Change Details

{T25227} improved security when it comes to user log out action. Previously, any GET request sent to `Special:UserLogout` page triggered the log out action. That was an issue as attacker could easily put an html that would logout user from Wikimedia. and now every request to the `Special:UserLogout` needs the `logoutToken` calculated by the system. Otherwise system will present an intermediate step, it will ask for confirmation before logging out user. {F29364649} To avoid the intermediate state, please pass the `logoutToken` param with the logout link. ###QA Steps [] Verify that logging out doesn't show an intermediate state. ###Developer notes: This can be achieved by passing param: 'logoutToken' => $this->user->getEditToken( 'logoutToken', $this->request ) To the [[ https://github.com/wikimedia/mediawiki-skins-MinervaNeue/blob/b64585dfad952a914c43d30e400e57eab5960d61/includes/menu/AuthMenuEntry.php#L162 | $authLinksQuery ]] in the `AuthMenuEntry::buildComponentsForLoggedIn()` method

{T25227} improved security when it comes to user log out action. Previously, any GET request sent to `Special:UserLogout` page triggered the log out action. That was an issue as attacker could easily put an html that would logout user from Wikimedia. and now every request to the `Special:UserLogout` needs the `logoutToken` calculated by the system. Otherwise system will present an intermediate step, it will ask for confirmation before logging out user. {F29364649} To avoid the intermediate state, please pass the `logoutToken` param with the logout link. ###QA Steps [X] Verify that logging out doesn't show an intermediate state. ###Developer notes: This can be achieved by passing param: 'logoutToken' => $this->user->getEditToken( 'logoutToken', $this->request ) To the [[ https://github.com/wikimedia/mediawiki-skins-MinervaNeue/blob/b64585dfad952a914c43d30e400e57eab5960d61/includes/menu/AuthMenuEntry.php#L162 | $authLinksQuery ]] in the `AuthMenuEntry::buildComponentsForLoggedIn()` method

{T25227} improved security when it comes to user log out action. Previously, any GET request sent to `Special:UserLogout` page triggered the log out action. That was an issue as attacker could easily put an html that would logout user from Wikimedia. and now every request to the `Special:UserLogout` needs the `logoutToken` calculated by the system. Otherwise system will present an intermediate step, it will ask for confirmation before logging out user. {F29364649} To avoid the intermediate state, please pass the `logoutToken` param with the logout link. ###QA Steps [X] Verify that logging out doesn't show an intermediate state. ###Developer notes: This can be achieved by passing param: 'logoutToken' => $this->user->getEditToken( 'logoutToken', $this->request ) To the [[ https://github.com/wikimedia/mediawiki-skins-MinervaNeue/blob/b64585dfad952a914c43d30e400e57eab5960d61/includes/menu/AuthMenuEntry.php#L162 | $authLinksQuery ]] in the `AuthMenuEntry::buildComponentsForLoggedIn()` method