From e331655cf017910f99861b122d1f1acdcf67628c Mon Sep 17 00:00:00 2001
From: Roan Kattouw <catrope@users.mediawiki.org>
Date: Sat, 23 Oct 2010 16:56:07 +0000
Subject: [PATCH] Revert r70640 per CR: don't expose unsalted edit tokens in
 URLs. Should instead change the API's patrol functionality to salt patrol
 tokens (coming up shortly)

---
 includes/Article.php                  | 4 ++--
 includes/diff/DifferenceInterface.php | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/includes/Article.php b/includes/Article.php
index 07f3e5da08..71aae25702 100644
--- a/includes/Article.php
+++ b/includes/Article.php
@@ -1308,7 +1308,7 @@ class Article {
 		}
 
 		$sk = $wgUser->getSkin();
-		$token = $wgUser->editToken();
+		$token = $wgUser->editToken( $rcid );
 
 		$wgOut->addHTML(
 			"<div class='patrollink'>" .
@@ -2348,7 +2348,7 @@ class Article {
 		# If we haven't been given an rc_id value, we can't do anything
 		$rcid = (int) $wgRequest->getVal( 'rcid' );
 
-		if ( !$wgUser->matchEditToken( $wgRequest->getVal( 'token' ) ) ) {
+		if ( !$wgUser->matchEditToken( $wgRequest->getVal( 'token' ), $rcid ) ) {
 			$wgOut->showErrorPage( 'sessionfailure-title', 'sessionfailure' );
 			return;
 		}
diff --git a/includes/diff/DifferenceInterface.php b/includes/diff/DifferenceInterface.php
index f59aa56ba1..0281f138b7 100644
--- a/includes/diff/DifferenceInterface.php
+++ b/includes/diff/DifferenceInterface.php
@@ -243,7 +243,7 @@ CONTROL;
 			}
 			// Build the link
 			if( $rcid ) {
-				$token = $wgUser->editToken();
+				$token = $wgUser->editToken( $rcid );
 				$patrol = ' <span class="patrollink">[' . $sk->link(
 					$this->mTitle, 
 					wfMsgHtml( 'markaspatrolleddiff' ),
@@ -474,7 +474,7 @@ CONTROL;
 		# Add redundant patrol link on bottom...
 		if( $this->mRcidMarkPatrolled && $this->mTitle->quickUserCan('patrol') ) {
 			$sk = $wgUser->getSkin();
-			$token = $wgUser->editToken();
+			$token = $wgUser->editToken( $this->mRcidMarkPatrolled );
 			$wgOut->addHTML(
 				"<div class='patrollink'>[" . $sk->link(
 					$this->mTitle,
-- 
2.20.1