diff options
Diffstat (limited to 'includes/api/ApiMain.php')
-rw-r--r-- | includes/api/ApiMain.php | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/includes/api/ApiMain.php b/includes/api/ApiMain.php index 31870449..00b3f63f 100644 --- a/includes/api/ApiMain.php +++ b/includes/api/ApiMain.php @@ -98,6 +98,14 @@ class ApiMain extends ApiBase { // If the current user cannot read, // Remove all modules other than login global $wgUser; + + if( $request->getVal( 'callback' ) !== null ) { + // JSON callback allows cross-site reads. + // For safety, strip user credentials. + wfDebug( "API: stripping user credentials for JSON callback\n" ); + $wgUser = new User(); + } + if (!$wgUser->isAllowed('read')) { self::$Modules = array( 'login' => self::$Modules['login'], |