wiki.techinc.nl/includes/actions/WatchAction.php

180 lines
4.9 KiB
PHP
Raw Normal View History

<?php
/**
* Performs the watch actions on a page
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
*
* @file
* @ingroup Actions
*/
/**
* Page addition to a user's watchlist
*
* @ingroup Actions
*/
class WatchAction extends FormAction {
public function getName() {
return 'watch';
}
public function requiresUnblock() {
return false;
}
protected function getDescription() {
return '';
}
public function onSubmit( $data ) {
return self::doWatch( $this->getTitle(), $this->getUser() );
}
protected function checkCanExecute( User $user ) {
// Must be logged in
if ( $user->isAnon() ) {
throw new UserNotLoggedIn( 'watchlistanontext', 'watchnologin' );
}
parent::checkCanExecute( $user );
}
WatchAction requires token (BREAKING CHANGE) * (bug 27655) Require token for watching/unwatching pages * Previously done for API (bug 29070) in r88522 * As with markpatrolled, the tokens are not compatible and made that way on purpose. The API requires the POST method and uses a universal token per-session. Since the front-end is all GET based (also per convention like in markpatrolled and rollback) they are stronger salted (title / action specific) * ajax.watch used the API already and was switched in r88554. * The actual watching/unwatching code was moved from WatchAction->onView to WatchAction::doWatch. This was done to allow the API to do the action without needing to generate a token like the front-end needs (or having to duplicate code). It is now similar to RecentChange::markPatrolled (in that it also a "central" function that does not care about tokens, it's called after the token-handling) * JavaScript / Gadgets that utilize action=watch in their scripts: ** Effects should be minimal as they should be using the API (see r88522 and wikitech-l) ** If they use index.php and scrap the link from the page, they can continue to do so. * There are links to the watch action all over the place. I've tried to catch most of them, but there may be some I miss. Migration in most cases is just a matter of adding an array item to the $query for: 'token' => WatchAction::getWatchToken( $title, $user [, $action] ) or changing: Action::factory( 'watch', $article )->execute(); to: WatchAction::doWatch( $title, $user ); While replacing the usages in some cases an instance of Article() no longer had to be created, in others $wgUser had to be retrieved from global (which was implied before but needs to be given directly now) Other notes: * Article->unwatch() and Article->watch(), which were deprecated as of 1.18 and are no longer used in core, may be broken in scenarios where the Request does not have a 'token' but is making a call to $article->watch() * Some extensions need to be fixed, I'm currently running a grep search and will fix them a.s.a.p [1] http://www.mediawiki.org/wiki/ResourceLoader/Default_modules?mw.user#tokens
2011-06-06 00:09:03 +00:00
protected function usesOOUI() {
return true;
}
protected function getFormFields() {
return [
'intro' => [
'type' => 'info',
'vertical-label' => true,
'raw' => true,
'default' => $this->msg( 'confirm-watch-top' )->parse()
]
];
}
protected function alterForm( HTMLForm $form ) {
$form->setWrapperLegendMsg( 'addwatch' );
$form->setSubmitTextMsg( 'confirm-watch-button' );
$form->setTokenSalt( 'watch' );
}
public function onSuccess() {
$msgKey = $this->getTitle()->isTalkPage() ? 'addedwatchtext-talk' : 'addedwatchtext';
$this->getOutput()->addWikiMsg( $msgKey, $this->getTitle()->getPrefixedText() );
}
/**
* Watch or unwatch a page
* @since 1.22
* @param bool $watch Whether to watch or unwatch the page
* @param Title $title Page to watch/unwatch
* @param User $user User who is watching/unwatching
* @return Status
*/
public static function doWatchOrUnwatch( $watch, Title $title, User $user ) {
if ( $user->isLoggedIn() &&
$user->isWatched( $title, User::IGNORE_USER_RIGHTS ) != $watch
) {
// If the user doesn't have 'editmywatchlist', we still want to
// allow them to add but not remove items via edits and such.
if ( $watch ) {
return self::doWatch( $title, $user, User::IGNORE_USER_RIGHTS );
} else {
return self::doUnwatch( $title, $user );
}
}
return Status::newGood();
}
/**
* Watch a page
* @since 1.22 Returns Status, $checkRights parameter added
* @param Title $title Page to watch/unwatch
* @param User $user User who is watching/unwatching
* @param bool $checkRights Passed through to $user->addWatch()
* Pass User::CHECK_USER_RIGHTS or User::IGNORE_USER_RIGHTS.
