API debugging flag $wgDebugAPI to disable some security checks
authorYuri Astrakhan <yuriastrakhan@gmail.com>
Fri, 18 Jan 2013 15:23:17 +0000 (10:23 -0500)
committerGerrit Code Review <gerrit@wikimedia.org>
Fri, 18 Jan 2013 17:58:06 +0000 (17:58 +0000)
commit258929f57248879e30749ff6007e545f36623a0a
tree13774cd7d5766193f416d8217de8e42385e34509
parent503cd2f4ae5f75eb110d67abcb5d3065cdc14a82
API debugging flag $wgDebugAPI to disable some security checks

Intentionally introduce a big security hole for debugging only.
Just like $wgShowDebug, $wgShowExceptionDetails, and $wgShowSQLErrors,
that introduce security vulnarabilities for debugging purposes,
this flag allows developers to remove some security checks in their
LocalSettings.php. This is a much safer approach than temporarily
changing production code to ignore certain conditions and later
forgetting to remove those changes before commiting the code.
Whenever enabled, a warning will allways be added to all output.

Change-Id: Ideb271dc1c9087f0843da03d024d70cc2cd776ae
RELEASE-NOTES-1.21
includes/DefaultSettings.php
includes/api/ApiBase.php
includes/api/ApiMain.php