wiki.techinc.nl/includes/OutputPage.php

4619 lines
140 KiB
PHP
Raw Normal View History

<?php
/**
* Preparation for the final page rendering.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License along
* with this program; if not, write to the Free Software Foundation, Inc.,
* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
* http://www.gnu.org/copyleft/gpl.html
*
* @file
*/
Hooks::run() call site migration Migrate all callers of Hooks::run() to use the new HookContainer/HookRunner system. General principles: * Use DI if it is already used. We're not changing the way state is managed in this patch. * HookContainer is always injected, not HookRunner. HookContainer is a service, it's a more generic interface, it is the only thing that provides isRegistered() which is needed in some cases, and a HookRunner can be efficiently constructed from it (confirmed by benchmark). Because HookContainer is needed for object construction, it is also needed by all factories. * "Ask your friendly local base class". Big hierarchies like SpecialPage and ApiBase have getHookContainer() and getHookRunner() methods in the base class, and classes that extend that base class are not expected to know or care where the base class gets its HookContainer from. * ProtectedHookAccessorTrait provides protected getHookContainer() and getHookRunner() methods, getting them from the global service container. The point of this is to ease migration to DI by ensuring that call sites ask their local friendly base class rather than getting a HookRunner from the service container directly. * Private $this->hookRunner. In some smaller classes where accessor methods did not seem warranted, there is a private HookRunner property which is accessed directly. Very rarely (two cases), there is a protected property, for consistency with code that conventionally assumes protected=private, but in cases where the class might actually be overridden, a protected accessor is preferred over a protected property. * The last resort: Hooks::runner(). Mostly for static, file-scope and global code. In a few cases it was used for objects with broken construction schemes, out of horror or laziness. Constructors with new required arguments: * AuthManager * BadFileLookup * BlockManager * ClassicInterwikiLookup * ContentHandlerFactory * ContentSecurityPolicy * DefaultOptionsManager * DerivedPageDataUpdater * FullSearchResultWidget * HtmlCacheUpdater * LanguageFactory * LanguageNameUtils * LinkRenderer * LinkRendererFactory * LocalisationCache * MagicWordFactory * MessageCache * NamespaceInfo * PageEditStash * PageHandlerFactory * PageUpdater * ParserFactory * PermissionManager * RevisionStore * RevisionStoreFactory * SearchEngineConfig * SearchEngineFactory * SearchFormWidget * SearchNearMatcher * SessionBackend * SpecialPageFactory * UserNameUtils * UserOptionsManager * WatchedItemQueryService * WatchedItemStore Constructors with new optional arguments: * DefaultPreferencesFactory * Language * LinkHolderArray * MovePage * Parser * ParserCache * PasswordReset * Router setHookContainer() now required after construction: * AuthenticationProvider * ResourceLoaderModule * SearchEngine Change-Id: Id442b0dbe43aba84bd5cf801d86dedc768b082c7
2020-03-19 02:42:09 +00:00
use MediaWiki\HookContainer\ProtectedHookAccessorTrait;
use MediaWiki\Html\Html;
use MediaWiki\Linker\LinkTarget;
use MediaWiki\MainConfigNames;
use MediaWiki\MediaWikiServices;
use MediaWiki\Page\PageRecord;
use MediaWiki\Page\PageReference;
use MediaWiki\Parser\ParserOutputFlags;
use MediaWiki\Permissions\PermissionStatus;
use MediaWiki\Request\ContentSecurityPolicy;
use MediaWiki\Request\FauxRequest;
use MediaWiki\ResourceLoader as RL;
use MediaWiki\ResourceLoader\ResourceLoader;
use MediaWiki\Session\SessionManager;
use MediaWiki\Title\Title;
use Wikimedia\AtEase\AtEase;
Generate/set/get TOCData/SectionMetadata objects instead of arrays * ParserOutput::setSections()/::getSections() are expected to be deprecated. Uses in extensions and skins will need to be migrated in follow up patches once the new interface has stabilized. * In the skins code, the metadata is converted back to an array. Downstream skin TOC consumers will need to be migrated as well before we can remove the toLegacy() conversion. * Fixed SerializationTestTrait's validation method - Not sure if this is overkill but should handle all future complex objects we might stuff into the ParserCache. * This patch emits a backward-compatible Sections property in order to avoid changing the parser cache serialization format. T327439 has been filed to eventually use the JsonCodec support for object serialization, but for this initial patch it makes sense to avoid the need for a concurrent ParserCache format migration by using a backward-compatible serialization. * TOCData is nullable because the intent is that ParserOutput::setTOCData() is MW_MERGE_STRATEGY_WRITE_ONCE; that is, only the top-level fragment composing a page will set the TOCData. This will be enforced in the future via wfDeprecated() (T327429), but again our first patch is as backward-compatible as possible. Bug: T296025 Depends-On: I1b267d23cf49d147c5379b914531303744481b68 Co-Authored-By: C. Scott Ananian <cananian@wikimedia.org> Co-Authored-By: Subramanya Sastry <ssastry@wikimedia.org> Change-Id: I8329864535f0b1dd5f9163868a08d6cb1ffcb78f
2022-09-01 23:07:29 +00:00
use Wikimedia\Parsoid\Core\TOCData;
use Wikimedia\Rdbms\IResultWrapper;
use Wikimedia\RelPath;
use Wikimedia\WrappedString;
use Wikimedia\WrappedStringList;
/**
* This is one of the Core classes and should
* be read at least once by any new developers. Also documented at
* https://www.mediawiki.org/wiki/Manual:Architectural_modules/OutputPage
*
* This class is used to prepare the final rendering. A skin is then
* applied to the output parameters (links, javascript, html, categories ...).
