2011-04-14 10:38:29 +00:00
|
|
|
<?php
|
|
|
|
|
/**
|
2014-08-07 00:40:35 +00:00
|
|
|
* Performs the watch actions on a page
|
2011-04-14 10:38:29 +00:00
|
|
|
*
|
|
|
|
|
* This program is free software; you can redistribute it and/or modify
|
|
|
|
|
* it under the terms of the GNU General Public License as published by
|
|
|
|
|
* the Free Software Foundation; either version 2 of the License, or
|
|
|
|
|
* (at your option) any later version.
|
|
|
|
|
*
|
|
|
|
|
* This program is distributed in the hope that it will be useful,
|
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
|
* GNU General Public License for more details.
|
|
|
|
|
*
|
|
|
|
|
* You should have received a copy of the GNU General Public License
|
|
|
|
|
* along with this program; if not, write to the Free Software
|
|
|
|
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
|
|
|
|
|
*
|
|
|
|
|
* @file
|
|
|
|
|
* @ingroup Actions
|
|
|
|
|
*/
|
|
|
|
|
|
2013-03-05 15:39:35 +00:00
|
|
|
/**
|
|
|
|
|
* Page addition to a user's watchlist
|
|
|
|
|
*
|
|
|
|
|
* @ingroup Actions
|
|
|
|
|
*/
|
2011-07-12 21:58:23 +00:00
|
|
|
class WatchAction extends FormAction {
|
2011-04-14 10:38:29 +00:00
|
|
|
|
2011-04-14 12:17:24 +00:00
|
|
|
public function getName() {
|
2011-04-14 10:38:29 +00:00
|
|
|
return 'watch';
|
|
|
|
|
}
|
|
|
|
|
|
2011-04-14 12:17:24 +00:00
|
|
|
public function requiresUnblock() {
|
2011-04-14 10:38:29 +00:00
|
|
|
return false;
|
|
|
|
|
}
|
|
|
|
|
|
2011-04-14 12:17:24 +00:00
|
|
|
protected function getDescription() {
|
2017-03-11 05:48:17 +00:00
|
|
|
return '';
|
2011-04-14 10:38:29 +00:00
|
|
|
}
|
|
|
|
|
|
2011-07-12 21:58:23 +00:00
|
|
|
public function onSubmit( $data ) {
|
2018-05-18 20:08:09 +00:00
|
|
|
return self::doWatch( $this->getTitle(), $this->getUser() );
|
2011-07-12 21:58:23 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
protected function checkCanExecute( User $user ) {
|
|
|
|
|
// Must be logged in
|
|
|
|
|
if ( $user->isAnon() ) {
|
2014-07-15 18:48:09 +00:00
|
|
|
throw new UserNotLoggedIn( 'watchlistanontext', 'watchnologin' );
|
2011-07-12 21:58:23 +00:00
|
|
|
}
|
2011-04-14 10:38:29 +00:00
|
|
|
|
2014-08-03 18:42:25 +00:00
|
|
|
parent::checkCanExecute( $user );
|
2011-04-14 10:38:29 +00:00
|
|
|
}
|
WatchAction requires token (BREAKING CHANGE)
* (bug 27655) Require token for watching/unwatching pages
* Previously done for API (bug 29070) in r88522
* As with markpatrolled, the tokens are not compatible and made that way on purpose. The API requires the POST method and uses a universal token per-session. Since the front-end is all GET based (also per convention like in markpatrolled and rollback) they are stronger salted (title / action specific)
* ajax.watch used the API already and was switched in r88554.
