Fix session handling in API test cases.

* Use the API module's own context to check edit tokens.
* Use the global session if none is provided to doApiRequest.
* Fix ApiFlockTest to not pass an empty session, so the tokens from
  the global request can be used.

Change-Id: I2bff2390f43beb984b1b451bcf4e41271b2f054f

diff --git a/includes/api/ApiMain.php b/includes/api/ApiMain.php
index 7414a97..30e9fb6 100644 (file)
--- a/includes/api/ApiMain.php
+++ b/includes/api/ApiMain.php
@@ -607,7 +607,7 @@ class ApiMain extends ApiBase {
                        if ( !isset( $moduleParams['token'] ) ) {
                                $this->dieUsageMsg( array( 'missingparam', 'token' ) );
                        } else {
-                               if ( !$this->getUser()->matchEditToken( $moduleParams['token'], $salt ) ) {
+                               if ( !$this->getUser()->matchEditToken( $moduleParams['token'], $salt, $this->getContext()->getRequest() ) ) {
                                        $this->dieUsageMsg( 'sessionfailure' );
                                }
                        }

diff --git a/tests/phpunit/includes/api/ApiBlockTest.php b/tests/phpunit/includes/api/ApiBlockTest.php
index 1f40b5a..5dfceee 100644 (file)
--- a/tests/phpunit/includes/api/ApiBlockTest.php
+++ b/tests/phpunit/includes/api/ApiBlockTest.php
@@ -56,7 +56,7 @@ class ApiBlockTest extends ApiTestCase {
                        'action' => 'block',
                        'user' => 'UTApiBlockee',
                        'reason' => 'Some reason',
-                       'token' => $pageinfo['blocktoken'] ), $data, false, self::$users['sysop']->user );
+                       'token' => $pageinfo['blocktoken'] ), null, false, self::$users['sysop']->user );
 
                $block = Block::newFromTarget('UTApiBlockee');
 

diff --git a/tests/phpunit/includes/api/ApiTestCase.php b/tests/phpunit/includes/api/ApiTestCase.php
index 8801391..23739bf 100644 (file)
--- a/tests/phpunit/includes/api/ApiTestCase.php
+++ b/tests/phpunit/includes/api/ApiTestCase.php
@@ -45,7 +45,10 @@ abstract class ApiTestCase extends MediaWikiLangTestCase {
 
        protected function doApiRequest( $params, $session = null, $appendModule = false, $user = null ) {
                if ( is_null( $session ) ) {
-                       $session = array();
+                       # use global session by default
+
+                       global $wgRequest;
+                       $session = $wgRequest->getSessionArray();
                }
 
                $context = $this->apiContext->newTestContext( $params, $session, $user );