Sam Wilson 5fd5b3276f Validate BlockID cookie before use ... This change adds a HMAC to the block-cookie to prevent someone spoofing a cookie and so discovering revdeleted users' names. The HMAC is only added if $wgSecretKey is set; if it isn't, the existing plain-ID format is used. A note about this has been added to DefaultSettings.php. Tests are updated and new tests added to demonstrate an inauthentic HMAC, and for when $wgSecretKey is not definied. Bug: T152951 Change-Id: I6a3ef9e91091408c25eaa2d36d58b365d681e8c6		2017-02-10 11:35:57 +08:00
..
BotPasswordTest.php	Use namespaced ScopedCallback	2016-10-17 15:46:05 -07:00
CentralIdLookupTest.php	Whenever possible, reuse User objects in unit tests	2016-05-26 20:42:31 +00:00
LocalIdLookupTest.php	Whenever possible, reuse User objects in unit tests	2016-05-26 20:42:31 +00:00
PasswordResetTest.php	Remove passwordreset capture feature	2016-11-23 00:02:33 +00:00
UserArrayFromResultTest.php	Convert all array() syntax to []	2016-02-17 01:33:00 -08:00
UserGroupMembershipTest.php	User group memberships that expire	2017-01-27 09:24:20 +00:00
UserTest.php	Validate BlockID cookie before use	2017-02-10 11:35:57 +08:00