Fix gettoken loophole from https://gerrit.wikimedia.org/r/#change,4220

Reported and patch by Szymon Świerkosz/Beau

Change-Id: I3b5a001ad60e7e637b351331794cb275a7cf021a

diff --git a/includes/api/ApiMain.php b/includes/api/ApiMain.php
index 2105b81..8c035dc 100644 (file)
--- a/includes/api/ApiMain.php
+++ b/includes/api/ApiMain.php
@@ -595,8 +595,14 @@ class ApiMain extends ApiBase {
                $moduleParams = $module->extractRequestParams();
 
                // Die if token required, but not provided (unless there is a gettoken parameter)
+               if ( isset( $moduleParams['gettoken'] ) ) {
+                       $gettoken = $moduleParams['gettoken'];
+               } else {
+                       $gettoken = false;
+               }
+
                $salt = $module->getTokenSalt();
-               if ( $salt !== false && isset( $moduleParams['gettoken'] ) && !$moduleParams['gettoken'] ) {
+               if ( $salt !== false && !$gettoken ) {
                        if ( !isset( $moduleParams['token'] ) ) {
                                $this->dieUsageMsg( array( 'missingparam', 'token' ) );
                        } else {