From: Brad Jorsch <bjorsch@wikimedia.org>
Date: Thu, 18 Sep 2014 19:56:53 +0000 (-0400)
Subject: API: No mustposttoken error with $wgDebugAPI
X-Git-Tag: 1.31.0-rc.0~13946^2
X-Git-Url: http://git.cyclocoop.org//%22%22.str_replace%28%27%22%27%2C?a=commitdiff_plain;h=756691eace9544298ec0afb4dde34693f7bbf735;p=lhc%2Fweb%2Fwiklou.git

API: No mustposttoken error with $wgDebugAPI

$wgDebugAPI is supposed to be a way to quickly (and insecurely) test API
modules using GET where they'd normally require POST. But this purpose
is defeated if token handling still throws mustposttoken.

Change-Id: Iee2fb76da86bf0670f9816f24f68c611fa0728b1
---

diff --git a/includes/api/ApiMain.php b/includes/api/ApiMain.php
index 0d677b19ea..bd20b140f6 100644
--- a/includes/api/ApiMain.php
+++ b/includes/api/ApiMain.php
@@ -783,10 +783,12 @@ class ApiMain extends ApiBase {
 				$this->dieUsageMsg( array( 'missingparam', 'token' ) );
 			}
 
-			if ( array_key_exists(
-				$module->encodeParamName( 'token' ),
-				$this->getRequest()->getQueryValues()
-			) ) {
+			if ( !$this->getConfig()->get( 'DebugAPI' ) &&
+				array_key_exists(
+					$module->encodeParamName( 'token' ),
+					$this->getRequest()->getQueryValues()
+				)
+			) {
 				$this->dieUsage(
 					"The '{$module->encodeParamName( 'token' )}' parameter was found in the query string, but must be in the POST body",
 					'mustposttoken'