API: Per IRC discussion with brion and co, now API only works if the user has the...

diff --git a/includes/api/ApiMain.php b/includes/api/ApiMain.php
index ae1e98f..a03b503 100644 (file)
--- a/includes/api/ApiMain.php
+++ b/includes/api/ApiMain.php
@@ -92,6 +92,20 @@ class ApiMain extends ApiBase {
                // Special handling for the main module: $parent === $this
                parent :: __construct($this, $this->mInternalMode ? 'main_int' : 'main');
 
+               if (!$this->mInternalMode) {
+                       
+                       // Impose module restrictions.
+                       // If the current user cannot read, 
+                       // Remove all modules other than login & help
+                       global $wgUser, $wgWhitelistRead;
+                       if (!$wgUser->isAllowed('read')) {
+                               self::$Modules = array(
+                                       'login' => self::$Modules['login'],
+                                       'help' => self::$Modules['help']
+                                       ); 
+                       }
+               }
+
                $this->mModules = self :: $Modules;
                $this->mModuleNames = array_keys($this->mModules); // todo: optimize
                $this->mFormats = self :: $Formats;