Use getParameter() for the "maxage" and "smaxage" parameters rather than pulling...

so that they'll be properly validated (and in particular coerced to integers).

diff --git a/RELEASE-NOTES b/RELEASE-NOTES
index e690601..a8e2e71 100644 (file)
--- a/RELEASE-NOTES
+++ b/RELEASE-NOTES
@@ -324,6 +324,7 @@ The following extensions are migrated into MediaWiki 1.14:
 * (bug 15845) Added pageid/fromid parameter to action=delete/move, making
   manipulation of legacy pages with invalid titles possible
 * (bug 15881) Empty or invalid parameters cause database errors 
+* The maxage and smaxage parameters are now properly validated
 
 === Languages updated in 1.14 ===
 

diff --git a/includes/api/ApiMain.php b/includes/api/ApiMain.php
index b339f0f..5c5c0bd 100644 (file)
--- a/includes/api/ApiMain.php
+++ b/includes/api/ApiMain.php
@@ -290,8 +290,8 @@ class ApiMain extends ApiBase {
                if($this->mSquidMaxage == -1)
                {
                        # Nobody called setCacheMaxAge(), use the (s)maxage parameters
-                       $smaxage = $this->mRequest->getVal('smaxage', 0);
-                       $maxage = $this->mRequest->getVal('maxage', 0);
+                       $smaxage = $this->getParameter('smaxage');
+                       $maxage = $this->getParameter('maxage');
                }
                else
                        $smaxage = $maxage = $this->mSquidMaxage;