SECURITY: Disallow loading JS/CSS/Json subpages from unregistered users and log

[lhc/web/wiklou.git] / includes / actions / FormAction.php

diff --git a/includes/actions/FormAction.php b/includes/actions/FormAction.php
index aa201d7..0141b9e 100644 (file)
--- a/includes/actions/FormAction.php
+++ b/includes/actions/FormAction.php
@@ -33,7 +33,7 @@ abstract class FormAction extends Action {
         */
        protected function getFormFields() {
                // Default to an empty form with just a submit button
-               return array();
+               return [];
        }
 
        /**
@@ -58,6 +58,14 @@ abstract class FormAction extends Action {
        protected function alterForm( HTMLForm $form ) {
        }
 
+       /**
+        * Whether the form should use OOUI
+        * @return bool
+        */
+       protected function usesOOUI() {
+               return false;
+       }
+
        /**
         * Get the HTMLForm to control behavior
         * @return HTMLForm|null
@@ -66,17 +74,21 @@ abstract class FormAction extends Action {
                $this->fields = $this->getFormFields();
 
                // Give hooks a chance to alter the form, adding extra fields or text etc
-               Hooks::run( 'ActionModifyFormFields', array( $this->getName(), &$this->fields, $this->page ) );
+               Hooks::run( 'ActionModifyFormFields', [ $this->getName(), &$this->fields, $this->page ] );
 
-               $form = new HTMLForm( $this->fields, $this->getContext(), $this->getName() );
-               $form->setSubmitCallback( array( $this, 'onSubmit' ) );
+               if ( $this->usesOOUI() ) {
+                       $form = HTMLForm::factory( 'ooui', $this->fields, $this->getContext(), $this->getName() );
+               } else {
+                       $form = new HTMLForm( $this->fields, $this->getContext(), $this->getName() );
+               }
+               $form->setSubmitCallback( [ $this, 'onSubmit' ] );
 
                $title = $this->getTitle();
-               $form->setAction( $title->getLocalURL( array( 'action' => $this->getName() ) ) );
+               $form->setAction( $title->getLocalURL( [ 'action' => $this->getName() ] ) );
                // Retain query parameters (uselang etc)
                $params = array_diff_key(
                        $this->getRequest()->getQueryValues(),
-                       array( 'action' => null, 'title' => null )
+                       [ 'action' => null, 'title' => null ]
                );
                if ( $params ) {
                        $form->addHiddenField( 'redirectparams', wfArrayToCgi( $params ) );
@@ -87,7 +99,7 @@ abstract class FormAction extends Action {
                $this->alterForm( $form );
 
                // Give hooks a chance to alter the form, adding extra fields or text etc
-               Hooks::run( 'ActionBeforeFormDisplay', array( $this->getName(), &$form, $this->page ) );
+               Hooks::run( 'ActionBeforeFormDisplay', [ $this->getName(), &$form, $this->page ] );
 
                return $form;
        }
@@ -127,4 +139,8 @@ abstract class FormAction extends Action {
                        $this->onSuccess();
                }
        }
+
+       public function doesWrites() {
+               return true;
+       }
 }