From cb1a748553eb286865eeac8cb70bbaf75c376eb0 Mon Sep 17 00:00:00 2001
From: Linty <lintydev@gmail.com>
Date: Fri, 31 Jul 2026 17:14:31 +0200
Subject: [PATCH] fixes #2573 in api_key context set pwg_token in $_POST only
 on POST requests

---
 include/user.inc.php | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/include/user.inc.php b/include/user.inc.php
index a2255954a..fc998a643 100644
--- a/include/user.inc.php
+++ b/include/user.inc.php
@@ -78,7 +78,15 @@ if (
     define('PWG_API_KEY_REQUEST', true);
 
     // set pwg_token for api_key request
-    $_POST['pwg_token'] = $_GET['pwg_token'] = get_pwg_token();
+    // same logic as PwgServer::isPost()
+    if (!empty($_POST))
+    {
+      $_POST['pwg_token'] = get_pwg_token();
+    }
+    else
+    {
+      $_GET['pwg_token'] = get_pwg_token();
+    }
 
     // logger
     global $logger;