diff options
| author | Petr Pchelko <ppchelko@wikimedia.org> | 2021-06-01 11:43:35 -0700 |
|---|---|---|
| committer | Petr Pchelko <ppchelko@wikimedia.org> | 2021-07-12 14:19:15 -0700 |
| commit | 0d75fdb4f73ddbf4ad5f29e14258d58e507d55b4 (patch) | |
| tree | 9e17f616f0b17370c219c3e4a339c0f3476155e7 /includes/FileDeleteForm.php | |
| parent | 4e7ac57b46e5397f88d1de723bee345bf9d83e8f (diff) | |
| download | mediawikicore-0d75fdb4f73ddbf4ad5f29e14258d58e507d55b4.tar.gz mediawikicore-0d75fdb4f73ddbf4ad5f29e14258d58e507d55b4.zip | |
Use CsrfTokenSet as CSRF token source
Change-Id: I079d2c802d9b48d6abf7f37fa9ef7dafac631345
Diffstat (limited to 'includes/FileDeleteForm.php')
| -rw-r--r-- | includes/FileDeleteForm.php | 11 |
1 files changed, 7 insertions, 4 deletions
diff --git a/includes/FileDeleteForm.php b/includes/FileDeleteForm.php index 8d2828df87b0..3e7a6e235a71 100644 --- a/includes/FileDeleteForm.php +++ b/includes/FileDeleteForm.php @@ -25,6 +25,7 @@ use MediaWiki\Linker\LinkRenderer; use MediaWiki\MediaWikiServices; use MediaWiki\Permissions\PermissionStatus; +use MediaWiki\Session\CsrfTokenSet; use MediaWiki\User\UserIdentity; use MediaWiki\User\UserOptionsLookup; use MediaWiki\Watchlist\WatchlistManager; @@ -111,7 +112,6 @@ class FileDeleteForm { $request = $this->context->getRequest(); $this->oldimage = $request->getText( 'oldimage', '' ); - $token = $request->getText( 'wpEditToken' ); # Flag to hide all contents of the archived revisions $suppress = $request->getCheck( 'wpSuppress' ) && $this->context->getAuthority()->isAllowed( 'suppressrevision' ); @@ -130,7 +130,10 @@ class FileDeleteForm { } // Perform the deletion if appropriate - if ( $request->wasPosted() && $this->context->getUser()->matchEditToken( $token, $this->oldimage ) ) { + if ( $request->wasPosted() && + $this->context->getCsrfTokenSet() + ->matchTokenField( CsrfTokenSet::DEFAULT_FIELD_NAME, $this->oldimage ) + ) { $permissionStatus = PermissionStatus::newEmpty(); if ( !$this->context->getAuthority()->authorizeWrite( 'delete', $this->title, $permissionStatus @@ -431,8 +434,8 @@ class FileDeleteForm { $fieldset, new OOUI\HtmlSnippet( Html::hidden( - 'wpEditToken', - $this->context->getUser()->getEditToken( $this->oldimage ) + CsrfTokenSet::DEFAULT_FIELD_NAME, + $this->context->getCsrfTokenSet()->getToken( $this->oldimage )->toString() ) ) ); |