2011-04-23 19:28:35 +00:00
*
* @todo FIXME: Another class handles sending the whole page to the client.
2011-04-23 19:28:35 +00:00
*
* Some comments comes from a pairing session between Zak Greant and Antoine Musso
* in November 2010.
*
* @todo document
*/
class OutputPage extends ContextSource {
Hooks::run() call site migration Migrate all callers of Hooks::run() to use the new HookContainer/HookRunner system. General principles: * Use DI if it is already used. We're not changing the way state is managed in this patch. * HookContainer is always injected, not HookRunner. HookContainer is a service, it's a more generic interface, it is the only thing that provides isRegistered() which is needed in some cases, and a HookRunner can be efficiently constructed from it (confirmed by benchmark). Because HookContainer is needed for object construction, it is also needed by all factories. * "Ask your friendly local base class". Big hierarchies like SpecialPage and ApiBase have getHookContainer() and getHookRunner() methods in the base class, and classes that extend that base class are not expected to know or care where the base class gets its HookContainer from. * ProtectedHookAccessorTrait provides protected getHookContainer() and getHookRunner() methods, getting them from the global service container. The point of this is to ease migration to DI by ensuring that call sites ask their local friendly base class rather than getting a HookRunner from the service container directly. * Private $this->hookRunner. In some smaller classes where accessor methods did not seem warranted, there is a private HookRunner property which is accessed directly. Very rarely (two cases), there is a protected property, for consistency with code that conventionally assumes protected=private, but in cases where the class might actually be overridden, a protected accessor is preferred over a protected property. * The last resort: Hooks::runner(). Mostly for static, file-scope and global code. In a few cases it was used for objects with broken construction schemes, out of horror or laziness. Constructors with new required arguments: * AuthManager * BadFileLookup * BlockManager * ClassicInterwikiLookup * ContentHandlerFactory * ContentSecurityPolicy * DefaultOptionsManager * DerivedPageDataUpdater * FullSearchResultWidget * HtmlCacheUpdater * LanguageFactory * LanguageNameUtils * LinkRenderer * LinkRendererFactory * LocalisationCache * MagicWordFactory * MessageCache * NamespaceInfo * PageEditStash * PageHandlerFactory * PageUpdater * ParserFactory * PermissionManager * RevisionStore * RevisionStoreFactory * SearchEngineConfig * SearchEngineFactory * SearchFormWidget * SearchNearMatcher * SessionBackend * SpecialPageFactory * UserNameUtils * UserOptionsManager * WatchedItemQueryService * WatchedItemStore Constructors with new optional arguments: * DefaultPreferencesFactory * Language * LinkHolderArray * MovePage * Parser * ParserCache * PasswordReset * Router setHookContainer() now required after construction: * AuthenticationProvider * ResourceLoaderModule * SearchEngine Change-Id: Id442b0dbe43aba84bd5cf801d86dedc768b082c7
2020-03-19 02:42:09 +00:00
use ProtectedHookAccessorTrait;
// Constants for getJSVars()
private const JS_VAR_EARLY = 1;
private const JS_VAR_LATE = 2;
// Core config vars that opt-in to JS_VAR_LATE.
// Extensions use the 'LateJSConfigVarNames' attribute instead.
private const CORE_LATE_JS_CONFIG_VAR_NAMES = [];
/** @var string[][] Should be private. Used with addMeta() which adds "<meta>" */
protected $mMetatags = [];
/** @var array */
protected $mLinktags = [];
/** @var string|false */
protected $mCanonicalUrl = false;
/**
* @var string The contents of <h1>
*/
private $mPageTitle = '';
/**
* @var string The displayed title of the page. Different from page title
* if overridden by display title magic word or hooks. Can contain safe
* HTML. Different from page title which may contain messages such as
* "Editing X" which is displayed in h1. This can be used for other places
* where the page name is referred on the page.
*/
private $displayTitle;
block: Allow cookie-block tracking from any uncached web request This was previously hardcoded from three places: 1) Upon viewing EditPage, 2) Upon viewing SpecialCreateAccount, 3) For any url if the user is logged-in (User::loadFromSession/isLoggedIn). == User::loadFromSession Performing cookie blocks from here created a circular dependency because Block may need the user language for localisation, which is determined by asking the User object. This was previously worked around by using a DeferredUpdate (T180050, T226777). Moving this logic explicitly to the end of the pre-send cycle in MediaWiki::preOutputCommit breaks the cycle. This is also where other request-specific handling resides already. == Limited effect on unregistered users When an unregistered user performs an edit, and gets blocked, the cookie block is not applied until they open built-in editor or CreateAccount page. This makes it more likely for a user's IP to change meanwhile. Either intentionally, or simply due to IPs varying naturally (e.g. between mobile locations, or when going on/off WiFi). By applying it throughout sessioned page views for unregistered users, it is more likely to get set. Similar to what was already done for logged-in users. This commit also makes the intent of not caching EditPage and SpecialCreateAccount explicit. This was previously implicit through nothing having called setCdnMaxage() and/or due to Session::persist being checked for by OutputPage::sendCacheControl. Bug: T233594 Change-Id: Icf5a00f9b41d31bb6d4742c049feca0039d0c9d9
2019-09-07 23:44:46 +00:00
/** @var bool See OutputPage::couldBePublicCached. */
private $cacheIsFinal = false;
/**
* @var string Contains all of the "<body>" content. Should be private we
* got set/get accessors and the append() method.
