jenkins-bot has submitted this change and it was merged.
Change subject: Add extra security check to Echo API to prevent vandalism
......................................................................
Add extra security check to Echo API to prevent vandalism
1. Only trigger mark as read if the unread notification count is > 0
1. Add a limit to the number of notification that can be marked as read
2. Only update those records with read_timestamp = null
Change-Id: I12456c504787f45f594ef9283e98d98692956935
---
M api/ApiEchoNotifications.php
M includes/DbEchoBackend.php
2 files changed, 10 insertions(+), 4 deletions(-)
Approvals:
Matthias Mullie: Looks good to me, approved
jenkins-bot: Verified
diff --git a/api/ApiEchoNotifications.php b/api/ApiEchoNotifications.php
index 8f4b71c..b1c3184 100644
--- a/api/ApiEchoNotifications.php
+++ b/api/ApiEchoNotifications.php
@@ -12,10 +12,15 @@
}
$params = $this->extractRequestParams();
- if ( count( $params['markread'] ) ) {
- EchoNotificationController::markRead( $user,
$params['markread'] );
- } elseif ( $params['markallread'] ) {
- EchoNotificationController::markAllRead( $user );
+
+ // There is no need to trigger markRead if all notifications
are read
+ if ( EchoNotificationController::getNotificationCount( $user )
> 0 ) {
+ if ( count( $params['markread'] ) ) {
+ // Make sure there is a limit to the update
+ EchoNotificationController::markRead( $user,
array_slice( $params['markread'], 0, ApiBase::LIMIT_SML2 ) );
+ } elseif ( $params['markallread'] ) {
+ EchoNotificationController::markAllRead( $user
);
+ }
}
$prop = $params['prop'];
diff --git a/includes/DbEchoBackend.php b/includes/DbEchoBackend.php
index 3e570d2..8936902 100644
--- a/includes/DbEchoBackend.php
+++ b/includes/DbEchoBackend.php
@@ -229,6 +229,7 @@
array(
'notification_user' => $user->getId(),
'notification_event' => $eventIDs,
+ 'notification_read_timestamp' => null,
),
__METHOD__
);
--
To view, visit https://gerrit.wikimedia.org/r/62211
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: merged
Gerrit-Change-Id: I12456c504787f45f594ef9283e98d98692956935
Gerrit-PatchSet: 2
Gerrit-Project: mediawiki/extensions/Echo
Gerrit-Branch: master
Gerrit-Owner: Bsitu <[email protected]>
Gerrit-Reviewer: Kaldari <[email protected]>
Gerrit-Reviewer: Lwelling <[email protected]>
Gerrit-Reviewer: Matthias Mullie <[email protected]>
Gerrit-Reviewer: jenkins-bot
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
