On Fri, Sep 26, 2008 at 12:04 PM, Tei <oscar.vives(a)gmail.com> wrote: Nothing except the external link filter, the captcha, and a lot of editors ready to revert them. For anon users, the edit token exists to ensure integrity of the submission, i.e., that it was submitted correctly and as intended. For logged-in users, it also makes impersonation more difficult. It is not meant to prevent incorrect submissions, which is a much higher-level job.

On Fri, Sep 26, 2008 at 12:43 PM, Tei <oscar.vives(a)gmail.com> wrote: As far as I recall, the captcha is triggered if any new external link is added. But some links are blacklisted and can never be added regardless. Ajax doesn't work across domains. If a rogue sysop were to add malicious JS to MediaWiki:Common.js, then sure, you could probably do fun stuff like forge edits somehow.

Aryeh Gregor wrote: Yes, it's a kluge I added sometime last year, I think. The problem is that there's a huge install base of broken "PHP proxy" scripts that essentially pass all content through the PHP addslashes() function (or, rather, they have magic_quotes_gpc enabled and don't use stripslashes()). Trying to edit through such a proxy would, in particular, turn all apostrophes in the page text into "\'" or even "\\\'". We used to get such edits with some regularity. Having a backslash in the edit token prevents editing via such proxies, since they will mangle it in the same way. As a nice bonus, it also happens to prevent some widespread spam- and vandalbots from using those proxies to hide their trails. (The reason I didn't include an actual apostrophe in the edit token was that, at least at the time, in some parts of the code the edit token was being embedded in hardcoded HTML without proper escaping, at least in some cases with single quotes around it. I didn't feel like tracking down and fixing all cases of that at the time (though it certainly should be done if someone hasn't already), so I just used a backslash, which breaks in the same way but has no special meaning in HTML.) I'm not sure why the "+" is there; I think it protects against another type of broken proxy that turns plus signs into spaces, presumably due to improper URL-decoding of form values. It's indeed a hack, but it does work remarkably well for all its simplicity. It'd probably deserve to be documented better, though, so that others won't have to ask the same question as you did. -- Ilmari Karonen

Ilmari Karonen schreef: The entire edit token system, including the +\ suffix, is documented at MW.org [1]. Roan Kattouw (Catrope) [1] http://www.mediawiki.org/wiki/Manual:Edit_token

Kalan schreef: You mean in the edit token? There currently aren't, it's just a hexadecimal number (0-9 and a-f) with \+ at the end. I'm personally wary of abusing the edit token too much for this purpose. \ and + are there because clients mangling those characters screw up big time, whereas Unicode/IPA damage is fairly limited (unless you're editing in a language that uses Unicode characters extensively, such as German). Roan Kattouw (Catrope)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Aryeh Gregor wrote: ... or any English-language page that has interlanguage links... :) - -- brion

On Thu, Oct 9, 2008 at 4:01 AM, Tei <oscar.vives(a)gmail.com> wrote: If editing Wikipedia doesn't work, particularly if it fails with an informative error message instead of "edit token didn't match", maybe the users will report it themselves.