* The actual watching/unwatching code was moved from WatchAction->onView to WatchAction::doWatch. This was done to allow the API to do the action without needing to generate a token like the front-end needs (or having to duplicate code). It is now similar to RecentChange::markPatrolled (in that it also a "central" function that does not care about tokens, it's called after the token-handling)
* JavaScript / Gadgets that utilize action=watch in their scripts:
** Effects should be minimal as they should be using the API (see r88522 and wikitech-l)
** If they use index.php and scrap the link from the page, they can continue to do so.
* There are links to the watch action all over the place. I've tried to catch most of them, but there may be some I miss. Migration in most cases is just a matter of adding an array item to the $query for:
'token' => WatchAction::getWatchToken( $title, $user [, $action] )
or changing:
Action::factory( 'watch', $article )->execute();
to:
WatchAction::doWatch( $title, $user );
While replacing the usages in some cases an instance of Article() no longer had to be created, in others $wgUser had to be retrieved from global (which was implied before but needs to be given directly now)
Other notes:
* Article->unwatch() and Article->watch(), which were deprecated as of 1.18 and are no longer used in core, may be broken in scenarios where the Request does not have a 'token' but is making a call to $article->watch()
* Some extensions need to be fixed, I'm currently running a grep search and will fix them a.s.a.p
[1] http://www.mediawiki.org/wiki/ResourceLoader/Default_modules?mw.user#tokens
2011-06-06 00:09:03 +00:00
|
|
|
|
2017-03-11 05:48:17 +00:00
|
|
|
protected function usesOOUI() {
|
|
|
|
|
return true;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
protected function getFormFields() {
|
|
|
|
|
return [
|
|
|
|
|
'intro' => [
|
|
|
|
|
'type' => 'info',
|
|
|
|
|
'vertical-label' => true,
|
|
|
|
|
'raw' => true,
|
|
|
|
|
'default' => $this->msg( 'confirm-watch-top' )->parse()
|
|
|
|
|
]
|
|
|
|
|
];
|
|
|
|
|
}
|
|
|
|
|
|
2015-09-28 21:32:45 +00:00
|
|
|
protected function alterForm( HTMLForm $form ) {
|
2017-03-11 05:48:17 +00:00
|
|
|
$form->setWrapperLegendMsg( 'addwatch' );
|
2015-09-28 21:32:45 +00:00
|
|
|
$form->setSubmitTextMsg( 'confirm-watch-button' );
|
|
|
|
|
$form->setTokenSalt( 'watch' );
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public function onSuccess() {
|
2016-07-30 10:05:36 +00:00
|
|
|
$msgKey = $this->getTitle()->isTalkPage() ? 'addedwatchtext-talk' : 'addedwatchtext';
|
|
|
|
|
$this->getOutput()->addWikiMsg( $msgKey, $this->getTitle()->getPrefixedText() );
|
2015-09-28 21:32:45 +00:00
|
|
|
}
|
|
|
|
|
|
2013-06-13 18:02:55 +00:00
|
|
|
/**
|
|
|
|
|
* Watch or unwatch a page
|
|
|
|
|
* @since 1.22
|
|
|
|
|
* @param bool $watch Whether to watch or unwatch the page
|
|
|
|
|
* @param Title $title Page to watch/unwatch
|
|
|
|
|
* @param User $user User who is watching/unwatching
|
|
|
|
|
* @return Status
|
|
|
|
|
*/
|
|
|
|
|
public static function doWatchOrUnwatch( $watch, Title $title, User $user ) {
|
2013-11-14 11:33:19 +00:00
|
|
|
if ( $user->isLoggedIn() &&
|
2016-02-01 11:53:01 +00:00
|
|
|
$user->isWatched( $title, User::IGNORE_USER_RIGHTS ) != $watch
|
2013-11-14 11:33:19 +00:00
|
|
|
) {
|
2013-06-13 18:02:55 +00:00
|
|
|
// If the user doesn't have 'editmywatchlist', we still want to
|
|
|
|
|
// allow them to add but not remove items via edits and such.
