pageSet->getGoodTitles();
+                       $title = reset( $titles );
                        if ( $title ) {
-                               $revid = $title->getNextRevisionID(
-                                       $params['newerthanrevid'], Title::GAID_FOR_UPDATE );
+                               $revid = $title->getNextRevisionID( $params['newerthanrevid'], Title::GAID_FOR_UPDATE );
                                if ( $revid ) {
-                                       $timestamp = $dbw->timestamp( Revision::getTimestampFromId( $title, $revid ) );
+                                       $timestamp = $dbw->timestamp(
+                                               MediaWikiServices::getInstance()->getRevisionStore()->getTimestampFromId( $title, $revid )
+                                       );
                                } else {
                                        $timestamp = null;
                                }
@@ -104,10 +109,7 @@ class ApiSetNotificationTimestamp extends ApiBase {
                $result = [];
                if ( $params['entirewatchlist'] ) {
                        // Entire watchlist mode: Just update the thing and return a success indicator
-                       $watchedItemStore->setNotificationTimestampsForUser(
-                               $user,
-                               $timestamp
-                       );
+                       $watchedItemStore->resetAllNotificationTimestampsForUser( $user, $timestamp );
 
                        $result['notificationtimestamp'] = is_null( $timestamp )
                                ? ''
@@ -153,7 +155,7 @@ class ApiSetNotificationTimestamp extends ApiBase {
                                        $ns = $title->getNamespace();
                                        $dbkey = $title->getDBkey();
                                        $r = [
-                                               'ns' => intval( $ns ),
+                                               'ns' => (int)$ns,
                                                'title' => $title->getPrefixedText(),
                                        ];
                                        if ( !$title->exists() ) {