Require POST method for action=purge, to prevent bots from hitting it

diff --git a/RELEASE-NOTES b/RELEASE-NOTES
index 8dd1d55..dfa0091 100644 (file)
--- a/RELEASE-NOTES
+++ b/RELEASE-NOTES
@@ -209,6 +209,7 @@ fully support the editing toolbar, but was found to be too confusing.
 * (bug 2392) Fix Atom items content type, upgrade to Atom 1.0
 * Allow $wgFeedCacheTimeout of 0 to disable feed caching
 * Fix WebRequest::getRequestURL() to strip off the host bits squid prepends
+* Require POST for action=purge, to stop bots from purging the cache
 
 === Caveats ===
 

diff --git a/includes/Article.php b/includes/Article.php
index 424929b..4ee9b55 100644 (file)
--- a/includes/Article.php
+++ b/includes/Article.php
@@ -912,6 +912,38 @@ class Article {
                $wgOut->setArticleBodyOnly(true);
                $this->view();
        }
+       
+       function purge() {
+               global $wgRequest, $wgOut, $wgUseSquid;
+
+               if ( $wgRequest->wasPosted() ) {
+                       // Invalidate the cache
+                       $this->mTitle->invalidateCache();
+
+                       if ( $wgUseSquid ) {
+                               // Commit the transaction before the purge is sent
+                               $dbw = wfGetDB( DB_MASTER );
+                               $dbw->immediateCommit();
+
+                               // Send purge
+                               $update = SquidUpdate::newSimplePurge( $this->mTitle );
+                               $update->doUpdate();
+                       }
+                       // Redirect to the article
+                       $wgOut->redirect( $this->mTitle->getFullURL() );
+               } else {
+                       $msg = $wgOut->parse( wfMsg( 'confirm_purge' ) );
+                       $action = $this->mTitle->escapeLocalURL( 'action=purge' );
+                       $button = htmlspecialchars( wfMsg( 'confirm_purge_button' ) );
+                       $msg = str_replace( '$1', 
+                               "<form method=\"post\" action=\"$action\">\n" .
+                               "<input type=\"submit\" name=\"submit\" value=\"$button\" />\n" .
+                               "</form>\n", $msg );
+
+                       $wgOut->setPageTitle( $this->mTitle->getPrefixedText() );
+                       $wgOut->addHTML( $msg );
+               }
+       }
 
        /**
         * Insert a new empty page record for this article.

diff --git a/index.php b/index.php
index 478a0c6..da837c9 100644 (file)
--- a/index.php
+++ b/index.php
@@ -189,6 +189,7 @@ if( !$wgDisableInternalSearch && !is_null( $search ) && $search !== '' ) {
                        case 'validate':
                        case 'render':
                        case 'deletetrackback':
+                       case 'purge':
                                $wgArticle->$action();
                                break;
                        case 'print':
@@ -250,12 +251,6 @@ if( !$wgDisableInternalSearch && !is_null( $search ) && $search !== '' ) {
                                $raw = new RawPage( $wgArticle );
                                $raw->view();
                                break;
-                       case 'purge':
-                               wfPurgeSquidServers(array($wgTitle->getInternalURL()));
-                               $wgOut->setSquidMaxage( $wgSquidMaxage );
-                               $wgTitle->invalidateCache();
-                               $wgArticle->view();
-                               break;
                        default:
                                if (wfRunHooks('UnknownAction', array($action, $wgArticle))) {
                                        $wgOut->errorpage( 'nosuchaction', 'nosuchactiontext' );

diff --git a/languages/Language.php b/languages/Language.php
index a79a3d5..7ec4669 100644 (file)
--- a/languages/Language.php
+++ b/languages/Language.php
@@ -2190,6 +2190,10 @@ Please confirm that really want to recreate this article.',
 # HTML dump
 'redirectingto' => 'Redirecting to [[$1]]...',
 
+# action=purge
+'confirm_purge' => "Clear the cache of this page?\n\n$1",
+'confirm_purge_button' => 'OK',
+
 );
 
 /* a fake language converter */