From 080370fb5bd6d29f675cf773e864661b9987b602 Mon Sep 17 00:00:00 2001
From: Brad Jorsch <bjorsch@wikimedia.org>
Date: Tue, 29 Nov 2016 11:32:48 -0500
Subject: [PATCH] API: Make action=clearhasmsg require POST

Bug: T146526
Change-Id: I341b395e532e7bdc7816f0deae8c6e5e8c9e8f3b
---
 RELEASE-NOTES-1.29              | 1 +
 includes/api/ApiClearHasMsg.php | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/RELEASE-NOTES-1.29 b/RELEASE-NOTES-1.29
index 386dee405e..5b5640fffb 100644
--- a/RELEASE-NOTES-1.29
+++ b/RELEASE-NOTES-1.29
@@ -36,6 +36,7 @@ production.
   in the query string is now an error. They should be submitted in the POST
   body instead.
 * The capture option for action=resetpassword has been removed
+* action=clearhasmsg now requires a POST.
 
 === Action API internal changes in 1.29 ===
 
diff --git a/includes/api/ApiClearHasMsg.php b/includes/api/ApiClearHasMsg.php
index 13b35772be..99242a8b0d 100644
--- a/includes/api/ApiClearHasMsg.php
+++ b/includes/api/ApiClearHasMsg.php
@@ -45,7 +45,7 @@ class ApiClearHasMsg extends ApiBase {
 	}
 
 	public function mustBePosted() {
-		return false;
+		return true;
 	}
 
 	protected function getExamplesMessages() {
-- 
2.20.1