|
|
|
|
|
if ( $watch ) {
|
2016-02-01 11:53:01 +00:00
|
|
|
return self::doWatch( $title, $user, User::IGNORE_USER_RIGHTS );
|
2013-06-13 18:02:55 +00:00
|
|
|
} else {
|
|
|
|
|
return self::doUnwatch( $title, $user );
|
|
|
|
|
}
|
|
|
|
|
}
|
2013-11-14 11:18:26 +00:00
|
|
|
|
2013-06-13 18:02:55 +00:00
|
|
|
return Status::newGood();
|
|
|
|
|
}
|
|
|
|
|
|
2013-06-13 17:56:29 +00:00
|
|
|
/**
|
|
|
|
|
* Watch a page
|
2013-06-13 18:02:55 +00:00
|
|
|
* @since 1.22 Returns Status, $checkRights parameter added
|
2013-06-13 17:56:29 +00:00
|
|
|
* @param Title $title Page to watch/unwatch
|
|
|
|
|
* @param User $user User who is watching/unwatching
|
2016-02-01 11:53:01 +00:00
|
|
|
* @param bool $checkRights Passed through to $user->addWatch()
|
|
|
|
|
* Pass User::CHECK_USER_RIGHTS or User::IGNORE_USER_RIGHTS.
|
2013-06-13 17:56:29 +00:00
|
|
|
* @return Status
|
|
|
|
|
*/
|
2016-02-01 11:53:01 +00:00
|
|
|
public static function doWatch(
|
|
|
|
|
Title $title,
|
|
|
|
|
User $user,
|
|
|
|
|
$checkRights = User::CHECK_USER_RIGHTS
|
2013-11-14 11:33:19 +00:00
|
|
|
) {
|
2016-02-01 11:53:01 +00:00
|
|
|
if ( $checkRights && !$user->isAllowed( 'editmywatchlist' ) ) {
|
2013-06-13 18:02:55 +00:00
|
|
|
return User::newFatalPermissionDeniedStatus( 'editmywatchlist' );
|
|
|
|
|
}
|
|
|
|
|
|
2012-01-06 16:28:11 +00:00
|
|
|
$page = WikiPage::factory( $title );
|
WatchAction requires token (BREAKING CHANGE)
* (bug 27655) Require token for watching/unwatching pages
* Previously done for API (bug 29070) in r88522
* As with markpatrolled, the tokens are not compatible and made that way on purpose. The API requires the POST method and uses a universal token per-session. Since the front-end is all GET based (also per convention like in markpatrolled and rollback) they are stronger salted (title / action specific)
* ajax.watch used the API already and was switched in r88554.
* The actual watching/unwatching code was moved from WatchAction->onView to WatchAction::doWatch. This was done to allow the API to do the action without needing to generate a token like the front-end needs (or having to duplicate code). It is now similar to RecentChange::markPatrolled (in that it also a "central" function that does not care about tokens, it's called after the token-handling)
* JavaScript / Gadgets that utilize action=watch in their scripts:
** Effects should be minimal as they should be using the API (see r88522 and wikitech-l)
** If they use index.php and scrap the link from the page, they can continue to do so.
* There are links to the watch action all over the place. I've tried to catch most of them, but there may be some I miss. Migration in most cases is just a matter of adding an array item to the $query for:
'token' => WatchAction::getWatchToken( $title, $user [, $action] )
or changing:
Action::factory( 'watch', $article )->execute();
to:
WatchAction::doWatch( $title, $user );
While replacing the usages in some cases an instance of Article() no longer had to be created, in others $wgUser had to be retrieved from global (which was implied before but needs to be given directly now)
Other notes:
* Article->unwatch() and Article->watch(), which were deprecated as of 1.18 and are no longer used in core, may be broken in scenarios where the Request does not have a 'token' but is making a call to $article->watch()
* Some extensions need to be fixed, I'm currently running a grep search and will fix them a.s.a.p
[1] http://www.mediawiki.org/wiki/ResourceLoader/Default_modules?mw.user#tokens
2011-06-06 00:09:03 +00:00
|
|
|
|
2013-06-13 17:56:29 +00:00
|
|
|
$status = Status::newFatal( 'hookaborted' );
|
2016-02-17 09:09:32 +00:00
|
|
|
if ( Hooks::run( 'WatchArticle', [ &$user, &$page, &$status ] ) ) {
|
2013-06-13 17:56:29 +00:00
|
|
|
$status = Status::newGood();
|
2013-06-13 18:02:55 +00:00
|
|
|
$user->addWatch( $title, $checkRights );
|
2016-02-17 09:09:32 +00:00
|
|
|
Hooks::run( 'WatchArticleComplete', [ &$user, &$page ] );
|
WatchAction requires token (BREAKING CHANGE)
* (bug 27655) Require token for watching/unwatching pages
* Previously done for API (bug 29070) in r88522
* As with markpatrolled, the tokens are not compatible and made that way on purpose. The API requires the POST method and uses a universal token per-session. Since the front-end is all GET based (also per convention like in markpatrolled and rollback) they are stronger salted (title / action specific)
* ajax.watch used the API already and was switched in r88554.