*/
public $mBodytext = '';
2010-07-08 08:12:19 +00:00
/** @var string Stores contents of "<title>" tag */
private $mHTMLtitle = '';
/**
* @var bool Is the displayed content related to the source of the
* corresponding wiki article.
*/
private $mIsArticle = false;
/** @var bool Stores "article flag" toggle. */
private $mIsArticleRelated = true;
/** @var bool Is the content subject to copyright */
private $mHasCopyright = false;
2011-01-14 07:54:28 +00:00
/**
* @var bool We have to set isPrintable(). Some pages should
2011-01-14 07:54:28 +00:00
* never be printed (ex: redirections).
*/
private $mPrintable = false;
/**
Generate/set/get TOCData/SectionMetadata objects instead of arrays * ParserOutput::setSections()/::getSections() are expected to be deprecated. Uses in extensions and skins will need to be migrated in follow up patches once the new interface has stabilized. * In the skins code, the metadata is converted back to an array. Downstream skin TOC consumers will need to be migrated as well before we can remove the toLegacy() conversion. * Fixed SerializationTestTrait's validation method - Not sure if this is overkill but should handle all future complex objects we might stuff into the ParserCache. * This patch emits a backward-compatible Sections property in order to avoid changing the parser cache serialization format. T327439 has been filed to eventually use the JsonCodec support for object serialization, but for this initial patch it makes sense to avoid the need for a concurrent ParserCache format migration by using a backward-compatible serialization. * TOCData is nullable because the intent is that ParserOutput::setTOCData() is MW_MERGE_STRATEGY_WRITE_ONCE; that is, only the top-level fragment composing a page will set the TOCData. This will be enforced in the future via wfDeprecated() (T327429), but again our first patch is as backward-compatible as possible. Bug: T296025 Depends-On: I1b267d23cf49d147c5379b914531303744481b68 Co-Authored-By: C. Scott Ananian <cananian@wikimedia.org> Co-Authored-By: Subramanya Sastry <ssastry@wikimedia.org> Change-Id: I8329864535f0b1dd5f9163868a08d6cb1ffcb78f
2022-09-01 23:07:29 +00:00
* @var ?TOCData Table of Contents information from ParserOutput, or
* null if no TOCData was ever set.
*/
Generate/set/get TOCData/SectionMetadata objects instead of arrays * ParserOutput::setSections()/::getSections() are expected to be deprecated. Uses in extensions and skins will need to be migrated in follow up patches once the new interface has stabilized. * In the skins code, the metadata is converted back to an array. Downstream skin TOC consumers will need to be migrated as well before we can remove the toLegacy() conversion. * Fixed SerializationTestTrait's validation method - Not sure if this is overkill but should handle all future complex objects we might stuff into the ParserCache. * This patch emits a backward-compatible Sections property in order to avoid changing the parser cache serialization format. T327439 has been filed to eventually use the JsonCodec support for object serialization, but for this initial patch it makes sense to avoid the need for a concurrent ParserCache format migration by using a backward-compatible serialization. * TOCData is nullable because the intent is that ParserOutput::setTOCData() is MW_MERGE_STRATEGY_WRITE_ONCE; that is, only the top-level fragment composing a page will set the TOCData. This will be enforced in the future via wfDeprecated() (T327429), but again our first patch is as backward-compatible as possible. Bug: T296025 Depends-On: I1b267d23cf49d147c5379b914531303744481b68 Co-Authored-By: C. Scott Ananian <cananian@wikimedia.org> Co-Authored-By: Subramanya Sastry <ssastry@wikimedia.org> Change-Id: I8329864535f0b1dd5f9163868a08d6cb1ffcb78f
2022-09-01 23:07:29 +00:00
private $tocData;
2011-01-14 07:54:28 +00:00
/**
* @var array Contains the page subtitle. Special pages usually have some
* links here. Don't confuse with site subtitle added by skins.
*/
private $mSubtitle = [];
/** @var string */
public $mRedirect = '';
/** @var int */
protected $mStatusCode;
2011-01-14 07:54:28 +00:00
/**
* @var string Used for sending cache control.
* The whole caching system should probably be moved into its own class.
