ApiQueryTokens.php

Go to the documentation of this file.

<?php
class ApiQueryTokens extends ApiQueryBase {

    public function execute() {
        $params = $this->extractRequestParams();
        $res = [
            ApiResult::META_TYPE => 'assoc',
        ];

        if ( $this->lacksSameOriginSecurity() ) {
            $this->setWarning( 'Tokens may not be obtained when the same-origin policy is not applied' );
            return;
        }

        $user = $this->getUser();
        $session = $this->getRequest()->getSession();
        $salts = self::getTokenTypeSalts();
        foreach ( $params['type'] as $type ) {
            $res[$type . 'token'] = self::getToken( $user, $session, $salts[$type] )->toString();
        }

        $this->getResult()->addValue( 'query', $this->getModuleName(), $res );
    }

    public static function getTokenTypeSalts() {
        static $salts = null;
        if ( !$salts ) {
            $salts = [
                'csrf' => '',
                'watch' => 'watch',
                'patrol' => 'patrol',
                'rollback' => 'rollback',
                'userrights' => 'userrights',
                'login' => [ '', 'login' ],
                'createaccount' => [ '', 'createaccount' ],
            ];
            Hooks::run( 'ApiQueryTokensRegisterTypes', [ &$salts ] );
            ksort( $salts );
        }

        return $salts;
    }

    public static function getToken( User $user, MediaWiki\Session\Session $session, $salt ) {
        if ( is_array( $salt ) ) {
            $session->persist();
            return call_user_func_array( [ $session, 'getToken' ], $salt );
        } else {
            return $user->getEditTokenObject( $salt, $session->getRequest() );
        }
    }

    public function getAllowedParams() {
        return [
            'type' => [
                ApiBase::PARAM_DFLT => 'csrf',
                ApiBase::PARAM_ISMULTI => true,
                ApiBase::PARAM_TYPE => array_keys( self::getTokenTypeSalts() ),
            ],
        ];
    }

    protected function getExamplesMessages() {
        return [
            'action=query&meta=tokens'
                => 'apihelp-query+tokens-example-simple',
            'action=query&meta=tokens&type=watch|patrol'
                => 'apihelp-query+tokens-example-types',
        ];
    }

    public function isReadMode() {
        // So login tokens can be fetched on private wikis
        return false;
    }

    public function getCacheMode( $params ) {
        return 'private';
    }

    public function getHelpUrls() {
        return 'https://www.mediawiki.org/wiki/API:Tokens';
    }
}