* @return Status
*/
public static function doWatch(
Title $title,
User $user,
$checkRights = User::CHECK_USER_RIGHTS
) {
if ( $checkRights && !$user->isAllowed( 'editmywatchlist' ) ) {
return User::newFatalPermissionDeniedStatus( 'editmywatchlist' );
}
$page = WikiPage::factory( $title );
WatchAction requires token (BREAKING CHANGE) * (bug 27655) Require token for watching/unwatching pages * Previously done for API (bug 29070) in r88522 * As with markpatrolled, the tokens are not compatible and made that way on purpose. The API requires the POST method and uses a universal token per-session. Since the front-end is all GET based (also per convention like in markpatrolled and rollback) they are stronger salted (title / action specific) * ajax.watch used the API already and was switched in r88554. * The actual watching/unwatching code was moved from WatchAction->onView to WatchAction::doWatch. This was done to allow the API to do the action without needing to generate a token like the front-end needs (or having to duplicate code). It is now similar to RecentChange::markPatrolled (in that it also a "central" function that does not care about tokens, it's called after the token-handling) * JavaScript / Gadgets that utilize action=watch in their scripts: ** Effects should be minimal as they should be using the API (see r88522 and wikitech-l) ** If they use index.php and scrap the link from the page, they can continue to do so. * There are links to the watch action all over the place. I've tried to catch most of them, but there may be some I miss. Migration in most cases is just a matter of adding an array item to the $query for: 'token' => WatchAction::getWatchToken( $title, $user [, $action] ) or changing: Action::factory( 'watch', $article )->execute(); to: WatchAction::doWatch( $title, $user ); While replacing the usages in some cases an instance of Article() no longer had to be created, in others $wgUser had to be retrieved from global (which was implied before but needs to be given directly now) Other notes: * Article->unwatch() and Article->watch(), which were deprecated as of 1.18 and are no longer used in core, may be broken in scenarios where the Request does not have a 'token' but is making a call to $article->watch() * Some extensions need to be fixed, I'm currently running a grep search and will fix them a.s.a.p [1] http://www.mediawiki.org/wiki/ResourceLoader/Default_modules?mw.user#tokens
2011-06-06 00:09:03 +00:00
$status = Status::newFatal( 'hookaborted' );
if ( Hooks::run( 'WatchArticle', [ &$user, &$page, &$status ] ) ) {
$status = Status::newGood();
$user->addWatch( $title, $checkRights );
Hooks::run( 'WatchArticleComplete', [ &$user, &$page ] );
WatchAction requires token (BREAKING CHANGE) * (bug 27655) Require token for watching/unwatching pages * Previously done for API (bug 29070) in r88522 * As with markpatrolled, the tokens are not compatible and made that way on purpose. The API requires the POST method and uses a universal token per-session. Since the front-end is all GET based (also per convention like in markpatrolled and rollback) they are stronger salted (title / action specific) * ajax.watch used the API already and was switched in r88554. * The actual watching/unwatching code was moved from WatchAction->onView to WatchAction::doWatch. This was done to allow the API to do the action without needing to generate a token like the front-end needs (or having to duplicate code). It is now similar to RecentChange::markPatrolled (in that it also a "central" function that does not care about tokens, it's called after the token-handling) * JavaScript / Gadgets that utilize action=watch in their scripts: ** Effects should be minimal as they should be using the API (see r88522 and wikitech-l) ** If they use index.php and scrap the link from the page, they can continue to do so. * There are links to the watch action all over the place. I've tried to catch most of them, but there may be some I miss. Migration in most cases is just a matter of adding an array item to the $query for: 'token' => WatchAction::getWatchToken( $title, $user [, $action] ) or changing: Action::factory( 'watch', $article )->execute(); to: WatchAction::doWatch( $title, $user ); While replacing the usages in some cases an instance of Article() no longer had to be created, in others $wgUser had to be retrieved from global (which was implied before but needs to be given directly now) Other notes: * Article->unwatch() and Article->watch(), which were deprecated as of 1.18 and are no longer used in core, may be broken in scenarios where the Request does not have a 'token' but is making a call to $article->watch() * Some extensions need to be fixed, I'm currently running a grep search and will fix them a.s.a.p [1] http://www.mediawiki.org/wiki/ResourceLoader/Default_modules?mw.user#tokens
