See my comments on r75274, for which this is a follow-up. Using a dedicated, but constant patrol token is in my opinion the optimal compromise between performance (only require fetching the token once) and security (leaking the token will only compromise the patrolling feature).
* Introduced a "cache mode" concept to simplify the header generation code, and to avoid odd results when conflicting cache header requests are received from submodules, or at least to formalise the handling of such cases.
* Made the cache mode private by default, so that code written in ignorance of caching tends to be safe. If different query modules are used in a single request, private caching is preferred over public caching.
* Removed the "must-revalidate" option from all CC headers, this is really specific to page views with a hacked squid in front, I don't think it's applicable here.
* Made the watchlist module private. This is really the definition of private data. There's nothing in the HTTP spec that says the URL for a CC:public request is private and can't be leaked. CC:private provides protection against unknown proxy behaviour.
* In ApiQueryAllmessages: avoid calling $wgLang->getCode() to check if it's necessary to make a new $wgLang when lang= is specified, since this is the only thing that unstubs $wgUser.
* Removed "FIXME: should this check $user instead of $wgUser?" Answer is no.
Per -rakkaus/#mediawiki-i18n- [22-Jul-2010 09:44:40] PHP Notice: Undefined property: ApiQueryInfo::$fld_displaytitle in /www/w/includes/api/ApiQueryInfo.php on line 266
"I wouldn't object to stylizing the API code to bring it in line with
the rest of MW on principle, but I'm not gonna bother myself." --Roan
<http://www.mediawiki.org/wiki/Special:Code/MediaWiki/60657#c5108>
If you're seeing this commit in blames, tell your blame tool to ignore
whitespace, e.g., git blame -w or svn blame -x -w.
* Aggressively intval() numeric things; addresses the concerns raised on bug 11633
* Use ApiQueryBase::addTitleInfo() everywhere
* Remove a drug-induced-looking line from ApiQueryWatchlist.php
* Use + instead of array_merge(), the latter messes up keys
* Fix a fatal error ($result not an object)
* Fix an interesting mistake when calling addTables(): addTables('foo', 'bar') doesn't add both tables, but adds foo AS bar
* Fix warning about $row->pt_namespace not being set
Commit message for r47214:
API: Refactor ApiQueryInfo
* Move result generating code from execute() to extractPageInfo()
** Merge code for existing and missing titles
* Don't loop over existing and missing titles separately, but on both in one go
* Move protection query code from execute() to getProtectionInfo()
** Merge code for existing and missing titles here as well
* Move subjectid/talkid query code from execute() to getTSIDs()
* Document some functions
