Last modified: 2014-05-09 16:19:07 UTC
I noticed that when I pass an edit token to the SF AutoEdit API it gives a warning: … 'warnings': {'main': {'*': "Unrecognized parameters: 'Team', 'token'"}} (Ignore the Team one, that's my issue). It seems that this API probably should handle, and even better, require and edit token given the function.
Re-assigning to f.trott.
Please tell how to reproduce this bug. I wasn't able to build the exact api url... Please share the URL if possible.
Got it. Example URL: http://127.0.0.1:8080/w/api.php?form=form_new&target=Capitalss&action=sfautoedit&token=sfsdfsqe2sd&format=json
Sorry for not getting that to you, but you figured it out. In essence, that edit should NOT work without the token, but it does.
Change 121698 had a related patch set uploaded by Pawanseerwani: Add token parameter to SF Autoedit API https://gerrit.wikimedia.org/r/121698
Hi, I have submitted a patch which solves the issue. It takes the hash string in token parameter and checks it at backend and throws an exception if its incorrect token. But my concern is how does the mediawiki user generate this token?
@Jamie Thingelstad: Do you have the possibility to test the patch? I think it should work, but I am not too much into API stuff, so I'd really like somebody else to have a look. (Be aware that this patch right now will cause SF to reject it's own forms, since they do not contain the token yet. This means editing is only possible using the API.)
Change 121698 merged by Foxtrott: Add token parameter to SF Autoedit API https://gerrit.wikimedia.org/r/121698
