Page MenuHomePhabricator

Special:ToggleUserPage should require a POST submit to perform changes
Open, Needs TriagePublic

Description

Visiting Special:ToggleUserPage switches your user page between wiki page and user profile.

Performing changes on GET request is very bad for performance and caching. But also you can cause havoc if you send a link to someone pointing to that URL which has been logged-in on the wiki, or embed a link to it as an image in a public forum or similar.

Event Timeline

Restricted Application added a project: Social-Tools. · View Herald TranscriptAug 20 2018, 11:15 AM