* The actual watching/unwatching code was moved from WatchAction->onView to WatchAction::doWatch. This was done to allow the API to do the action without needing to generate a token like the front-end needs (or having to duplicate code). It is now similar to RecentChange::markPatrolled (in that it also a "central" function that does not care about tokens, it's called after the token-handling)
* JavaScript / Gadgets that utilize action=watch in their scripts:
** Effects should be minimal as they should be using the API (see r88522 and wikitech-l)
** If they use index.php and scrap the link from the page, they can continue to do so.
* There are links to the watch action all over the place. I've tried to catch most of them, but there may be some I miss. Migration in most cases is just a matter of adding an array item to the $query for:
'token' => WatchAction::getWatchToken( $title, $user [, $action] )
or changing:
Action::factory( 'watch', $article )->execute();
to:
WatchAction::doWatch( $title, $user );
While replacing the usages in some cases an instance of Article() no longer had to be created, in others $wgUser had to be retrieved from global (which was implied before but needs to be given directly now)
Other notes:
* Article->unwatch() and Article->watch(), which were deprecated as of 1.18 and are no longer used in core, may be broken in scenarios where the Request does not have a 'token' but is making a call to $article->watch()
* Some extensions need to be fixed, I'm currently running a grep search and will fix them a.s.a.p
[1] http://www.mediawiki.org/wiki/ResourceLoader/Default_modules?mw.user#tokens
2011-06-06 00:09:03 +00:00
|
|
|
}
|
2013-11-14 11:18:26 +00:00
|
|
|
|
2013-06-13 17:56:29 +00:00
|
|
|
return $status;
|
WatchAction requires token (BREAKING CHANGE)
* (bug 27655) Require token for watching/unwatching pages
* Previously done for API (bug 29070) in r88522
* As with markpatrolled, the tokens are not compatible and made that way on purpose. The API requires the POST method and uses a universal token per-session. Since the front-end is all GET based (also per convention like in markpatrolled and rollback) they are stronger salted (title / action specific)
* ajax.watch used the API already and was switched in r88554.
* The actual watching/unwatching code was moved from WatchAction->onView to WatchAction::doWatch. This was done to allow the API to do the action without needing to generate a token like the front-end needs (or having to duplicate code). It is now similar to RecentChange::markPatrolled (in that it also a "central" function that does not care about tokens, it's called after the token-handling)
* JavaScript / Gadgets that utilize action=watch in their scripts:
