From: Roan Kattouw <catrope@users.mediawiki.org>
Date: Sat, 23 Oct 2010 16:56:07 +0000 (+0000)
Subject: Revert r70640 per CR: don't expose unsalted edit tokens in URLs. Should instead chang... 
X-Git-Tag: 1.31.0-rc.0~34357
X-Git-Url: https://git.cyclocoop.org/%7B%24admin_url%7Dmembres/modifier.php?a=commitdiff_plain;h=e331655cf017910f99861b122d1f1acdcf67628c;p=lhc%2Fweb%2Fwiklou.git

Revert r70640 per CR: don't expose unsalted edit tokens in URLs. Should instead change the API's patrol functionality to salt patrol tokens (coming up shortly)
---

diff --git a/includes/Article.php b/includes/Article.php
index 07f3e5da08..71aae25702 100644
--- a/includes/Article.php
+++ b/includes/Article.php
@@ -1308,7 +1308,7 @@ class Article {
 		}
 
 		$sk = $wgUser->getSkin();
-		$token = $wgUser->editToken();
+		$token = $wgUser->editToken( $rcid );
 
 		$wgOut->addHTML(
 			"<div class='patrollink'>" .
@@ -2348,7 +2348,7 @@ class Article {
 		# If we haven't been given an rc_id value, we can't do anything
 		$rcid = (int) $wgRequest->getVal( 'rcid' );
 
-		if ( !$wgUser->matchEditToken( $wgRequest->getVal( 'token' ) ) ) {
+		if ( !$wgUser->matchEditToken( $wgRequest->getVal( 'token' ), $rcid ) ) {
 			$wgOut->showErrorPage( 'sessionfailure-title', 'sessionfailure' );
 			return;
 		}
diff --git a/includes/diff/DifferenceInterface.php b/includes/diff/DifferenceInterface.php
index f59aa56ba1..0281f138b7 100644
--- a/includes/diff/DifferenceInterface.php
+++ b/includes/diff/DifferenceInterface.php
@@ -243,7 +243,7 @@ CONTROL;
 			}
 			// Build the link
 			if( $rcid ) {
-				$token = $wgUser->editToken();
+				$token = $wgUser->editToken( $rcid );
 				$patrol = ' <span class="patrollink">[' . $sk->link(
 					$this->mTitle, 
 					wfMsgHtml( 'markaspatrolleddiff' ),
@@ -474,7 +474,7 @@ CONTROL;
 		# Add redundant patrol link on bottom...
 		if( $this->mRcidMarkPatrolled && $this->mTitle->quickUserCan('patrol') ) {
 			$sk = $wgUser->getSkin();
-			$token = $wgUser->editToken();
+			$token = $wgUser->editToken( $this->mRcidMarkPatrolled );
 			$wgOut->addHTML(
 				"<div class='patrollink'>[" . $sk->link(
 					$this->mTitle,