Merge "Default the "watchlisttoken" value to a derived HMAC value"

diff --combined RELEASE-NOTES-1.26
index ff7f884,9b93740..a532171
--- 1/RELEASE-NOTES-1.26
--- 2/RELEASE-NOTES-1.26
+++ b/RELEASE-NOTES-1.26
@@@ -27,8 -27,6 +27,8 @@@ production
    MediaWiki 1.26, in where ResourceLoader became fully asynchronous.
  * $wgMasterWaitTimeout was removed (deprecated in 1.24).
  * Fields in ParserOptions are now private. Use the accessors instead.
 +* Custom LESS functions (defined via $wgResourceLoaderLESSFunctions)
 +  have been removed, after being deprecated in 1.24.
  
  === New features in 1.26 ===
  * (T51506) Now action=info gives estimates of actual watchers for a page.
@@@ -85,8 -83,6 +85,8 @@@
  * (T53283) load.php sometimes sends 304 response without full headers
  * (T65198) Talk page tabs now have a "rel=discussion" attribute
  * (T98841) {{msgnw:}} now preserves comments even when subst: is not used.
 +* (T104142) $wgEmergencyContact and $wgPasswordSender now use their default
 +  value if set to an empty string.
  
  === Action API changes in 1.26 ===
  * New-style continuation is now the default for action=continue. Clients may
@@@ -170,6 -166,9 +170,9 @@@ changes to languages because of Phabric
    a lengthy deprecation period.
  * The ScopedPHPTimeout class was removed.
  * Removed maintenance script fixSlaveDesync.php.
+ * Watchlist tokens, SpecialResetTokens, and User::getTokenFromOption()
+   are deprecated. Applications using those can work via the OAuth
+   extension instead. New tokens types should not be added.
  
  == Compatibility ==
  

diff --combined includes/User.php
index da8ff79,4276a7d..605dab6
--- 1/includes/User.php
--- 2/includes/User.php
+++ b/includes/User.php
@@@ -2438,6 -2438,7 +2438,7 @@@ class User implements IDBAccessObject 
         */
        public function setInternalPassword( $str ) {
                $this->setToken();
+               $this->setOption( 'watchlisttoken', false );
  
                $passwordFactory = self::getPasswordFactory();
                $this->mPassword = $passwordFactory->newFromPlaintext( $str );
@@@ -2715,20 -2716,24 +2716,24 @@@
         * @return string|bool User's current value for the option, or false if this option is disabled.
         * @see resetTokenFromOption()
         * @see getOption()
+        * @deprecated 1.26 Applications should use the OAuth extension
         */
        public function getTokenFromOption( $oname ) {
                global $wgHiddenPrefs;
-               if ( in_array( $oname, $wgHiddenPrefs ) ) {
+ 
+               $id = $this->getId();
+               if ( !$id || in_array( $oname, $wgHiddenPrefs ) ) {
                        return false;
                }
  
                $token = $this->getOption( $oname );
                if ( !$token ) {
-                       $token = $this->resetTokenFromOption( $oname );
-                       if ( !wfReadOnly() ) {
-                               $this->saveSettings();
-                       }
+                       // Default to a value based on the user token to avoid space
+                       // wasted on storing tokens for all users. When this option
+                       // is set manually by the user, only then is it stored.
+                       $token = hash_hmac( 'sha1', "$oname:$id", $this->getToken() );
                }
+ 
                return $token;
        }
  
@@@ -3208,10 -3213,10 +3213,10 @@@
        /**
         * Check if user is allowed to access a feature / make an action
         *
 -       * @param string $permissions,... Permissions to test
 +       * @param string ... Permissions to test
         * @return bool True if user is allowed to perform *any* of the given actions
         */
 -      public function isAllowedAny( /*...*/ ) {
 +      public function isAllowedAny() {
                $permissions = func_get_args();
                foreach ( $permissions as $permission ) {
                        if ( $this->isAllowed( $permission ) ) {
@@@ -3223,10 -3228,10 +3228,10 @@@
  
        /**
         *
 -       * @param string $permissions,... Permissions to test
 +       * @param string ... Permissions to test
         * @return bool True if the user is allowed to perform *all* of the given actions
         */
 -      public function isAllowedAll( /*...*/ ) {
 +      public function isAllowedAll() {
                $permissions = func_get_args();
                foreach ( $permissions as $permission ) {
                        if ( !$this->isAllowed( $permission ) ) {