SECURITY: Add data attribute to patrol links so it can't be spoofed by user

Javascript used to look just for the patrollinks class, which
could be set by the user in order to patrol an arbitrary page.

Bug: T103239
Change-Id: I13fcc3ce479c0a4a90a6217c2e5244f051eaf862

Signed-off-by: Chad Horohoe <chadh@wikimedia.org>

diff --git a/includes/diff/DifferenceEngine.php b/includes/diff/DifferenceEngine.php
index e2345ca..caef7f1 100644 (file)
--- a/includes/diff/DifferenceEngine.php
+++ b/includes/diff/DifferenceEngine.php
@@ -474,7 +474,7 @@ class DifferenceEngine extends ContextSource {
                        if ( !$linkInfo ) {
                                $this->mMarkPatrolledLink = '';
                        } else {
-                               $this->mMarkPatrolledLink = ' <span class="patrollink">[' . Linker::linkKnown(
+                               $this->mMarkPatrolledLink = ' <span class="patrollink" data-mw="interface">[' . Linker::linkKnown(
                                        $this->mNewPage,
                                        $this->msg( 'markaspatrolleddiff' )->escaped(),
                                        [],

diff --git a/includes/page/Article.php b/includes/page/Article.php
index 4c9eaed..eccf36f 100644 (file)
--- a/includes/page/Article.php
+++ b/includes/page/Article.php
@@ -1216,7 +1216,7 @@ class Article implements Page {
                );
 
                $outputPage->addHTML(
-                       "<div class='patrollink'>" .
+                       "<div class='patrollink' data-mw='interface'>" .
                                wfMessage( 'markaspatrolledlink' )->rawParams( $link )->escaped() .
                        '</div>'
                );

diff --git a/resources/src/mediawiki/page/patrol.ajax.js b/resources/src/mediawiki/page/patrol.ajax.js
index ec68b3c..e78bd4e 100644 (file)
--- a/resources/src/mediawiki/page/patrol.ajax.js
+++ b/resources/src/mediawiki/page/patrol.ajax.js
@@ -12,7 +12,7 @@
                return;
        }
        $( function () {
-               var $patrolLinks = $( '.patrollink a' );
+               var $patrolLinks = $( '.patrollink[data-mw="interface"] a' );
                $patrolLinks.on( 'click', function ( e ) {
                        var $spinner, rcid, apiRequest;