Last modified: 2014-08-02 20:31:13 UTC
Open a page's edit window Add a input value of 'wpUndidRevision' with some valid revid. Save. Whoever made that edit will receive an extremely confusing Echo notification. This can easily be exploited by adding the same parameter to an edit made via the API. A warning will be displayed, but the notification is still sent. Ideas on how to fix: Temporary: Check that $rev->getTitle() == $article->getTitle() Maybe also look into using sha1's to only show reverts for exact reverts. Long term: Find some other way than using a request value like wpUndidRevision to trigger a notification.
Change 97191 had a related patch set uploaded by Legoktm: Check supposed revision being reverted is on the same page https://gerrit.wikimedia.org/r/97191
(In reply to comment #0) > Temporary: Check that $rev->getTitle() == $article->getTitle() Patch only addresses this for now.
Change 97191 merged by jenkins-bot: Check supposed revision being reverted is on the same page https://gerrit.wikimedia.org/r/97191