2011-06-06 00:09:03 +00:00
}
return $status;
WatchAction requires token (BREAKING CHANGE) * (bug 27655) Require token for watching/unwatching pages * Previously done for API (bug 29070) in r88522 * As with markpatrolled, the tokens are not compatible and made that way on purpose. The API requires the POST method and uses a universal token per-session. Since the front-end is all GET based (also per convention like in markpatrolled and rollback) they are stronger salted (title / action specific) * ajax.watch used the API already and was switched in r88554. * The actual watching/unwatching code was moved from WatchAction->onView to WatchAction::doWatch. This was done to allow the API to do the action without needing to generate a token like the front-end needs (or having to duplicate code). It is now similar to RecentChange::markPatrolled (in that it also a "central" function that does not care about tokens, it's called after the token-handling) * JavaScript / Gadgets that utilize action=watch in their scripts: ** Effects should be minimal as they should be using the API (see r88522 and wikitech-l) ** If they use index.php and scrap the link from the page, they can continue to do so. * There are links to the watch action all over the place. I've tried to catch most of them, but there may be some I miss. Migration in most cases is just a matter of adding an array item to the $query for: 'token' => WatchAction::getWatchToken( $title, $user [, $action] ) or changing: Action::factory( 'watch', $article )->execute(); to: WatchAction::doWatch( $title, $user ); While replacing the usages in some cases an instance of Article() no longer had to be created, in others $wgUser had to be retrieved from global (which was implied before but needs to be given directly now) Other notes: * Article->unwatch() and Article->watch(), which were deprecated as of 1.18 and are no longer used in core, may be broken in scenarios where the Request does not have a 'token' but is making a call to $article->watch() * Some extensions need to be fixed, I'm currently running a grep search and will fix them a.s.a.p [1] http://www.mediawiki.org/wiki/ResourceLoader/Default_modules?mw.user#tokens
2011-06-06 00:09:03 +00:00
}
/**
* Unwatch a page
* @since 1.22 Returns Status
* @param Title $title Page to watch/unwatch
* @param User $user User who is watching/unwatching
* @return Status
*/
public static function doUnwatch( Title $title, User $user ) {
if ( !$user->isAllowed( 'editmywatchlist' ) ) {
return User::newFatalPermissionDeniedStatus( 'editmywatchlist' );
}
$page = WikiPage::factory( $title );
WatchAction requires token (BREAKING CHANGE) * (bug 27655) Require token for watching/unwatching pages * Previously done for API (bug 29070) in r88522 * As with markpatrolled, the tokens are not compatible and made that way on purpose. The API requires the POST method and uses a universal token per-session. Since the front-end is all GET based (also per convention like in markpatrolled and rollback) they are stronger salted (title / action specific) * ajax.watch used the API already and was switched in r88554. * The actual watching/unwatching code was moved from WatchAction->onView to WatchAction::doWatch. This was done to allow the API to do the action without needing to generate a token like the front-end needs (or having to duplicate code). It is now similar to RecentChange::markPatrolled (in that it also a "central" function that does not care about tokens, it's called after the token-handling) * JavaScript / Gadgets that utilize action=watch in their scripts: ** Effects should be minimal as they should be using the API (see r88522 and wikitech-l) ** If they use index.php and scrap the link from the page, they can continue to do so. * There are links to the watch action all over the place. I've tried to catch most of them, but there may be some I miss. Migration in most cases is just a matter of adding an array item to the $query for: 'token' => WatchAction::getWatchToken( $title, $user [, $action] ) or changing: Action::factory( 'watch', $article )->execute(); to: WatchAction::doWatch( $title, $user ); While replacing the usages in some cases an instance of Article() no longer had to be created, in others $wgUser had to be retrieved from global (which was implied before but needs to be given directly now) Other notes: * Article->unwatch() and Article->watch(), which were deprecated as of 1.18 and are no longer used in core, may be broken in scenarios where the Request does not have a 'token' but is making a call to $article->watch() * Some extensions need to be fixed, I'm currently running a grep search and will fix them a.s.a.p [1] http://www.mediawiki.org/wiki/ResourceLoader/Default_modules?mw.user#tokens
