r64694 MediaWiki - Code Review archive

Repository:MediaWiki
Revision:r64693‎ | r64694 | r64695 >
Date:08:50, 7 April 2010
Author:catrope
Status:ok (Comments)
Tags:
Comment:
Fix for r64677: as reported on mediawiki-api, I forgot about clients that build their own cookies. Support this do-it-yourself method for the NeedToken error as well.
Modified paths:
  • /trunk/phase3/includes/api/ApiLogin.php (modified) (history)

Diff [purge]

Index: trunk/phase3/includes/api/ApiLogin.php
@@ -89,8 +89,11 @@
9090 break;
9191
9292 case LoginForm::NEED_TOKEN:
 93+ global $wgCookiePrefix;
9394 $result['result'] = 'NeedToken';
9495 $result['token'] = $loginForm->getLoginToken();
 96+ $result['cookieprefix'] = $wgCookiePrefix;
 97+ $result['sessionid'] = session_id();
9598 break;
9699
97100 case LoginForm::WRONG_TOKEN:

Follow-up revisions

RevisionCommit summaryAuthorDate
r646951.16wmf3: MFT r64694catrope08:51, 7 April 2010
r64697REL1_16: Backport r64694catrope09:05, 7 April 2010
r696611.16wmf4: MFT r64694. Was merged to 1.16wmf3 but somehow didn't make it into ...catrope09:54, 21 July 2010
r69990* MFT r59948: restore the function of ApiMain::requestWriteMode()....tstarling08:44, 27 July 2010

Past revisions this follows-up on

RevisionCommit summaryAuthorDate
r64677* (bug 23076) Fixed login CSRF vulnerability. Logins now require a token to b...tstarling00:05, 7 April 2010

Comments

#Comment by Reedy (talk | contribs)   19:31, 24 June 2010

Needs merging to 1.16wmf4 please

Status & tagging log