** Effects should be minimal as they should be using the API (see r88522 and wikitech-l)
** If they use index.php and scrap the link from the page, they can continue to do so.
* There are links to the watch action all over the place. I've tried to catch most of them, but there may be some I miss. Migration in most cases is just a matter of adding an array item to the $query for:
'token' => WatchAction::getWatchToken( $title, $user [, $action] )
or changing:
Action::factory( 'watch', $article )->execute();
to:
WatchAction::doWatch( $title, $user );
While replacing the usages in some cases an instance of Article() no longer had to be created, in others $wgUser had to be retrieved from global (which was implied before but needs to be given directly now)
Other notes:
* Article->unwatch() and Article->watch(), which were deprecated as of 1.18 and are no longer used in core, may be broken in scenarios where the Request does not have a 'token' but is making a call to $article->watch()
* Some extensions need to be fixed, I'm currently running a grep search and will fix them a.s.a.p
[1] http://www.mediawiki.org/wiki/ResourceLoader/Default_modules?mw.user#tokens
2011-06-06 00:09:03 +00:00
|
|
|
}
|
|
|
|
|
|
2013-06-13 17:56:29 +00:00
|
|
|
/**
|
|
|
|
|
* Unwatch a page
|
|
|
|
|
* @since 1.22 Returns Status
|
|
|
|
|
* @param Title $title Page to watch/unwatch
|
|
|
|
|
* @param User $user User who is watching/unwatching
|
|
|
|
|
* @return Status
|
|
|
|
|
*/
|
2013-04-27 12:02:08 +00:00
|
|
|
public static function doUnwatch( Title $title, User $user ) {
|
2013-06-13 18:02:55 +00:00
|
|
|
if ( !$user->isAllowed( 'editmywatchlist' ) ) {
|
|
|
|
|
return User::newFatalPermissionDeniedStatus( 'editmywatchlist' );
|
|
|
|
|
}
|
|
|
|
|
|
2012-01-06 16:28:11 +00:00
|
|
|
$page = WikiPage::factory( $title );
|
WatchAction requires token (BREAKING CHANGE)
* (bug 27655) Require token for watching/unwatching pages
* Previously done for API (bug 29070) in r88522
* As with markpatrolled, the tokens are not compatible and made that way on purpose. The API requires the POST method and uses a universal token per-session. Since the front-end is all GET based (also per convention like in markpatrolled and rollback) they are stronger salted (title / action specific)
* ajax.watch used the API already and was switched in r88554.
* The actual watching/unwatching code was moved from WatchAction->onView to WatchAction::doWatch. This was done to allow the API to do the action without needing to generate a token like the front-end needs (or having to duplicate code). It is now similar to RecentChange::markPatrolled (in that it also a "central" function that does not care about tokens, it's called after the token-handling)
* JavaScript / Gadgets that utilize action=watch in their scripts:
** Effects should be minimal as they should be using the API (see r88522 and wikitech-l)
** If they use index.php and scrap the link from the page, they can continue to do so.
* There are links to the watch action all over the place. I've tried to catch most of them, but there may be some I miss. Migration in most cases is just a matter of adding an array item to the $query for:
'token' => WatchAction::getWatchToken( $title, $user [, $action] )
or changing:
Action::factory( 'watch', $article )->execute();
to:
WatchAction::doWatch( $title, $user );
While replacing the usages in some cases an instance of Article() no longer had to be created, in others $wgUser had to be retrieved from global (which was implied before but needs to be given directly now)
Other notes:
* Article->unwatch() and Article->watch(), which were deprecated as of 1.18 and are no longer used in core, may be broken in scenarios where the Request does not have a 'token' but is making a call to $article->watch()
* Some extensions need to be fixed, I'm currently running a grep search and will fix them a.s.a.p
[1] http://www.mediawiki.org/wiki/ResourceLoader/Default_modules?mw.user#tokens
2011-06-06 00:09:03 +00:00
|
|
|
|
2013-06-13 17:56:29 +00:00
|
|
|
$status = Status::newFatal( 'hookaborted' );
|
2016-02-17 09:09:32 +00:00
|
|
|
if ( Hooks::run( 'UnwatchArticle', [ &$user, &$page, &$status ] ) ) {
|
2013-06-13 17:56:29 +00:00
|
|
|
$status = Status::newGood();
|
WatchAction requires token (BREAKING CHANGE)
* (bug 27655) Require token for watching/unwatching pages
* Previously done for API (bug 29070) in r88522
* As with markpatrolled, the tokens are not compatible and made that way on purpose. The API requires the POST method and uses a universal token per-session. Since the front-end is all GET based (also per convention like in markpatrolled and rollback) they are stronger salted (title / action specific)
* ajax.watch used the API already and was switched in r88554.