2011-06-06 00:09:03 +00:00
$status = Status::newFatal( 'hookaborted' );
if ( Hooks::run( 'UnwatchArticle', [ &$user, &$page, &$status ] ) ) {
$status = Status::newGood();
WatchAction requires token (BREAKING CHANGE) * (bug 27655) Require token for watching/unwatching pages * Previously done for API (bug 29070) in r88522 * As with markpatrolled, the tokens are not compatible and made that way on purpose. The API requires the POST method and uses a universal token per-session. Since the front-end is all GET based (also per convention like in markpatrolled and rollback) they are stronger salted (title / action specific) * ajax.watch used the API already and was switched in r88554. * The actual watching/unwatching code was moved from WatchAction->onView to WatchAction::doWatch. This was done to allow the API to do the action without needing to generate a token like the front-end needs (or having to duplicate code). It is now similar to RecentChange::markPatrolled (in that it also a "central" function that does not care about tokens, it's called after the token-handling) * JavaScript / Gadgets that utilize action=watch in their scripts: ** Effects should be minimal as they should be using the API (see r88522 and wikitech-l) ** If they use index.php and scrap the link from the page, they can continue to do so. * There are links to the watch action all over the place. I've tried to catch most of them, but there may be some I miss. Migration in most cases is just a matter of adding an array item to the $query for: 'token' => WatchAction::getWatchToken( $title, $user [, $action] ) or changing: Action::factory( 'watch', $article )->execute(); to: WatchAction::doWatch( $title, $user ); While replacing the usages in some cases an instance of Article() no longer had to be created, in others $wgUser had to be retrieved from global (which was implied before but needs to be given directly now) Other notes: * Article->unwatch() and Article->watch(), which were deprecated as of 1.18 and are no longer used in core, may be broken in scenarios where the Request does not have a 'token' but is making a call to $article->watch() * Some extensions need to be fixed, I'm currently running a grep search and will fix them a.s.a.p [1] http://www.mediawiki.org/wiki/ResourceLoader/Default_modules?mw.user#tokens
2011-06-06 00:09:03 +00:00
$user->removeWatch( $title );
Hooks::run( 'UnwatchArticleComplete', [ &$user, &$page ] );
WatchAction requires token (BREAKING CHANGE) * (bug 27655) Require token for watching/unwatching pages * Previously done for API (bug 29070) in r88522 * As with markpatrolled, the tokens are not compatible and made that way on purpose. The API requires the POST method and uses a universal token per-session. Since the front-end is all GET based (also per convention like in markpatrolled and rollback) they are stronger salted (title / action specific) * ajax.watch used the API already and was switched in r88554. * The actual watching/unwatching code was moved from WatchAction->onView to WatchAction::doWatch. This was done to allow the API to do the action without needing to generate a token like the front-end needs (or having to duplicate code). It is now similar to RecentChange::markPatrolled (in that it also a "central" function that does not care about tokens, it's called after the token-handling) * JavaScript / Gadgets that utilize action=watch in their scripts: ** Effects should be minimal as they should be using the API (see r88522 and wikitech-l) ** If they use index.php and scrap the link from the page, they can continue to do so. * There are links to the watch action all over the place. I've tried to catch most of them, but there may be some I miss. Migration in most cases is just a matter of adding an array item to the $query for: 'token' => WatchAction::getWatchToken( $title, $user [, $action] ) or changing: Action::factory( 'watch', $article )->execute(); to: WatchAction::doWatch( $title, $user ); While replacing the usages in some cases an instance of Article() no longer had to be created, in others $wgUser had to be retrieved from global (which was implied before but needs to be given directly now) Other notes: * Article->unwatch() and Article->watch(), which were deprecated as of 1.18 and are no longer used in core, may be broken in scenarios where the Request does not have a 'token' but is making a call to $article->watch() * Some extensions need to be fixed, I'm currently running a grep search and will fix them a.s.a.p [1] http://www.mediawiki.org/wiki/ResourceLoader/Default_modules?mw.user#tokens