2011-01-14 07:54:28 +00:00
*/
protected $mLastModified = '';
/**
* @var string[][]
* @deprecated since 1.38; will be made private (T301020)
*/
protected $mCategoryLinks = [];
/**
* @var string[][]
* @deprecated since 1.38, will be made private (T301020)
*/
protected $mCategories = [
'hidden' => [],
'normal' => [],
];
/**
* @var string[]
* @deprecated since 1.38; will be made private (T301020)
*/
protected $mIndicators = [];
Implement page status indicators Page status indicators are icons (or short text snippets) usually displayed in the top-right corner of the page, outside of the main content. Basically, <indicator name="foo">[[File:Foo.svg|20px]]</indicator> may be used on a page to place the icon in the indicator area. They are also known as top icons, page icons, heading icons or title icons. I found the discussion on bug 23796 highly illuminating. I suggest that everyone read it before suggesting different design choices. I spent some time with a thesaurus pondering the name. "Emblems" and "badges" were also considered, but the former has a much more limited meaning and the latter is already taken by Wikidata, with a similar but subtly different feature set. I am not aware of any naming conflicts ;) besides new talk page message "indicator" (used by core and Echo in some documents) and OOjs UI indicators (tiny icons like the arrow on a dropdown form element), which shouldn't be confusing. Potential use cases include: * "Lock" indicators for page protection levels * Featured/good article indicators * Redirect shortcuts display ("WP:VPT") * Links to help/manual for special pages * Coordinates?… or globe icon for inline pop-up maps Design features: * Skin-customizable. Skins can fully control where and how indicators are shown, or may just do <?php echo $this->getIndicators(); ?> to output the default structure. By default they are not shown at all. * Extension-customizable. Extensions can call ParserOutput::addIndicator() to insert an indicator from one of the numerous parser hooks. * Wiki-customizable. In addition to just using the parser functions, on-wiki styles and scripts can use the provided classes and ids (.mw-indicator, #mw-indicator-<name>) to customize their display. Design limitations: * Every indicator must have a unique identifier (name). It's not possible to create arrays, or to have several indicators with the same name. In case of duplicates, the latest occurrence of the parser function wins. * Indicators are displayed ordered by their names (and not occurrence order). This ensures consistency across pages and provides a simple means of ordering or grouping them. * Indicators are not stored, tracked or accessible outside of ParserOutput (in particular they're not in the page_props table). They are intended to merely reflect the content or metadata that is already present on the page, and not be data themselves. If you ever think you need to list pages with a given status indicator, instead figure out what it means and use the appropriate tracking category, special page report, already existing page_prop, or other means. Corresponding patch in Vector: I90a8ae15ac8275d084ea5f47b6b2684d5e6c7412. I'll implement support in the other three skins included in the tarball and document it on mediawiki.org after this is merged. Bug: 23796 Change-Id: I2389ff9a5332a2b1d033eb75f0946e5241cfaaf4
2014-09-24 10:44:16 +00:00
/**
* @var string[] Array of Interwiki Prefixed (non DB key) Titles (e.g. 'fr:Test page')
*/
private $mLanguageLinks = [];
2011-01-14 07:54:28 +00:00
/**
* Used for JavaScript (predates ResourceLoader)
* @todo We should split JS / CSS.
* mScripts content is inserted as is in "<head>" by Skin. This might
* contain either a link to a stylesheet or inline CSS.
*/
private $mScripts = '';
2011-01-14 07:54:28 +00:00
/** @var string Inline CSS styles. Use addInlineStyle() sparingly */
protected $mInlineStyles = '';
/**
* @var string Used by skin template.
* Example: $tpl->set( 'displaytitle', $out->mPageLinkTitle );
*/
public $mPageLinkTitle = '';
/**
* Additional <html> classes; This should be rarely modified; prefer mAdditionalBodyClasses.
* @var array
*/
protected $mAdditionalHtmlClasses = [];
/**
* @var string[] Array of elements in "<head>". Parser might add its own headers!
* @deprecated since 1.38; will be made private (T301020)
*/
protected $mHeadItems = [];
/** @var array Additional <body> classes; there are also <body> classes from other sources */
protected $mAdditionalBodyClasses = [];
/**
* @var array
* @deprecated since 1.38; will be made private (T301020)
*/
protected $mModules = [];
/**
* @var array
* @deprecated since 1.38; will be made private (T301020)
*/
protected $mModuleStyles = [];
2010-07-08 08:12:19 +00:00
/** @var ResourceLoader */
protected $mResourceLoader;
/** @var RL\ClientHtml */
resourceloader: Move queue formatting out of OutputPage HTML formatting of the queue was distributed over several OutputPage methods. Each method demanding a snippet of HTML by calling makeResourceLoaderLink() with a limited amount of information. As such, makeResourceLoaderLink() was unable to provide the client with the proper state information. Centralising it also allows it to better reduce duplication in HTML output and maintain a more accurate state. Problems fixed by centralising: 1. The 'user' module is special (due to per-user 'version' and 'user' params). It is manually requested via script-src. To avoid a separate (and wrong) request from something that requires it, we set state=loading directly. However, because the module is in the bottom, the old HTML formatter could only put state=loading in the bottom also. This sometimes caused a wrong request to be fired for modules=user if something in the top queue triggered a requirement for it. 2. Since a464d1d4 (T87871) we track states of page-style modules, with purpose of allowing dependencies on style modules without risking duplicate loading on pages where the styles are loaded already. This didn't work, because the state information about page-style modules is output near the stylesheet, which is after the script tag with mw.loader.load(). That runs first, and mw.loader would still make a duplicate request before it learns the state. Changes: * Document reasons for style/script tag order in getHeadHtml (per 09537e83). * Pass $type from getModuleStyles() to getAllowedModules(). This wasn't needed before since a duplicate check in makeResourceLoaderLink() verified