| Subject: | rollback is dangerously broken |
I think this problem is more difficult to describe than to fix, but here
goes.
Rollback is a quick way of removing vandalism; you just specify the page
and the user, and that user's edits are reverted, if they still have the
top edit. Currently, the module silently replaced the specified user
with the last editor to the page, which defeats the safety check. This
means the rollback would always happen, but it's as likely to replace
vandalism that was reverted as it is to revert it, pretty much defeating
the purpose. I'll mark the severity high, since someone who tries to
use this function could get blocked for misuse of it due to this problem.
There's a similar problem with the timestamp for the first edit. The
script should keep the timestamp when the page is retrieved, and pass it
back when saving, so the API can detect edit conflicts, but the module
also replaces that with the most recent available timestamp at the time
of the submit, thus disabling any conflicts that could happen during the
processing. This is only done for the first edit, which is the main
reason I removed that part entirely, so it could be more consistent.
Neither of these overwritten parameters was documented; I only noticed
it when I found that a required parameter wasn't used in the rollback
example. Since the documentation is somewhat thin as most parameters
are simply passed through to the server, it may be better to document
exceptions to that.
| Subject: | rollback2.patch |
--- /usr/local/lib/perl5/site_perl/5.10.0/MediaWiki/API.pm 2008-10-16 16:52:28.000000000 -0400
+++ MediaWiki/API.pm 2008-10-23 12:53:47.000000000 -0400
@@ -364,7 +364,7 @@
# rollback a page edit
$mw->edit( {
- action => 'rollback', title => 'Sandbox' } )
+ action => 'rollback', title => 'Sandbox', user => 'Vandal' } )
|| die $mw->{error}->{code} . ': ' . $mw->{error}->{details};
=cut
@@ -663,16 +663,10 @@
if ( $action eq 'rollback' ) {
$query->{token} = @{ $pageref->{revisions} }[0]->{$action.'token'};
- $query->{user} = @{ $pageref->{revisions} }[0]->{user};
} else {
$query->{token} = $pageref->{$action.'token'};
}
- # need timestamp of last revision for edits to avoid edit conflicts (if there are previous revisions)
- if ( $action eq 'edit' && defined $pageref->{revisions} ) {
- $query->{basetimestamp} = @{ $pageref->{revisions} }[0]->{timestamp};
- }
-
return $self->_error( ERR_EDIT, 'Unable to get an edit token ($page).' ) unless ( defined $query->{token} );
# cache the token. rollback tokens are specific for the page name and last edited user so can not be cached.