* The actual watching/unwatching code was moved from WatchAction->onView to WatchAction::doWatch. This was done to allow the API to do the action without needing to generate a token like the front-end needs (or having to duplicate code). It is now similar to RecentChange::markPatrolled (in that it also a "central" function that does not care about tokens, it's called after the token-handling)
* JavaScript / Gadgets that utilize action=watch in their scripts:
** Effects should be minimal as they should be using the API (see r88522 and wikitech-l)
** If they use index.php and scrap the link from the page, they can continue to do so.
* There are links to the watch action all over the place. I've tried to catch most of them, but there may be some I miss. Migration in most cases is just a matter of adding an array item to the $query for:
'token' => WatchAction::getWatchToken( $title, $user [, $action] )
or changing:
Action::factory( 'watch', $article )->execute();
to:
WatchAction::doWatch( $title, $user );
While replacing the usages in some cases an instance of Article() no longer had to be created, in others $wgUser had to be retrieved from global (which was implied before but needs to be given directly now)
Other notes:
* Article->unwatch() and Article->watch(), which were deprecated as of 1.18 and are no longer used in core, may be broken in scenarios where the Request does not have a 'token' but is making a call to $article->watch()
* Some extensions need to be fixed, I'm currently running a grep search and will fix them a.s.a.p
[1] http://www.mediawiki.org/wiki/ResourceLoader/Default_modules?mw.user#tokens
2011-06-06 00:09:03 +00:00
|
|
|
$user->removeWatch( $title );
|
2016-02-17 09:09:32 +00:00
|
|
|
Hooks::run( 'UnwatchArticleComplete', [ &$user, &$page ] );
|
WatchAction requires token (BREAKING CHANGE)
* (bug 27655) Require token for watching/unwatching pages
* Previously done for API (bug 29070) in r88522
* As with markpatrolled, the tokens are not compatible and made that way on purpose. The API requires the POST method and uses a universal token per-session. Since the front-end is all GET based (also per convention like in markpatrolled and rollback) they are stronger salted (title / action specific)
* ajax.watch used the API already and was switched in r88554.
* The actual watching/unwatching code was moved from WatchAction->onView to WatchAction::doWatch. This was done to allow the API to do the action without needing to generate a token like the front-end needs (or having to duplicate code). It is now similar to RecentChange::markPatrolled (in that it also a "central" function that does not care about tokens, it's called after the token-handling)
* JavaScript / Gadgets that utilize action=watch in their scripts:
** Effects should be minimal as they should be using the API (see r88522 and wikitech-l)
** If they use index.php and scrap the link from the page, they can continue to do so.
* There are links to the watch action all over the place. I've tried to catch most of them, but there may be some I miss. Migration in most cases is just a matter of adding an array item to the $query for:
'token' => WatchAction::getWatchToken( $title, $user [, $action] )
or changing:
Action::factory( 'watch', $article )->execute();
to:
WatchAction::doWatch( $title, $user );
While replacing the usages in some cases an instance of Article() no longer had to be created, in others $wgUser had to be retrieved from global (which was implied before but needs to be given directly now)
Other notes:
* Article->unwatch() and Article->watch(), which were deprecated as of 1.18 and are no longer used in core, may be broken in scenarios where the Request does not have a 'token' but is making a call to $article->watch()
* Some extensions need to be fixed, I'm currently running a grep search and will fix them a.s.a.p
[1] http://www.mediawiki.org/wiki/ResourceLoader/Default_modules?mw.user#tokens
2011-06-06 00:09:03 +00:00
|
|
|
}
|
2013-11-14 11:18:26 +00:00
|
|
|
|
2013-06-13 17:56:29 +00:00
|
|
|
return $status;
|
WatchAction requires token (BREAKING CHANGE)
* (bug 27655) Require token for watching/unwatching pages
* Previously done for API (bug 29070) in r88522
* As with markpatrolled, the tokens are not compatible and made that way on purpose. The API requires the POST method and uses a universal token per-session. Since the front-end is all GET based (also per convention like in markpatrolled and rollback) they are stronger salted (title / action specific)
* ajax.watch used the API already and was switched in r88554.