the origin a second time. * Declare explicit position 'top' on 'user.options' and 'user.tokens' module. Previously, OutputPage hardcoded them in the top. The new formatter doesn't. * Remove getHeadScripts(). * Remove getInlineHeadScripts(). * Remove getExternalHeadScripts(). * Remove buildCssLinks(). * Remove getScriptsForBottomQueue(). * Change where Skin::setupSkinUserCss() is called. This methods lets the skin add modules to the queue. Previously it was called from buildCssLinks(), via headElement(), via prepareQuickTemplate(), via OutputPage::output(). It's now in OutputPage::output() directly (slightly earlier). This is needed because prepareQuickTemplate() calls bottomScripts() before headElement(). And bottomScript() would lazy-initialise the queue and lock it before setupSkinUserCss() is called from headElement(). This makes execution order more predictable instead of being dependent on the arbitrary order of data extraction in prepareQuickTemplate (which varies from one skin to another). * Compute isUserModulePreview() and isKnownEmpty() for the 'user' module early on so. This avoids wrongful loading and fixes problem 1. Effective changes in output: * mw.loader.state() is now before mw.loader.load(). This fixes problem 2. * mw.loader.state() now sets 'user.options' and 'user.tokens' to "loading". * mw.loader.state() now sets 'user' (as "loading" or "ready"). Fixes problem 1. * The <script async src> tag for 'startup' changed position (slightly). Previously it was after all inline scripts and stylesheets. It's still after all inline scripts and after most stylesheets, but before any user styles. Since the queue is now formatted outside OutputPage, it can't inject the meta-ResourceLoaderDynamicStyles tag and user-stylesheet hack in the middle of existing output. This shouldn't have any noticable impact. Bug: T87871 Change-Id: I605b8cd1e1fc009b4662a0edbc54d09dd65ee1df
2016-07-15 14:13:09 +00:00
private $rlClient;
/** @var RL\Context */
resourceloader: Move queue formatting out of OutputPage HTML formatting of the queue was distributed over several OutputPage methods. Each method demanding a snippet of HTML by calling makeResourceLoaderLink() with a limited amount of information. As such, makeResourceLoaderLink() was unable to provide the client with the proper state information. Centralising it also allows it to better reduce duplication in HTML output and maintain a more accurate state. Problems fixed by centralising: 1. The 'user' module is special (due to per-user 'version' and 'user' params). It is manually requested via script-src. To avoid a separate (and wrong) request from something that requires it, we set state=loading directly. However, because the module is in the bottom, the old HTML formatter could only put state=loading in the bottom also. This sometimes caused a wrong request to be fired for modules=user if something in the top queue triggered a requirement for it. 2. Since a464d1d4 (T87871) we track states of page-style modules, with purpose of allowing dependencies on style modules without risking duplicate loading on pages where the styles are loaded already. This didn't work, because the state information about page-style modules is output near the stylesheet, which is after the script tag with mw.loader.load(). That runs first, and mw.loader would still make a duplicate request before it learns the state. Changes: * Document reasons for style/script tag order in getHeadHtml (per 09537e83). * Pass $type from getModuleStyles() to getAllowedModules(). This wasn't needed before since a duplicate check in makeResourceLoaderLink() verified the origin a second time. * Declare explicit position 'top' on 'user.options' and 'user.tokens' module. Previously, OutputPage hardcoded them in the top. The new formatter doesn't. * Remove getHeadScripts(). * Remove getInlineHeadScripts(). * Remove getExternalHeadScripts(). * Remove buildCssLinks(). * Remove getScriptsForBottomQueue(). * Change where Skin::setupSkinUserCss() is called. This methods lets the skin add modules to the queue. Previously it was called from buildCssLinks(), via headElement(), via prepareQuickTemplate(), via OutputPage::output(). It's now in OutputPage::output() directly (slightly earlier). This is needed because prepareQuickTemplate() calls bottomScripts() before headElement(). And bottomScript() would lazy-initialise the queue and lock it before setupSkinUserCss() is called from headElement(). This makes execution order more predictable instead of being dependent on the arbitrary order of data extraction in prepareQuickTemplate (which varies from one skin to another). * Compute isUserModulePreview() and isKnownEmpty() for the 'user' module early on so. This avoids wrongful loading and fixes problem 1. Effective changes in output: * mw.loader.state() is now before mw.loader.load(). This fixes problem 2. * mw.loader.state() now sets 'user.options' and 'user.tokens' to "loading". * mw.loader.state() now sets 'user' (as "loading" or "ready"). Fixes problem 1. * The <script async src> tag for 'startup' changed position (slightly). Previously it was after all inline scripts and stylesheets. It's still after all inline scripts and after most stylesheets, but before any user styles. Since the queue is now formatted outside OutputPage, it can't inject the meta-ResourceLoaderDynamicStyles tag and user-stylesheet hack in the middle of existing output. This shouldn't have any noticable impact. Bug: T87871 Change-Id: I605b8cd1e1fc009b4662a0edbc54d09dd65ee1df
2016-07-15 14:13:09 +00:00
private $rlClientContext;
/** @var array */
private $rlExemptStyleModules;
/**
* @var array
* @deprecated since 1.38; will be made private (T301020)
*/
protected $mJsConfigVars = [];
/**
* @var array
* @deprecated since 1.38; will be made private (T301020)
*/
protected $mTemplateIds = [];
/** @var array */
protected $mImageTimeKeys = [];
2011-07-06 17:55:44 +00:00
/** @var string */
public $mRedirectCode = '';
2011-07-06 17:55:44 +00:00
protected $mFeedLinksAppendQuery = null;
/** @var array
* What level of 'untrustworthiness' is allowed in CSS/JS modules loaded on this page?
* @see RL\Module::$origin
* RL\Module::ORIGIN_ALL is assumed unless overridden;
*/
protected $mAllowedModules = [
RL\Module::TYPE_COMBINED => RL\Module::ORIGIN_ALL,
];
/** @var bool Whether output is disabled. If this is true, the 'output' method will do nothing. */
protected $mDoNothing = false;
// Parser related.
