From: Brad Jorsch <bjorsch@wikimedia.org>
Date: Tue, 29 Nov 2016 16:32:48 +0000 (-0500)
Subject: API: Make action=clearhasmsg require POST
X-Git-Tag: 1.31.0-rc.0~4742
X-Git-Url: http://git.cyclocoop.org/%24image?a=commitdiff_plain;h=080370fb5bd6d29f675cf773e864661b9987b602;p=lhc%2Fweb%2Fwiklou.git

API: Make action=clearhasmsg require POST

Bug: T146526
Change-Id: I341b395e532e7bdc7816f0deae8c6e5e8c9e8f3b
---

diff --git a/RELEASE-NOTES-1.29 b/RELEASE-NOTES-1.29
index 386dee405e..5b5640fffb 100644
--- a/RELEASE-NOTES-1.29
+++ b/RELEASE-NOTES-1.29
@@ -36,6 +36,7 @@ production.
   in the query string is now an error. They should be submitted in the POST
   body instead.
 * The capture option for action=resetpassword has been removed
+* action=clearhasmsg now requires a POST.
 
 === Action API internal changes in 1.29 ===
 
diff --git a/includes/api/ApiClearHasMsg.php b/includes/api/ApiClearHasMsg.php
index 13b35772be..99242a8b0d 100644
--- a/includes/api/ApiClearHasMsg.php
+++ b/includes/api/ApiClearHasMsg.php
@@ -45,7 +45,7 @@ class ApiClearHasMsg extends ApiBase {
 	}
 
 	public function mustBePosted() {
-		return false;
+		return true;
 	}
 
 	protected function getExamplesMessages() {