(bug 34237) Regenerate an empty user_token and save to the database when we try to...

This allows the entire user_token column to be regenerated after a leak by running `UPDATE user SET user_token = NULL;` and letting the user_tokens be regenerated as users try to log back in.

diff --git a/includes/User.php b/includes/User.php
index f8de203..9b6f4e7 100644 (file)
--- a/includes/User.php
+++ b/includes/User.php
@@ -2753,6 +2753,14 @@ class User {
 
                $this->load();
                if ( 0 == $this->mId ) return;
+               if ( !$this->mToken ) {
+                       // When token is empty or NULL generate a new one and then save it to the database
+                       // This allows a wiki to re-secure itself after a leak of it's user table or $wgSecretKey
+                       // Simply by setting every cell in the user_token column to NULL and letting them be
+                       // regenerated as users log back into the wiki.
+                       $this->setToken();
+                       $this->saveSettings();
+               }
                $session = array(
                        'wsUserID' => $this->mId,
                        'wsToken' => $this->mToken,