/**
* lazy initialised, use parserOptions()
* @var ParserOptions
*/
protected $mParserOptions = null;
2011-01-14 07:54:28 +00:00
/**
* Handles the Atom / RSS links.
* We probably only support Atom in 2011.
2011-01-14 07:54:28 +00:00
* @see $wgAdvertisedFeedTypes
*/
private $mFeedLinks = [];
2009-11-07 09:26:02 +00:00
/**
* @var bool Set to false to send no-cache headers, disabling
* client-side caching. (This variable should really be named
* in the opposite sense; see ::disableClientCache().)
* @deprecated since 1.38; will be made private (T301020)
*/
protected $mEnableClientCache = true;
/** @var bool Flag if output should only contain the body of the article. */
private $mArticleBodyOnly = false;
/**
* @var bool
* @deprecated since 1.38; will be made private (T301020)
*/
protected $mNewSectionLink = false;
/**
* @var bool
* @deprecated since 1.38; will be made private (T301020)
*/
protected $mHideNewSectionLink = false;
2011-01-14 07:54:28 +00:00
/**
* @var bool Comes from the parser. This was probably made to load CSS/JS
* only if we had "<gallery>". Used directly in CategoryPage.php.
* Looks like ResourceLoader can replace this.
* @deprecated since 1.38; will be made private (T301020)
*/
public $mNoGallery = false;
/** @var int Cache stuff. Looks like mEnableClientCache */
protected $mCdnMaxage = 0;
/** @var int Upper limit on mCdnMaxage */
protected $mCdnMaxageLimit = INF;
/**
* @var bool Controls if anti-clickjacking / frame-breaking headers will
* be sent. This should be done for pages where edit actions are possible.
* Setter: $this->setPreventClickjacking()
*/
protected $mPreventClickjacking = true;
/** @var int|null To include the variable {{REVISIONID}} */
private $mRevisionId = null;
/** @var bool|null */
private $mRevisionIsCurrent = null;
/** @var string */
private $mRevisionTimestamp = null;
/** @var array */
protected $mFileVersion = null;
/**
* @var array An array of stylesheet filenames (relative from skins path),
* with options for CSS media, IE conditions, and RTL/LTR direction.
* For internal use; add settings in the skin via $this->addStyle()
*
* Style again! This seems like a code duplication since we already have
* mStyles. This is what makes Open Source amazing.
*/
protected $styles = [];
private $mIndexPolicy = 'index';
private $mFollowPolicy = 'follow';
/** @var array */
private $mRobotsOptions = [ 'max-image-preview' => 'standard' ];
/**
* @var array Headers that cause the cache to vary. Key is header name,
* value should always be null. (Value was an array of options for
* the `Key` header, which was deprecated in 1.32 and removed in 1.34.)
*/
private $mVaryHeader = [
'Accept-Encoding' => null,
];
/**
* If the current page was reached through a redirect, $mRedirectedFrom contains the title
* of the redirect.
*
* @var PageReference
*/
private $mRedirectedFrom = null;
/**
* Additional key => value data
*/
private $mProperties = [];
/**
* @var string|null ResourceLoader target for load.php links. If null, will be omitted
*/
private $mTarget = null;
/**
* @var bool Whether parser output contains a table of contents
*/
private $mEnableTOC = false;
/**
* @var string|null The URL to send in a <link> element with rel=license
*/
private $copyrightUrl;
/** @var array Profiling data */
private $limitReportJSData = [];
/** @var array Map Title to Content */
private $contentOverrides = [];
/** @var callable[] */
private $contentOverrideCallbacks = [];
/**
* Link: header contents
*/
private $mLinkHeader = [];
Initial support for Content Security Policy, disabled by default The primary goal here is a defense in depth measure to stop an attacker who found a bug in the parser allowing them to insert malicious attributes. This wouldn't stop someone who could insert a full script tag (since at current it can't distinguish between malicious and legit user js). It also would not prevent DOM-based or reflected XSS for anons, as the nonce value is guessable for anons when receiving a response cached by varnish. However, the limited protection of just stopping stored XSS where the attacker only has control of attributes, is still a big win in my opinion. (But it wouldn't prevent someone who has that type of xss from abusing things like data-ooui attribute). This will likely break many gadgets. Its expected that any sort of rollout on Wikimedia will be done very slowly, with lots of testing and the report-only option to begin with. This is behind feature flags that are off by default, so merging this patch should not cause any change in default behaviour. This may break some extensions (The most obvious one is charinsert (See fe648d41005), but will probably need some testing in report-only mode to see if anything else breaks) This uses the unsafe-eval option of CSP, in order to support RL's local storage thingy. For better security, we may want to remove some of the sillier uses of eval (e.g. jquery.ui.datepicker.js). For more info, see spec: https://www.w3.org/TR/CSP2/ Additionally see: https://www.mediawiki.org/wiki/Requests_for_comment/Content-Security-Policy Bug: T135963 Change-Id: I80f6f469ba4c0b608385483457df96ccb7429ae5
2016-02-29 04:13:10 +00:00
/**
* @var ContentSecurityPolicy
Initial support for Content Security Policy, disabled by default The primary goal here is a defense in depth measure to stop an attacker who found a bug in the parser allowing them to insert malicious attributes. This wouldn't stop someone who could insert a full script tag (since at current it can't distinguish between malicious and legit user js). It also would not prevent DOM-based or reflected XSS for anons, as the nonce value is guessable for anons when receiving a response cached by varnish. However, the limited protection of just stopping stored XSS where the attacker only has control of attributes, is still a big win in my opinion. (But it wouldn't prevent someone who has that type of xss from abusing things like data-ooui attribute). This will likely break many gadgets. Its expected that any sort of rollout on Wikimedia will be done very slowly, with lots of testing and the report-only option to begin with. This is behind feature flags that are off by default, so merging this patch should not cause any change in default behaviour. This may break some extensions (The most obvious one is charinsert (See fe648d41005), but will probably need some testing in report-only mode to see if anything else breaks) This uses the unsafe-eval option of CSP, in order to support RL's local storage thingy. For better security, we may want to remove some of the sillier uses of eval (e.g. jquery.ui.datepicker.js). For more info, see spec: https://www.w3.org/TR/CSP2/ Additionally see: https://www.mediawiki.org/wiki/Requests_for_comment/Content-Security-Policy Bug: T135963 Change-Id: I80f6f469ba4c0b608385483457df96ccb7429ae5
