Add token checks for Delete and Switch Cargo table special pages

Patch by BlankEclair. Change-Id: I15d05996ff1eaf203cf726b02925687e671ba272
Wikia · Oct 7, 2024 · 3695b0e · 3695b0e
1 parent bf05a69
commit 3695b0e
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 2 deletions.
diff --git a/includes/specials/SpecialDeleteCargoTable.php b/includes/specials/SpecialDeleteCargoTable.php
@@ -55,6 +55,7 @@ public function execute( $subpage = false ) {
 
 		$out = $this->getOutput();
 		$req = $this->getRequest();
+		$csrfTokenSet = $this->getContext()->getCsrfTokenSet();
 
 		$out->enableOOUI();
 
@@ -87,7 +88,7 @@ public function execute( $subpage = false ) {
 		$fieldTables = unserialize( $row['field_tables'] );
 		$fieldHelperTables = unserialize( $row['field_helper_tables'] );
 
-		if ( $this->getRequest()->getCheck( 'delete' ) ) {
+		if ( $req->wasPosted() && $req->getCheck( 'delete' ) && $csrfTokenSet->matchToken( $req->getText( 'wpEditToken' ) ) ) {
 			self::deleteTable( $tableName, $fieldTables, $fieldHelperTables );
 			$text = Html::rawElement( 'p', null, $this->msg( 'cargo-deletetable-success', $tableName )->escaped() ) . "\n";
 			$tablesLink = CargoUtils::makeLink( $this->getLinkRenderer(),

diff --git a/includes/specials/SpecialSwitchCargoTable.php b/includes/specials/SpecialSwitchCargoTable.php
@@ -86,6 +86,9 @@ public function execute( $subpage = false ) {
 		$this->checkPermissions();
 
 		$out = $this->getOutput();
+		$req = $this->getRequest();
+		$csrfTokenSet = $this->getContext()->getCsrfTokenSet();
+
 		$tableName = $subpage;
 		$out->enableOOUI();
 
@@ -116,7 +119,7 @@ public function execute( $subpage = false ) {
 		$fieldTables = unserialize( $row['field_tables'] );
 		$fieldHelperTables = unserialize( $row['field_helper_tables'] );
 
-		if ( $this->getRequest()->getCheck( 'switch' ) ) {
+		if ( $req->wasPosted() && $req->getCheck( 'switch' ) && $csrfTokenSet->matchToken( $req->getText( 'wpEditToken' ) ) ) {
 			self::switchInTableReplacement( $tableName, $fieldTables, $fieldHelperTables, $this->getUser() );
 			$text = Html::element( 'p', null, $this->msg( 'cargo-switchtables-success', $tableName )->parse() ) . "\n";
 			$tablesLink = CargoUtils::makeLink( $this->getLinkRenderer(),