SECURITY: API: Avoid some silliness with browser-guessed filenames

[lhc/web/wiklou.git] / includes / api / ApiQuery.php

diff --git a/includes/api/ApiQuery.php b/includes/api/ApiQuery.php
index 987bb99..31bcc7a 100644 (file)
--- a/includes/api/ApiQuery.php
+++ b/includes/api/ApiQuery.php
@@ -169,7 +169,7 @@ class ApiQuery extends ApiBase {
         * as the first, regardless of the values of $db and $groups
         * @param string $name Name to assign to the database connection
         * @param int $db One of the DB_* constants
-        * @param array $groups Query groups
+        * @param string|string[] $groups Query groups
         * @return IDatabase
         */
        public function getNamedDB( $name, $db, $groups ) {
@@ -459,6 +459,7 @@ class ApiQuery extends ApiBase {
                        // Raw formatter will handle this
                        $result->addValue( null, 'text', $sink, ApiResult::NO_SIZE_CHECK );
                        $result->addValue( null, 'mime', 'text/xml', ApiResult::NO_SIZE_CHECK );
+                       $result->addValue( null, 'filename', 'export.xml', ApiResult::NO_SIZE_CHECK );
                } else {
                        $result->addValue( 'query', 'export', $sink, ApiResult::NO_SIZE_CHECK );
                        $result->addValue( 'query', ApiResult::META_BC_SUBELEMENTS, [ 'export' ] );