2016-02-29 04:13:10 +00:00
*/
private $CSP;
Initial support for Content Security Policy, disabled by default The primary goal here is a defense in depth measure to stop an attacker who found a bug in the parser allowing them to insert malicious attributes. This wouldn't stop someone who could insert a full script tag (since at current it can't distinguish between malicious and legit user js). It also would not prevent DOM-based or reflected XSS for anons, as the nonce value is guessable for anons when receiving a response cached by varnish. However, the limited protection of just stopping stored XSS where the attacker only has control of attributes, is still a big win in my opinion. (But it wouldn't prevent someone who has that type of xss from abusing things like data-ooui attribute). This will likely break many gadgets. Its expected that any sort of rollout on Wikimedia will be done very slowly, with lots of testing and the report-only option to begin with. This is behind feature flags that are off by default, so merging this patch should not cause any change in default behaviour. This may break some extensions (The most obvious one is charinsert (See fe648d41005), but will probably need some testing in report-only mode to see if anything else breaks) This uses the unsafe-eval option of CSP, in order to support RL's local storage thingy. For better security, we may want to remove some of the sillier uses of eval (e.g. jquery.ui.datepicker.js). For more info, see spec: https://www.w3.org/TR/CSP2/ Additionally see: https://www.mediawiki.org/wiki/Requests_for_comment/Content-Security-Policy Bug: T135963 Change-Id: I80f6f469ba4c0b608385483457df96ccb7429ae5
2016-02-29 04:13:10 +00:00
/**
* @var array A cache of the names of the cookies that will influence the cache
*/
private static $cacheVaryCookies = null;
/**
* Constructor for OutputPage. This should not be called directly.
* Instead a new RequestContext should be created and it will implicitly create
* a OutputPage tied to that context.
* @param IContextSource $context
*/
public function __construct( IContextSource $context ) {
$this->setContext( $context );
$this->CSP = new ContentSecurityPolicy(
$context->getRequest()->response(),
Hooks::run() call site migration Migrate all callers of Hooks::run() to use the new HookContainer/HookRunner system. General principles: * Use DI if it is already used. We're not changing the way state is managed in this patch. * HookContainer is always injected, not HookRunner. HookContainer is a service, it's a more generic interface, it is the only thing that provides isRegistered() which is needed in some cases, and a HookRunner can be efficiently constructed from it (confirmed by benchmark). Because HookContainer is needed for object construction, it is also needed by all factories. * "Ask your friendly local base class". Big hierarchies like SpecialPage and ApiBase have getHookContainer() and getHookRunner() methods in the base class, and classes that extend that base class are not expected to know or care where the base class gets its HookContainer from. * ProtectedHookAccessorTrait provides protected getHookContainer() and getHookRunner() methods, getting them from the global service container. The point of this is to ease migration to DI by ensuring that call sites ask their local friendly base class rather than getting a HookRunner from the service container directly. * Private $this->hookRunner. In some smaller classes where accessor methods did not seem warranted, there is a private HookRunner property which is accessed directly. Very rarely (two cases), there is a protected property, for consistency with code that conventionally assumes protected=private, but in cases where the class might actually be overridden, a protected accessor is preferred over a protected property. * The last resort: Hooks::runner(). Mostly for static, file-scope and global code. In a few cases it was used for objects with broken construction schemes, out of horror or laziness. Constructors with new required arguments: * AuthManager * BadFileLookup * BlockManager * ClassicInterwikiLookup * ContentHandlerFactory * ContentSecurityPolicy * DefaultOptionsManager * DerivedPageDataUpdater * FullSearchResultWidget * HtmlCacheUpdater * LanguageFactory * LanguageNameUtils * LinkRenderer * LinkRendererFactory * LocalisationCache * MagicWordFactory * MessageCache * NamespaceInfo * PageEditStash * PageHandlerFactory * PageUpdater * ParserFactory * PermissionManager * RevisionStore * RevisionStoreFactory * SearchEngineConfig * SearchEngineFactory * SearchFormWidget * SearchNearMatcher * SessionBackend * SpecialPageFactory * UserNameUtils * UserOptionsManager * WatchedItemQueryService * WatchedItemStore Constructors with new optional arguments: * DefaultPreferencesFactory * Language * LinkHolderArray * MovePage * Parser * ParserCache * PasswordReset * Router setHookContainer() now required after construction: * AuthenticationProvider * ResourceLoaderModule * SearchEngine Change-Id: Id442b0dbe43aba84bd5cf801d86dedc768b082c7
2020-03-19 02:42:09 +00:00
$context->getConfig(),
$this->getHookContainer()
);
}
/**
* Redirect to $url rather than displaying the normal page
*
* @param string $url
* @param string|int $responsecode HTTP status code
*/
public function redirect( $url, $responsecode = '302' ) {
# Strip newlines as a paranoia check for header injection in PHP<5.1.2
$this->mRedirect = str_replace( "\n", '', $url );
$this->mRedirectCode = (string)$responsecode;
}
/**
* Get the URL to redirect to, or an empty string if not redirect URL set
*
* @return string
*/
public function getRedirect() {
return $this->mRedirect;
}
2003-04-14 23:10:40 +00:00
/**
* Set the copyright URL to send with the output.
