Revert r70640 per CR: don't expose unsalted edit tokens in URLs. Should instead chang...

diff --git a/includes/Article.php b/includes/Article.php
index 07f3e5d..71aae25 100644 (file)
--- a/includes/Article.php
+++ b/includes/Article.php
@@ -1308,7 +1308,7 @@ class Article {
                }
 
                $sk = $wgUser->getSkin();
-               $token = $wgUser->editToken();
+               $token = $wgUser->editToken( $rcid );
 
                $wgOut->addHTML(
                        "<div class='patrollink'>" .
@@ -2348,7 +2348,7 @@ class Article {
                # If we haven't been given an rc_id value, we can't do anything
                $rcid = (int) $wgRequest->getVal( 'rcid' );
 
-               if ( !$wgUser->matchEditToken( $wgRequest->getVal( 'token' ) ) ) {
+               if ( !$wgUser->matchEditToken( $wgRequest->getVal( 'token' ), $rcid ) ) {
                        $wgOut->showErrorPage( 'sessionfailure-title', 'sessionfailure' );
                        return;
                }

diff --git a/includes/diff/DifferenceInterface.php b/includes/diff/DifferenceInterface.php
index f59aa56..0281f13 100644 (file)
--- a/includes/diff/DifferenceInterface.php
+++ b/includes/diff/DifferenceInterface.php
@@ -243,7 +243,7 @@ CONTROL;
                        }
                        // Build the link
                        if( $rcid ) {
-                               $token = $wgUser->editToken();
+                               $token = $wgUser->editToken( $rcid );
                                $patrol = ' <span class="patrollink">[' . $sk->link(
                                        $this->mTitle, 
                                        wfMsgHtml( 'markaspatrolleddiff' ),
@@ -474,7 +474,7 @@ CONTROL;
                # Add redundant patrol link on bottom...
                if( $this->mRcidMarkPatrolled && $this->mTitle->quickUserCan('patrol') ) {
                        $sk = $wgUser->getSkin();
-                       $token = $wgUser->editToken();
+                       $token = $wgUser->editToken( $this->mRcidMarkPatrolled );
                        $wgOut->addHTML(
                                "<div class='patrollink'>[" . $sk->link(
                                        $this->mTitle,