r70640 MediaWiki - Code Review archive

Repository:MediaWiki
Revision:r70639‎ | r70640 | r70641 >
Date:18:56, 7 August 2010
Author:ialex
Status:reverted (Comments)
Tags:
Comment:
Per comments, follow-up to r70278: make patrol tokens compatibles between api and normal interface
Modified paths:
  • /trunk/phase3/includes/Article.php (modified) (history)
  • /trunk/phase3/includes/diff/DifferenceInterface.php (modified) (history)

Diff [purge]

Index: trunk/phase3/includes/diff/DifferenceInterface.php
@@ -236,7 +236,7 @@
237237 }
238238 // Build the link
239239 if( $rcid ) {
240 - $token = $wgUser->editToken( $rcid );
 240+ $token = $wgUser->editToken();
241241 $patrol = ' <span class="patrollink">[' . $sk->link(
242242 $this->mTitle,
243243 wfMsgHtml( 'markaspatrolleddiff' ),
@@ -463,7 +463,7 @@
464464 # Add redundant patrol link on bottom...
465465 if( $this->mRcidMarkPatrolled && $this->mTitle->quickUserCan('patrol') ) {
466466 $sk = $wgUser->getSkin();
467 - $token = $wgUser->editToken( $this->mRcidMarkPatrolled );
 467+ $token = $wgUser->editToken();
468468 $wgOut->addHTML(
469469 "<div class='patrollink'>[" . $sk->link(
470470 $this->mTitle,
Index: trunk/phase3/includes/Article.php
@@ -1307,7 +1307,7 @@
13081308 }
13091309
13101310 $sk = $wgUser->getSkin();
1311 - $token = $wgUser->editToken( $rcid );
 1311+ $token = $wgUser->editToken();
13121312
13131313 $wgOut->addHTML(
13141314 "<div class='patrollink'>" .
@@ -2366,7 +2366,7 @@
23672367 # If we haven't been given an rc_id value, we can't do anything
23682368 $rcid = (int) $wgRequest->getVal( 'rcid' );
23692369
2370 - if ( !$wgUser->matchEditToken( $wgRequest->getVal( 'token' ), $rcid ) ) {
 2370+ if ( !$wgUser->matchEditToken( $wgRequest->getVal( 'token' ) ) ) {
23712371 $wgOut->showErrorPage( 'sessionfailure-title', 'sessionfailure' );
23722372 return;
23732373 }

Follow-up revisions

RevisionCommit summaryAuthorDate
r75270Revert r70640 per CR: don't expose unsalted edit tokens in URLs. Should inste...catrope16:56, 23 October 2010
r75274BREAKING CHANGE: Per r70640 CR, salt patrol tokens with rcid in the API too. ...catrope17:22, 23 October 2010

Past revisions this follows-up on

RevisionCommit summaryAuthorDate
r70278* (bug 24418) action=markpatrolled now requires a tokenialex15:50, 1 August 2010

Comments

#Comment by Platonides (talk | contribs)   22:20, 7 August 2010

You are exposing the main token inside an url. This leaks it to proxy logs, referer urls...

You should instead change the api to use the token salted with the rcid. Such token can only be used to patrol that edit and so it's not an issue if a third party gains knowledge of it.

Status & tagging log