BREAKING CHANGE: Require POST for patrolling revisions and salt the patrol token...
authorBryan Tong Minh <btongminh@users.mediawiki.org>
Thu, 9 Dec 2010 21:29:03 +0000 (21:29 +0000)
committerBryan Tong Minh <btongminh@users.mediawiki.org>
Thu, 9 Dec 2010 21:29:03 +0000 (21:29 +0000)
commit27b998755c2b18fb247c7929c7e358f32a98141c
tree3ae2b035f1f48be991b1db9477c38378dd9af8b6
parent98d9684ace02085341d8c1b5c404ec14bc55e3d7
BREAKING CHANGE: Require POST for patrolling revisions and salt the patrol token with 'patrol' instead of rc_id.

See my comments on r75274, for which this is a follow-up. Using a dedicated, but constant patrol token is in my opinion the optimal compromise between performance (only require fetching the token once) and security (leaking the token will only compromise the patrolling feature).
includes/api/ApiPatrol.php
includes/api/ApiQueryInfo.php
includes/api/ApiQueryRecentChanges.php