* The actual watching/unwatching code was moved from WatchAction->onView to WatchAction::doWatch. This was done to allow the API to do the action without needing to generate a token like the front-end needs (or having to duplicate code). It is now similar to RecentChange::markPatrolled (in that it also a "central" function that does not care about tokens, it's called after the token-handling)
* JavaScript / Gadgets that utilize action=watch in their scripts:
** Effects should be minimal as they should be using the API (see r88522 and wikitech-l)
** If they use index.php and scrap the link from the page, they can continue to do so.
* There are links to the watch action all over the place. I've tried to catch most of them, but there may be some I miss. Migration in most cases is just a matter of adding an array item to the $query for:
'token' => WatchAction::getWatchToken( $title, $user [, $action] )
or changing:
Action::factory( 'watch', $article )->execute();
to:
WatchAction::doWatch( $title, $user );
While replacing the usages in some cases an instance of Article() no longer had to be created, in others $wgUser had to be retrieved from global (which was implied before but needs to be given directly now)
Other notes:
* Article->unwatch() and Article->watch(), which were deprecated as of 1.18 and are no longer used in core, may be broken in scenarios where the Request does not have a 'token' but is making a call to $article->watch()
* Some extensions need to be fixed, I'm currently running a grep search and will fix them a.s.a.p
[1] http://www.mediawiki.org/wiki/ResourceLoader/Default_modules?mw.user#tokens
2011-06-06 00:09:03 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* Get token to watch (or unwatch) a page for a user
|
|
|
|
|
*
|
|
|
|
|
* @param Title $title Title object of page to watch
|
2012-02-01 20:53:38 +00:00
|
|
|
* @param User $user User for whom the action is going to be performed
|
WatchAction requires token (BREAKING CHANGE)
* (bug 27655) Require token for watching/unwatching pages
* Previously done for API (bug 29070) in r88522
* As with markpatrolled, the tokens are not compatible and made that way on purpose. The API requires the POST method and uses a universal token per-session. Since the front-end is all GET based (also per convention like in markpatrolled and rollback) they are stronger salted (title / action specific)
* ajax.watch used the API already and was switched in r88554.
* The actual watching/unwatching code was moved from WatchAction->onView to WatchAction::doWatch. This was done to allow the API to do the action without needing to generate a token like the front-end needs (or having to duplicate code). It is now similar to RecentChange::markPatrolled (in that it also a "central" function that does not care about tokens, it's called after the token-handling)
* JavaScript / Gadgets that utilize action=watch in their scripts:
** Effects should be minimal as they should be using the API (see r88522 and wikitech-l)
** If they use index.php and scrap the link from the page, they can continue to do so.
* There are links to the watch action all over the place. I've tried to catch most of them, but there may be some I miss. Migration in most cases is just a matter of adding an array item to the $query for:
'token' => WatchAction::getWatchToken( $title, $user [, $action] )
or changing:
Action::factory( 'watch', $article )->execute();
to:
WatchAction::doWatch( $title, $user );
While replacing the usages in some cases an instance of Article() no longer had to be created, in others $wgUser had to be retrieved from global (which was implied before but needs to be given directly now)
Other notes:
* Article->unwatch() and Article->watch(), which were deprecated as of 1.18 and are no longer used in core, may be broken in scenarios where the Request does not have a 'token' but is making a call to $article->watch()
* Some extensions need to be fixed, I'm currently running a grep search and will fix them a.s.a.p
[1] http://www.mediawiki.org/wiki/ResourceLoader/Default_modules?mw.user#tokens
2011-06-06 00:09:03 +00:00
|
|
|
* @param string $action Optionally override the action to 'unwatch'
|
|
|
|
|
* @return string Token
|
2011-07-18 23:01:08 +00:00
|
|
|
* @since 1.18
|
WatchAction requires token (BREAKING CHANGE)
* (bug 27655) Require token for watching/unwatching pages
* Previously done for API (bug 29070) in r88522
* As with markpatrolled, the tokens are not compatible and made that way on purpose. The API requires the POST method and uses a universal token per-session. Since the front-end is all GET based (also per convention like in markpatrolled and rollback) they are stronger salted (title / action specific)
* ajax.watch used the API already and was switched in r88554.
