BREAKING CHANGE: Require POST for patrolling revisions and salt the patrol token...

See my comments on r75274, for which this is a follow-up. Using a dedicated, but constant patrol token is in my opinion the optimal compromise between performance (only require fetching the token once) and security (leaking the token will only compromise the patrolling feature).

diff --git a/includes/api/ApiPatrol.php b/includes/api/ApiPatrol.php
index ddc205f..04afd1d 100644 (file)
--- a/includes/api/ApiPatrol.php
+++ b/includes/api/ApiPatrol.php
@@ -59,6 +59,10 @@ class ApiPatrol extends ApiBase {
                $this->getResult()->addValue( null, $this->getModuleName(), $result );
        }
 
+       public function mustBePosted() {
+               return true;
+       }
+
        public function isWriteMode() {
                return true;
        }
@@ -95,8 +99,7 @@ class ApiPatrol extends ApiBase {
        }
 
        public function getTokenSalt() {
-               $params = $this->extractRequestParams();
-               return $params['rcid'];
+               return 'patrol';
        }
 
        protected function getExamples() {

diff --git a/includes/api/ApiQueryInfo.php b/includes/api/ApiQueryInfo.php
index 8ffb2e2..3156b7e 100644 (file)
--- a/includes/api/ApiQueryInfo.php
+++ b/includes/api/ApiQueryInfo.php
@@ -87,6 +87,7 @@ class ApiQueryInfo extends ApiQueryBase {
                        'unblock' => array( 'ApiQueryInfo', 'getUnblockToken' ),
                        'email' => array( 'ApiQueryInfo', 'getEmailToken' ),
                        'import' => array( 'ApiQueryInfo', 'getImportToken' ),
+                       'patrol' => array( 'ApiQueryRecentChanges', 'getPatrolToken' ),
                );
                wfRunHooks( 'APIQueryInfoTokens', array( &$this->tokenFunctions ) );
                return $this->tokenFunctions;

diff --git a/includes/api/ApiQueryRecentChanges.php b/includes/api/ApiQueryRecentChanges.php
index 2e9f9b7..2aecea8 100644 (file)
--- a/includes/api/ApiQueryRecentChanges.php
+++ b/includes/api/ApiQueryRecentChanges.php
@@ -79,7 +79,13 @@ class ApiQueryRecentChanges extends ApiQueryBase {
                        return false;
                }
 
-               return $wgUser->editToken( $rc->getAttribute( 'rc_id' ) );
+               // The patrol token is always the same, let's exploit that
+               static $cachedPatrolToken = null;
+               if ( is_null( $cachedPatrolToken ) ) {
+                       $cachedPatrolToken = $wgUser->editToken( 'patrol' );
+               }
+               
+               return $cachedPatrolToken;
        }
 
        /**