(bug 25793) Don't output the session ID over HTTP, allows session hijacking because...

diff --git a/includes/api/ApiLogin.php b/includes/api/ApiLogin.php
index 987d046..2542306 100644 (file)
--- a/includes/api/ApiLogin.php
+++ b/includes/api/ApiLogin.php
@@ -87,14 +87,12 @@ class ApiLogin extends ApiBase {
                                $result['lgusername'] = $wgUser->getName();
                                $result['lgtoken'] = $wgUser->getToken();
                                $result['cookieprefix'] = $wgCookiePrefix;
-                               $result['sessionid'] = session_id();
                                break;
 
                        case LoginForm::NEED_TOKEN:
                                $result['result'] = 'NeedToken';
                                $result['token'] = $loginForm->getLoginToken();
                                $result['cookieprefix'] = $wgCookiePrefix;
-                               $result['sessionid'] = session_id();
                                break;
 
                        case LoginForm::WRONG_TOKEN: