* (bug 34212) ApiBlock/ApiUnblock allow action to take place without a token paramete...

[lhc/web/wiklou.git] / includes / OutputPage.php

diff --git a/includes/OutputPage.php b/includes/OutputPage.php
index 47f6641..a044c55 100644 (file)
--- a/includes/OutputPage.php
+++ b/includes/OutputPage.php
@@ -2505,7 +2505,7 @@ $templates
         * @return string html <script> and <style> tags
         */
        protected function makeResourceLoaderLink( $modules, $only, $useESI = false, array $extraQuery = array(), $loadCall = false ) {
-               global $wgResourceLoaderUseESI, $wgResourceLoaderInlinePrivateModules;
+               global $wgResourceLoaderUseESI;
 
                if ( !count( $modules ) ) {
                        return '';
@@ -2584,10 +2584,11 @@ $templates
                                continue;
                        }
 
-                       // Support inlining of private modules if configured as such. Note that these
-                       // modules should be loaded from getHeadScripts() before the first loader call.
-                       // Otherwise other modules can't properly use them as dependencies (bug 30914)
-                       if ( $group === 'private' && $wgResourceLoaderInlinePrivateModules ) {
+                       // Inline private modules. These can't be loaded through load.php for security
+                       // reasons, see bug 34907. Note that these modules should be loaded from
+                       // getHeadScripts() before the first loader call. Otherwise other modules can't
+                       // properly use them as dependencies (bug 30914)
+                       if ( $group === 'private' ) {
                                if ( $only == ResourceLoaderModule::TYPE_STYLES ) {
                                        $links .= Html::inlineStyle(
                                                $resourceLoader->makeModuleResponse( $context, $modules )