2011-06-06 00:09:03 +00:00
}
return $status;
WatchAction requires token (BREAKING CHANGE) * (bug 27655) Require token for watching/unwatching pages * Previously done for API (bug 29070) in r88522 * As with markpatrolled, the tokens are not compatible and made that way on purpose. The API requires the POST method and uses a universal token per-session. Since the front-end is all GET based (also per convention like in markpatrolled and rollback) they are stronger salted (title / action specific) * ajax.watch used the API already and was switched in r88554. * The actual watching/unwatching code was moved from WatchAction->onView to WatchAction::doWatch. This was done to allow the API to do the action without needing to generate a token like the front-end needs (or having to duplicate code). It is now similar to RecentChange::markPatrolled (in that it also a "central" function that does not care about tokens, it's called after the token-handling) * JavaScript / Gadgets that utilize action=watch in their scripts: ** Effects should be minimal as they should be using the API (see r88522 and wikitech-l) ** If they use index.php and scrap the link from the page, they can continue to do so. * There are links to the watch action all over the place. I've tried to catch most of them, but there may be some I miss. Migration in most cases is just a matter of adding an array item to the $query for: 'token' => WatchAction::getWatchToken( $title, $user [, $action] ) or changing: Action::factory( 'watch', $article )->execute(); to: WatchAction::doWatch( $title, $user ); While replacing the usages in some cases an instance of Article() no longer had to be created, in others $wgUser had to be retrieved from global (which was implied before but needs to be given directly now) Other notes: * Article->unwatch() and Article->watch(), which were deprecated as of 1.18 and are no longer used in core, may be broken in scenarios where the Request does not have a 'token' but is making a call to $article->watch() * Some extensions need to be fixed, I'm currently running a grep search and will fix them a.s.a.p [1] http://www.mediawiki.org/wiki/ResourceLoader/Default_modules?mw.user#tokens
2011-06-06 00:09:03 +00:00
}
/**
* Get token to watch (or unwatch) a page for a user
*
* @param Title $title Title object of page to watch
* @param User $user User for whom the action is going to be performed
WatchAction requires token (BREAKING CHANGE) * (bug 27655) Require token for watching/unwatching pages * Previously done for API (bug 29070) in r88522 * As with markpatrolled, the tokens are not compatible and made that way on purpose. The API requires the POST method and uses a universal token per-session. Since the front-end is all GET based (also per convention like in markpatrolled and rollback) they are stronger salted (title / action specific) * ajax.watch used the API already and was switched in r88554. * The actual watching/unwatching code was moved from WatchAction->onView to WatchAction::doWatch. This was done to allow the API to do the action without needing to generate a token like the front-end needs (or having to duplicate code). It is now similar to RecentChange::markPatrolled (in that it also a "central" function that does not care about tokens, it's called after the token-handling) * JavaScript / Gadgets that utilize action=watch in their scripts: ** Effects should be minimal as they should be using the API (see r88522 and wikitech-l) ** If they use index.php and scrap the link from the page, they can continue to do so. * There are links to the watch action all over the place. I've tried to catch most of them, but there may be some I miss. Migration in most cases is just a matter of adding an array item to the $query for: 'token' => WatchAction::getWatchToken( $title, $user [, $action] ) or changing: Action::factory( 'watch', $article )->execute(); to: WatchAction::doWatch( $title, $user ); While replacing the usages in some cases an instance of Article() no longer had to be created, in others $wgUser had to be retrieved from global (which was implied before but needs to be given directly now) Other notes: * Article->unwatch() and Article->watch(), which were deprecated as of 1.18 and are no longer used in core, may be broken in scenarios where the Request does not have a 'token' but is making a call to $article->watch() * Some extensions need to be fixed, I'm currently running a grep search and will fix them a.s.a.p [1] http://www.mediawiki.org/wiki/ResourceLoader/Default_modules?mw.user#tokens
2011-06-06 00:09:03 +00:00
* @param string $action Optionally override the action to 'unwatch'
