r88522 MediaWiki - Code Review archive

Repository:MediaWiki
Revision:r88521‎ | r88522 | r88523 >
Date:16:38, 21 May 2011
Author:reedy
Status:ok (Comments)
Tags:
Comment:
* (bug 29070) Add token to action=watch
Modified paths:
  • /trunk/phase3/RELEASE-NOTES-1.19 (modified) (history)
  • /trunk/phase3/includes/api/ApiQueryInfo.php (modified) (history)
  • /trunk/phase3/includes/api/ApiWatch.php (modified) (history)

Diff [purge]

Index: trunk/phase3/RELEASE-NOTES-1.19
@@ -83,6 +83,7 @@
8484 * (bug 28578) API's parse module should not silently override invalid
8585 title inputs
8686 * (bug 20699) API watchlist should list log-events
 87+* (bug 29070) Add token to action=watch
8788
8889 === Languages updated in 1.19 ===
8990
Index: trunk/phase3/includes/api/ApiQueryInfo.php
@@ -98,6 +98,7 @@
9999 'unblock' => array( 'ApiQueryInfo', 'getUnblockToken' ),
100100 'email' => array( 'ApiQueryInfo', 'getEmailToken' ),
101101 'import' => array( 'ApiQueryInfo', 'getImportToken' ),
 102+ 'watch' => array( 'ApiQueryInfo', 'getWatchToken'),
102103 );
103104 wfRunHooks( 'APIQueryInfoTokens', array( &$this->tokenFunctions ) );
104105 return $this->tokenFunctions;
@@ -217,6 +218,21 @@
218219 return $cachedImportToken;
219220 }
220221
 222+ public static function getWatchToken( $pageid, $title ) {
 223+ global $wgUser;
 224+ if ( !$wgUser->isLoggedIn() ) {
 225+ return false;
 226+ }
 227+
 228+ static $cachedWatchToken = null;
 229+ if ( !is_null( $cachedWatchToken ) ) {
 230+ return $cachedWatchToken;
 231+ }
 232+
 233+ $cachedWatchToken = $wgUser->editToken( 'watch' );
 234+ return $cachedWatchToken;
 235+ }
 236+
221237 public function execute() {
222238 $this->params = $this->extractRequestParams();
223239 if ( !is_null( $this->params['prop'] ) ) {
Index: trunk/phase3/includes/api/ApiWatch.php
@@ -71,18 +71,30 @@
7272 $this->getResult()->addValue( null, $this->getModuleName(), $res );
7373 }
7474
 75+ public function mustBePosted() {
 76+ return true;
 77+ }
 78+
7579 public function isWriteMode() {
7680 return true;
7781 }
7882
 83+ public function needsToken() {
 84+ return true;
 85+ }
 86+
 87+ public function getTokenSalt() {
 88+ return 'watch';
 89+ }
 90+
7991 public function getAllowedParams() {
8092 return array(
8193 'title' => array(
8294 ApiBase::PARAM_TYPE => 'string',
8395 ApiBase::PARAM_REQUIRED => true
8496 ),
85 -
8697 'unwatch' => false,
 98+ 'token' => null,
8799 );
88100 }
89101
@@ -90,6 +102,7 @@
91103 return array(
92104 'title' => 'The page to (un)watch',
93105 'unwatch' => 'If set the page will be unwatched rather than watched',
 106+ 'token' => 'A token previously acquired via prop=info',
94107 );
95108 }
96109

Follow-up revisions

RevisionCommit summaryAuthorDate
r88527Fixing mediawiki.action.watch.ajax...krinkle18:33, 21 May 2011
r88554Passing token paremeter in mw.action.watch.ajax since this is required as of ...krinkle23:14, 21 May 2011
r89545WatchAction requires token (BREAKING CHANGE)...krinkle00:09, 6 June 2011

Comments

#Comment by Duplicatebug (talk | contribs)   17:25, 24 May 2011

Why not using the watchlisttoken from the Preferences, which is used for feeds and so on?

#Comment by Catrope (talk | contribs)   15:58, 2 June 2011

That's different. The watchlist token is used for authentication, the watch token is used to prevent CSRF.

Status & tagging log