MediaWiki 1.16.0

[autoinstalls/mediawiki.git] / includes / specials / SpecialUserlogout.php

diff --git a/includes/specials/SpecialUserlogout.php b/includes/specials/SpecialUserlogout.php
index 3d497bd7d785de6a5a65ebed68e49c48debe3e3a..e23df612cc64d649506d50cf9d7c938de03ba6bf 100644 (file)
--- a/includes/specials/SpecialUserlogout.php
+++ b/includes/specials/SpecialUserlogout.php
@@ -10,6 +10,16 @@
 function wfSpecialUserlogout() {
        global $wgUser, $wgOut;
 
+       /**
+        * Some satellite ISPs use broken precaching schemes that log people out straight after
+        * they're logged in (bug 17790). Luckily, there's a way to detect such requests.
+        */
+       if ( isset( $_SERVER['REQUEST_URI'] ) && strpos( $_SERVER['REQUEST_URI'], '&' ) !== false ) {
+               wfDebug( "Special:Userlogout request {$_SERVER['REQUEST_URI']} looks suspicious, denying.\n" );
+               wfHttpError( 400, wfMsg( 'loginerror' ), wfMsg( 'suspicious-userlogout' ) );
+               return;
+       }
+       
        $oldName = $wgUser->getName();
        $wgUser->logout();
        $wgOut->setRobotPolicy( 'noindex,nofollow' );