* The actual watching/unwatching code was moved from WatchAction->onView to WatchAction::doWatch. This was done to allow the API to do the action without needing to generate a token like the front-end needs (or having to duplicate code). It is now similar to RecentChange::markPatrolled (in that it also a "central" function that does not care about tokens, it's called after the token-handling)
* JavaScript / Gadgets that utilize action=watch in their scripts:
** Effects should be minimal as they should be using the API (see r88522 and wikitech-l)
** If they use index.php and scrap the link from the page, they can continue to do so.
* There are links to the watch action all over the place. I've tried to catch most of them, but there may be some I miss. Migration in most cases is just a matter of adding an array item to the $query for:
'token' => WatchAction::getWatchToken( $title, $user [, $action] )
or changing:
Action::factory( 'watch', $article )->execute();
to:
WatchAction::doWatch( $title, $user );
While replacing the usages in some cases an instance of Article() no longer had to be created, in others $wgUser had to be retrieved from global (which was implied before but needs to be given directly now)
Other notes:
* Article->unwatch() and Article->watch(), which were deprecated as of 1.18 and are no longer used in core, may be broken in scenarios where the Request does not have a 'token' but is making a call to $article->watch()
* Some extensions need to be fixed, I'm currently running a grep search and will fix them a.s.a.p
[1] http://www.mediawiki.org/wiki/ResourceLoader/Default_modules?mw.user#tokens
2011-06-06 00:09:03 +00:00
|
|
|
*/
|
|
|
|
|
public static function getWatchToken( Title $title, User $user, $action = 'watch' ) {
|
|
|
|
|
if ( $action != 'unwatch' ) {
|
|
|
|
|
$action = 'watch';
|
|
|
|
|
}
|
2015-09-28 21:32:45 +00:00
|
|
|
// Match ApiWatch and ResourceLoaderUserTokensModule
|
|
|
|
|
return $user->getEditToken( $action );
|
WatchAction requires token (BREAKING CHANGE)
* (bug 27655) Require token for watching/unwatching pages
* Previously done for API (bug 29070) in r88522
* As with markpatrolled, the tokens are not compatible and made that way on purpose. The API requires the POST method and uses a universal token per-session. Since the front-end is all GET based (also per convention like in markpatrolled and rollback) they are stronger salted (title / action specific)
* ajax.watch used the API already and was switched in r88554.
* The actual watching/unwatching code was moved from WatchAction->onView to WatchAction::doWatch. This was done to allow the API to do the action without needing to generate a token like the front-end needs (or having to duplicate code). It is now similar to RecentChange::markPatrolled (in that it also a "central" function that does not care about tokens, it's called after the token-handling)
* JavaScript / Gadgets that utilize action=watch in their scripts:
** Effects should be minimal as they should be using the API (see r88522 and wikitech-l)
** If they use index.php and scrap the link from the page, they can continue to do so.
* There are links to the watch action all over the place. I've tried to catch most of them, but there may be some I miss. Migration in most cases is just a matter of adding an array item to the $query for:
'token' => WatchAction::getWatchToken( $title, $user [, $action] )
or changing:
Action::factory( 'watch', $article )->execute();
to:
WatchAction::doWatch( $title, $user );
While replacing the usages in some cases an instance of Article() no longer had to be created, in others $wgUser had to be retrieved from global (which was implied before but needs to be given directly now)
Other notes:
* Article->unwatch() and Article->watch(), which were deprecated as of 1.18 and are no longer used in core, may be broken in scenarios where the Request does not have a 'token' but is making a call to $article->watch()
* Some extensions need to be fixed, I'm currently running a grep search and will fix them a.s.a.p
[1] http://www.mediawiki.org/wiki/ResourceLoader/Default_modules?mw.user#tokens
2011-06-06 00:09:03 +00:00
|
|
|
}
|
|
|
|
|
|
2016-01-14 00:06:06 +00:00
|
|
|
public function doesWrites() {
|
|
|
|
|
return true;
|
|
|
|
|
}
|
2011-04-14 10:38:29 +00:00
|
|
|
}
|