API: Make action=clearhasmsg require POST

Bug: T146526
Change-Id: I341b395e532e7bdc7816f0deae8c6e5e8c9e8f3b

diff --git a/RELEASE-NOTES-1.29 b/RELEASE-NOTES-1.29
index 386dee4..5b5640f 100644 (file)
--- a/RELEASE-NOTES-1.29
+++ b/RELEASE-NOTES-1.29
@@ -36,6 +36,7 @@ production.
   in the query string is now an error. They should be submitted in the POST
   body instead.
 * The capture option for action=resetpassword has been removed
+* action=clearhasmsg now requires a POST.
 
 === Action API internal changes in 1.29 ===
 

diff --git a/includes/api/ApiClearHasMsg.php b/includes/api/ApiClearHasMsg.php
index 13b3577..99242a8 100644 (file)
--- a/includes/api/ApiClearHasMsg.php
+++ b/includes/api/ApiClearHasMsg.php
@@ -45,7 +45,7 @@ class ApiClearHasMsg extends ApiBase {
        }
 
        public function mustBePosted() {
-               return false;
+               return true;
        }
 
        protected function getExamplesMessages() {