r27151 MediaWiki - Code Review archive

Repository:MediaWiki
Revision:r27150‎ | r27151 | r27152 >
Date:09:57, 3 November 2007
Author:catrope
Status:old
Tags:
Comment:
API:
* Allow staying logged in through lg* parameters instead of cookies (modified patch by Eddie Roger)
* Removed ApiLogin's sessionID return value, as it doesn't always work and is redundant anyway
Modified paths:
  • /trunk/phase3/RELEASE-NOTES (modified) (history)
  • /trunk/phase3/includes/api/ApiLogin.php (modified) (history)
  • /trunk/phase3/includes/api/ApiMain.php (modified) (history)

Diff [purge]

Index: trunk/phase3/includes/api/ApiLogin.php
@@ -104,7 +104,6 @@
105105 $result['lgusername'] = $_SESSION['wsUserName'];
106106 $result['lgtoken'] = $_SESSION['wsToken'];
107107 $result['cookieprefix'] = $wgCookiePrefix;
108 - $result['sessionid'] = $_COOKIE["{$wgCookiePrefix}_session"];
109108 break;
110109
111110 case LoginForm :: NO_NAME :
Index: trunk/phase3/includes/api/ApiMain.php
@@ -88,11 +88,24 @@
8989 * @param $enableWrite bool should be set to true if the api may modify data
9090 */
9191 public function __construct($request, $enableWrite = false) {
 92+ global $wgRequest, $wgUser;
9293
9394 $this->mInternalMode = ($request instanceof FauxRequest);
9495
9596 // Special handling for the main module: $parent === $this
9697 parent :: __construct($this, $this->mInternalMode ? 'main_int' : 'main');
 98+
 99+ // Check if request has cookie-like variables, and set them
 100+ if( ($request->getVal('lgtoken')) && ($request->getVal('lgusername')) && ($request->getVal('lguserid')) ) {
 101+
 102+ // Got variables, set cookies.
 103+ $_SESSION['wsUserID'] = $request->getVal('lguserid');
 104+ $_SESSION['wsUserName'] = $request->getVal('lgusername');
 105+ $_SESSION['wsToken'] = $request->getVal('lgtoken');
 106+
 107+ // Reinitialize $wgUser from session data
 108+ $wgUser = User::newFromSession();
 109+ }
97110
98111 if (!$this->mInternalMode) {
99112
Index: trunk/phase3/RELEASE-NOTES
@@ -157,6 +157,7 @@
158158 * (bug 11721) Use a different title for results than for the help page.
159159 * (bug 11562) Added a user_registration parameter/field to the list=allusers query.
160160 * (bug 11588) Preserve document structure for empty dataset in backlinks query.
 161+* Allow staying logged in through lg* parameters instead of cookies
161162
162163 === Languages updated in 1.12 ===
163164

Follow-up revisions

RevisionCommit summaryAuthorDate
r27514Revert r27151 -- allows session fixation attacks....brion04:24, 15 November 2007

Status & tagging log