Page MenuHomePhabricator

Use token for reseting the update markers on the watchlist
Closed, DuplicatePublic


Since fix of T25655 adding a page to the watchlist needs a token.
The api module setnotificationtimestamp also required a token.
MediaWiki should force a token at least for the reset="all" on the watchlist.

Version: 1.21.x
Severity: normal



Event Timeline

bzimport raised the priority of this task from to High.Nov 22 2014, 1:26 AM
bzimport set Reference to bz44563.
bzimport added a subscriber: Unknown Object (MLST).

should force a token

What is currently the problem? Things don't work?

The reset option does write actions on the database, so this should be protected against CSRF or so. You can submit a post against and the show marker on the watclist of the logged in user gets cleared.

Aklapper lowered the priority of this task from High to Low.Nov 27 2019, 5:12 PM
Aklapper edited subscribers, added: Aklapper; removed: wikibugs-l-list.