Last modified: 2014-10-06 06:58:12 UTC
Currently I'm using code like this: // Before MW 1.20 $wgHooks['ApiTokensGetTokenTypes'][] = 'ApiTranslationReview::injectTokenFunction'; // After MW 1.20 $wgHooks['APIQueryInfoTokens'][] = 'ApiTranslationReview::injectTokenFunction'; public static function getToken() { global $wgUser; if ( !$wgUser->isAllowed( self::$right ) ) { return false; } return $wgUser->getEditToken( self::$salt ); } public static function injectTokenFunction( &$list ) { $list['translationreview'] = array( __CLASS__, 'getToken' ); return true; // Hooks must return bool } However, I'd like to get rid of the global wgUser. Please document the best way to implement tokens for version 1.19 and above.
That's probably the best way at the moment. All the core token-getting functions seem to use $wgUser, too.
Since Gerrit change #153110, things have gotten much simpler. Now most API modules will just implement ApiBase::needsToken public function needsToken() { return 'csrf'; } Using custom salts is discouraged, but if necessary is accomplished using the 'ApiQueryTokensRegisterTypes' hook: $wgHooks['ApiQueryTokensRegisterTypes'][] = function ( &$salts ) { $salts['mytokentype'] = 'salt'; return true; }; (then needsToken() would return 'mytokentype' instead of 'csrf')
Wonderful. Can someone make sure this ends up in a some wiki page which extension developers can easily find?
Assigning to Brad as patch author and only person knowing about the feature.
