SECURITY: API: Don't log "sensitive" parameters

[lhc/web/wiklou.git] / includes / api / ApiAuthManagerHelper.php

diff --git a/includes/api/ApiAuthManagerHelper.php b/includes/api/ApiAuthManagerHelper.php
index 6fafebf..8862cc7 100644 (file)
--- a/includes/api/ApiAuthManagerHelper.php
+++ b/includes/api/ApiAuthManagerHelper.php
@@ -93,7 +93,7 @@ class ApiAuthManagerHelper {
        /**
         * Call $manager->securitySensitiveOperationStatus()
         * @param string $operation Operation being checked.
-        * @throws UsageException
+        * @throws ApiUsageException
         */
        public function securitySensitiveOperation( $operation ) {
                $status = AuthManager::singleton()->securitySensitiveOperationStatus( $operation );
@@ -102,14 +102,10 @@ class ApiAuthManagerHelper {
                                return;
 
                        case AuthManager::SEC_REAUTH:
-                               $this->module->dieUsage(
-                                       'You have not authenticated recently in this session, please reauthenticate.', 'reauthenticate'
-                               );
+                               $this->module->dieWithError( 'apierror-reauthenticate' );
 
                        case AuthManager::SEC_FAIL:
-                               $this->module->dieUsage(
-                                       'This action is not available as your identify cannot be verified.', 'cannotreauthenticate'
-                               );
+                               $this->module->dieWithError( 'apierror-cannotreauthenticate' );
 
                        default:
                                throw new UnexpectedValueException( "Unknown status \"$status\"" );
@@ -173,6 +169,7 @@ class ApiAuthManagerHelper {
                $this->module->getMain()->markParamsUsed( array_keys( $data ) );
 
                if ( $sensitive ) {
+                       $this->module->getMain()->markParamsSensitive( array_keys( $sensitive ) );
                        $this->module->requirePostedParameters( array_keys( $sensitive ), 'noprefix' );
                }
 
@@ -212,6 +209,7 @@ class ApiAuthManagerHelper {
                        $res->status === AuthenticationResponse::RESTART
                ) {
                        $this->formatMessage( $ret, 'message', $res->message );
+                       $ret['messagecode'] = ApiMessage::create( $res->message )->getApiCode();
                }
 
                if ( $res->status === AuthenticationResponse::FAIL ||