Move CSRF token handling into MediaWiki\Session\Session

[lhc/web/wiklou.git] / includes / api / ApiBase.php

diff --git a/includes/api/ApiBase.php b/includes/api/ApiBase.php
index 8e5cdcc..425a337 100644 (file)
--- a/includes/api/ApiBase.php
+++ b/includes/api/ApiBase.php
@@ -79,7 +79,7 @@ abstract class ApiBase extends ContextSource {
         * - timestamp: A timestamp in any format recognized by MWTimestamp, or the
         *   string 'now' representing the current timestamp. Will be returned in
         *   TS_MW format.
-        * - user: A MediaWiki username. Will be returned normalized but not canonicalized.
+        * - user: A MediaWiki username or IP. Will be returned normalized but not canonicalized.
         * - upload: An uploaded file. Will be returned as a WebRequestUpload object.
         *   Cannot be used with PARAM_ISMULTI.
         */
@@ -97,7 +97,7 @@ abstract class ApiBase extends ContextSource {
        /** (integer) Lowest value allowed for the parameter, for PARAM_TYPE 'integer' and 'limit'. */
        const PARAM_MIN = 5;
 
-       /** (boolean) Allow the same value to be set more than once when PARAM_MULTI is true? */
+       /** (boolean) Allow the same value to be set more than once when PARAM_ISMULTI is true? */
        const PARAM_ALLOW_DUPLICATES = 6;
 
        /** (boolean) Is the parameter deprecated (will show a warning)? */
@@ -214,7 +214,6 @@ abstract class ApiBase extends ContextSource {
                }
        }
 
-
        /************************************************************************//**
         * @name   Methods to implement
         * @{
@@ -638,6 +637,17 @@ abstract class ApiBase extends ContextSource {
         * @{
         */
 
+       /**
+        * Indicate if the module supports dynamically-determined parameters that
+        * cannot be included in self::getAllowedParams().
+        * @return string|array|Message|null Return null if the module does not
+        *  support additional dynamic parameters, otherwise return a message
+        *  describing them.
+        */
+       public function dynamicParameterDocumentation() {
+               return null;
+       }
+
        /**
         * This method mangles parameter name based on the prefix supplied to the constructor.
         * Override this method to change parameter name during runtime
@@ -1250,11 +1260,10 @@ abstract class ApiBase extends ContextSource {
                        );
                }
 
-               if ( $this->getUser()->matchEditToken(
-                       $token,
-                       $salts[$tokenType],
-                       $this->getRequest()
-               ) ) {
+               $tokenObj = ApiQueryTokens::getToken(
+                       $this->getUser(), $this->getRequest()->getSession(), $salts[$tokenType]
+               );
+               if ( $tokenObj->match( $token ) ) {
                        return true;
                }
 
@@ -1461,6 +1470,33 @@ abstract class ApiBase extends ContextSource {
                );
        }
 
+       /**
+        * Throw a UsageException, which will (if uncaught) call the main module's
+        * error handler and die with an error message including block info.
+        *
+        * @since 1.27
+        * @param Block $block The block used to generate the UsageException
+        * @throws UsageException always
+        */
+       public function dieBlocked( Block $block ) {
+               // Die using the appropriate message depending on block type
+               if ( $block->getType() == Block::TYPE_AUTO ) {
+                       $this->dieUsage(
+                               'Your IP address has been blocked automatically, because it was used by a blocked user',
+                               'autoblocked',
+                               0,
+                               array( 'blockinfo' => ApiQueryUserInfo::getBlockInfo( $block ) )
+                       );
+               } else {
+                       $this->dieUsage(
+                               'You have been blocked from editing',
+                               'blocked',
+                               0,
+                               array( 'blockinfo' => ApiQueryUserInfo::getBlockInfo( $block ) )
+                       );
+               }
+       }
+
        /**
         * Get error (as code, string) from a Status object.
         *