Bsitu has uploaded a new change for review.
https://gerrit.wikimedia.org/r/62211
Change subject: Add extra security to Echo markread API
......................................................................
Add extra security to Echo markread API
1. Add a limit to the number of notification that can be marked as read
2. Only update those records with read_timestamp = null
Change-Id: I12456c504787f45f594ef9283e98d98692956935
---
M api/ApiEchoNotifications.php
M includes/DbEchoBackend.php
2 files changed, 3 insertions(+), 1 deletion(-)
git pull ssh://gerrit.wikimedia.org:29418/mediawiki/extensions/Echo
refs/changes/11/62211/1
diff --git a/api/ApiEchoNotifications.php b/api/ApiEchoNotifications.php
index 8f4b71c..02d0d88 100644
--- a/api/ApiEchoNotifications.php
+++ b/api/ApiEchoNotifications.php
@@ -13,7 +13,8 @@
$params = $this->extractRequestParams();
if ( count( $params['markread'] ) ) {
- EchoNotificationController::markRead( $user,
$params['markread'] );
+ // Make sure there is a limit to the update
+ EchoNotificationController::markRead( $user,
array_slice( $params['markread'], 0, ApiBase::LIMIT_SML2 ) );
} elseif ( $params['markallread'] ) {
EchoNotificationController::markAllRead( $user );
}
diff --git a/includes/DbEchoBackend.php b/includes/DbEchoBackend.php
index 3e570d2..8936902 100644
--- a/includes/DbEchoBackend.php
+++ b/includes/DbEchoBackend.php
@@ -229,6 +229,7 @@
array(
'notification_user' => $user->getId(),
'notification_event' => $eventIDs,
+ 'notification_read_timestamp' => null,
),
__METHOD__
);
--
To view, visit https://gerrit.wikimedia.org/r/62211
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: newchange
Gerrit-Change-Id: I12456c504787f45f594ef9283e98d98692956935
Gerrit-PatchSet: 1
Gerrit-Project: mediawiki/extensions/Echo
Gerrit-Branch: master
Gerrit-Owner: Bsitu <[email protected]>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
