3 * Module to fetch tokens via action=query&meta=tokens
5 * Copyright © 2014 Wikimedia Foundation and contributors
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 2 of the License, or
10 * (at your option) any later version.
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
17 * You should have received a copy of the GNU General Public License along
18 * with this program; if not, write to the Free Software Foundation, Inc.,
19 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
20 * http://www.gnu.org/copyleft/gpl.html
27 * Module to fetch tokens via action=query&meta=tokens
32 class ApiQueryTokens
extends ApiQueryBase
{
34 public function execute() {
35 $params = $this->extractRequestParams();
37 ApiResult
::META_TYPE
=> 'assoc',
40 if ( $this->lacksSameOriginSecurity() ) {
41 $this->addWarning( [ 'apiwarn-tokens-origin' ] );
45 $user = $this->getUser();
46 $session = $this->getRequest()->getSession();
47 $salts = self
::getTokenTypeSalts();
48 foreach ( $params['type'] as $type ) {
49 $res[$type . 'token'] = self
::getToken( $user, $session, $salts[$type] )->toString();
52 $this->getResult()->addValue( 'query', $this->getModuleName(), $res );
56 * Get the salts for known token types
57 * @return (string|array)[] Returning a string will use that as the salt
58 * for User::getEditTokenObject() to fetch the token, which will give a
59 * LoggedOutEditToken (always "+\\") for anonymous users. Returning an
60 * array will use it as parameters to MediaWiki\Session\Session::getToken(),
61 * which will always return a full token even for anonymous users.
63 public static function getTokenTypeSalts() {
70 'rollback' => 'rollback',
71 'userrights' => 'userrights',
72 'login' => [ '', 'login' ],
73 'createaccount' => [ '', 'createaccount' ],
75 Hooks
::run( 'ApiQueryTokensRegisterTypes', [ &$salts ] );
83 * Get a token from a salt
85 * @param MediaWiki\Session\Session $session
86 * @param string|array $salt A string will be used as the salt for
87 * User::getEditTokenObject() to fetch the token, which will give a
88 * LoggedOutEditToken (always "+\\") for anonymous users. An array will
89 * be used as parameters to MediaWiki\Session\Session::getToken(), which
90 * will always return a full token even for anonymous users. An array will
91 * also persist the session.
92 * @return MediaWiki\Session\Token
94 public static function getToken( User
$user, MediaWiki\Session\Session
$session, $salt ) {
95 if ( is_array( $salt ) ) {
97 return $session->getToken( ...$salt );
99 return $user->getEditTokenObject( $salt, $session->getRequest() );
103 public function getAllowedParams() {
106 ApiBase
::PARAM_DFLT
=> 'csrf',
107 ApiBase
::PARAM_ISMULTI
=> true,
108 ApiBase
::PARAM_TYPE
=> array_keys( self
::getTokenTypeSalts() ),
113 protected function getExamplesMessages() {
115 'action=query&meta=tokens'
116 => 'apihelp-query+tokens-example-simple',
117 'action=query&meta=tokens&type=watch|patrol'
118 => 'apihelp-query+tokens-example-types',
122 public function isReadMode() {
123 // So login tokens can be fetched on private wikis
127 public function getCacheMode( $params ) {
131 public function getHelpUrls() {
132 return 'https://www.mediawiki.org/wiki/Special:MyLanguage/API:Tokens';