summaryrefslogtreecommitdiff
path: root/includes/api/ApiMain.php
diff options
context:
space:
mode:
Diffstat (limited to 'includes/api/ApiMain.php')
-rw-r--r--includes/api/ApiMain.php8
1 files changed, 8 insertions, 0 deletions
diff --git a/includes/api/ApiMain.php b/includes/api/ApiMain.php
index 31870449..00b3f63f 100644
--- a/includes/api/ApiMain.php
+++ b/includes/api/ApiMain.php
@@ -98,6 +98,14 @@ class ApiMain extends ApiBase {
// If the current user cannot read,
// Remove all modules other than login
global $wgUser;
+
+ if( $request->getVal( 'callback' ) !== null ) {
+ // JSON callback allows cross-site reads.
+ // For safety, strip user credentials.
+ wfDebug( "API: stripping user credentials for JSON callback\n" );
+ $wgUser = new User();
+ }
+
if (!$wgUser->isAllowed('read')) {
self::$Modules = array(
'login' => self::$Modules['login'],