The change log for TL-42916 has been amended to include the configuration flag that can be used to revert the new behaviour until Totara 20.
We apologise for the omission.
The new change log reads:
TL-42916 Enforced POST for authentication parameters when using REST webservice protocol
Additionally, a new security check has been introduced to alert site
administrators when XML-RPC or SOAP web service protocols are enabled, as these
are considered insecure. If legacy web services are still required, the REST
protocol is the recommended option. However, please note that web services are
no longer actively maintained and will eventually be deprecated and removed. For
new integrations, it is strongly recommended to use the external API.
If a site needs the previous behaviour, set $CFG->revert_TL_42916_until_t20 = 1; in
config.php to temporarily revert this fix.