* @return string Token
* @since 1.18
WatchAction requires token (BREAKING CHANGE) * (bug 27655) Require token for watching/unwatching pages * Previously done for API (bug 29070) in r88522 * As with markpatrolled, the tokens are not compatible and made that way on purpose. The API requires the POST method and uses a universal token per-session. Since the front-end is all GET based (also per convention like in markpatrolled and rollback) they are stronger salted (title / action specific) * ajax.watch used the API already and was switched in r88554. * The actual watching/unwatching code was moved from WatchAction->onView to WatchAction::doWatch. This was done to allow the API to do the action without needing to generate a token like the front-end needs (or having to duplicate code). It is now similar to RecentChange::markPatrolled (in that it also a "central" function that does not care about tokens, it's called after the token-handling) * JavaScript / Gadgets that utilize action=watch in their scripts: ** Effects should be minimal as they should be using the API (see r88522 and wikitech-l) ** If they use index.php and scrap the link from the page, they can continue to do so. * There are links to the watch action all over the place. I've tried to catch most of them, but there may be some I miss. Migration in most cases is just a matter of adding an array item to the $query for: 'token' => WatchAction::getWatchToken( $title, $user [, $action] ) or changing: Action::factory( 'watch', $article )->execute(); to: WatchAction::doWatch( $title, $user ); While replacing the usages in some cases an instance of Article() no longer had to be created, in others $wgUser had to be retrieved from global (which was implied before but needs to be given directly now) Other notes: * Article->unwatch() and Article->watch(), which were deprecated as of 1.18 and are no longer used in core, may be broken in scenarios where the Request does not have a 'token' but is making a call to $article->watch() * Some extensions need to be fixed, I'm currently running a grep search and will fix them a.s.a.p [1] http://www.mediawiki.org/wiki/ResourceLoader/Default_modules?mw.user#tokens
2011-06-06 00:09:03 +00:00
*/
public static function getWatchToken( Title $title, User $user, $action = 'watch' ) {
if ( $action != 'unwatch' ) {
$action = 'watch';
}
// Match ApiWatch and ResourceLoaderUserTokensModule
return $user->getEditToken( $action );
WatchAction requires token (BREAKING CHANGE) * (bug 27655) Require token for watching/unwatching pages * Previously done for API (bug 29070) in r88522 * As with markpatrolled, the tokens are not compatible and made that way on purpose. The API requires the POST method and uses a universal token per-session. Since the front-end is all GET based (also per convention like in markpatrolled and rollback) they are stronger salted (title / action specific) * ajax.watch used the API already and was switched in r88554. * The actual watching/unwatching code was moved from WatchAction->onView to WatchAction::doWatch. This was done to allow the API to do the action without needing to generate a token like the front-end needs (or having to duplicate code). It is now similar to RecentChange::markPatrolled (in that it also a "central" function that does not care about tokens, it's called after the token-handling) * JavaScript / Gadgets that utilize action=watch in their scripts: ** Effects should be minimal as they should be using the API (see r88522 and wikitech-l) ** If they use index.php and scrap the link from the page, they can continue to do so. * There are links to the watch action all over the place. I've tried to catch most of them, but there may be some I miss. Migration in most cases is just a matter of adding an array item to the $query for: 'token' => WatchAction::getWatchToken( $title, $user [, $action] ) or changing: Action::factory( 'watch', $article )->execute(); to: WatchAction::doWatch( $title, $user ); While replacing the usages in some cases an instance of Article() no longer had to be created, in others $wgUser had to be retrieved from global (which was implied before but needs to be given directly now) Other notes: * Article->unwatch() and Article->watch(), which were deprecated as of 1.18 and are no longer used in core, may be broken in scenarios where the Request does not have a 'token' but is making a call to $article->watch() * Some extensions need to be fixed, I'm currently running a grep search and will fix them a.s.a.p [1] http://www.mediawiki.org/wiki/ResourceLoader/Default_modules?mw.user#tokens
2011-06-06 00:09:03 +00:00
}
public function doesWrites() {
return true;
}
}