Note that you shouldn't use a custom $salt for 'edit' or 'csrf'

Change-Id: I795b3a17791a9e16382a7c6379b0e7a4a498d32e

diff --git a/includes/user/User.php b/includes/user/User.php
index ab665a4..83cfa40 100644 (file)
--- a/includes/user/User.php
+++ b/includes/user/User.php
@@ -4190,6 +4190,8 @@ class User implements IDBAccessObject {
         * login credentials aren't being hijacked with a foreign form
         * submission.
         *
+        * The $salt for 'edit' and 'csrf' tokens is the default (empty string).
+        *
         * @since 1.19
         * @param string|array $salt Array of Strings Optional function-specific data for hashing
         * @param WebRequest|null $request WebRequest object to use or null to use $wgRequest