* Empty string to omit, null to reset.
*
* @since 1.26
*
* @param string|null $url
*/
public function setCopyrightUrl( $url ) {
$this->copyrightUrl = $url;
}
/**
* Set the HTTP status code to send with the output.
*
* @param int $statusCode
*/
public function setStatusCode( $statusCode ) {
$this->mStatusCode = $statusCode;
}
/**
* Add a new "<meta>" tag
* To add an http-equiv meta tag, precede the name with "http:"
*
* @param string $name Name of the meta tag
* @param string $val Value of the meta tag
*/
public function addMeta( $name, $val ) {
$this->mMetatags[] = [ $name, $val ];
}
/**
* Returns the current <meta> tags
*
* @since 1.25
* @return array
*/
public function getMetaTags() {
return $this->mMetatags;
}
/**
* Add a new \<link\> tag to the page header.
*
* Note: use setCanonicalUrl() for rel=canonical.
*
* @param array $linkarr Associative array of attributes.
*/
public function addLink( array $linkarr ) {
$this->mLinktags[] = $linkarr;
}
/**
* Returns the current <link> tags
*
* @since 1.25
* @return array
*/
public function getLinkTags() {
return $this->mLinktags;
}
/**
* Set the URL to be used for the <link rel=canonical>. This should be used
* in preference to addLink(), to avoid duplicate link tags.
* @param string $url
*/
public function setCanonicalUrl( $url ) {
$this->mCanonicalUrl = $url;
}
/**
* Returns the URL to be used for the <link rel=canonical> if
* one is set.
*
* @since 1.25
* @return bool|string
*/
public function getCanonicalUrl() {
return $this->mCanonicalUrl;
}
/**
* Add raw HTML to the list of scripts (including \<script\> tag, etc.)
* Internal use only. Use OutputPage::addModules() or OutputPage::addJsConfigVars()
* if possible.
*
* @param string $script Raw HTML
*/
public function addScript( $script ) {
$this->mScripts .= $script;
2009-08-07 00:16:54 +00:00
}
here it is ... the upload-api, script-server, js2 (javascript phase2) branch merge 1st attempt. Here is a short overview of changes and associated default configuration variables (most everything is off by default) also see ~soon to be updated~: http://www.mediawiki.org/wiki/Media_Projects_Overview = Upload Improvements = ==Upload API == * Based on the early work of Bryan Tong and others it adds the upload option to the api. * We rewrite Special:Upload page to include use the new refactoring * Added in token checks in both the SpecialUpload.php page so avoids DOS / xss copy-by-url JavaScript based cross site POST file submissions == Copy by URL== $wgAllowCopyUploads = false; * http class rewrite includes a new http background download see: includes/HttpFunctions.php * spins off a php process that calls: maintenance/http_session_download.php * pushes updates to the session and gives the user a progress bar on http copy uploads from other server progress (using js2 upload interface) (if not using the js2 upload interface it does the request in-place but the download is limited to the php ini timeout time) == Firefogg == * Firefogg enables resumable upload by chunks * progress indicators and conditional invokation (js2 system) * and of-course client side transcoding. = Script Server = $wgEnableScriptLoader = false; * off by default if $wgEnableScriptLoader is turned on script files are grouped, gziped, cached etc. for more info see: http://www.mediawiki.org/wiki/Extension:ScriptLoader * Includes some early skin js include fixes (skin/script system still lots of love) * Includes a "javascript class autoloader" this is packaged into mwEmbed so that the mwEmbed library can work in stand alone mode (while retaining localization and script serving) (one such application is the make page for firefogg.org : http://www.firefogg.org/make/index.html ) * The file that contains the autojavascript loading classes is: js2/php/jsAutoloadLocalClasses.php * One can use this auto class loading dependency system with extensions and add-ons but I need to better document that. = js2 system / mwEmbed= $wgEnableJS2system = false * includes initial rewrite towards more jquery based javascript code * especially for the Special:Upload page. * Also the edit page include support for the "add-media-wizard" * includes dependency loader for javascript that optionally takes advantage of the script-loader * remote embedding of javascript interfaces (like embedding video, or commons media searching) * $wgDebugJavaScript = false; .. .this variable lets you always get "always fresh javascript". When used with the script-loader it does not minify the script-loader output. = mwEmbed = * Will commit a separate patch to oggHandler that conditionally outputs <video tag> to use the new javascript video player. ** mv_embed player includes: play-head, volume control, remote embedding, oggz-chop support across plugins. * add-media-wizard adds easy inserts of media to pages (with import) == jQuery== * we include a base install of jQuery, jQuery ui and some plugins. * all the javascript classes are in the scriptloader so its easy to load any set of jquery ui components that you may need using the script-server. You get a callback so you can then execute js with dependencies loaded. == other stuff == there is a bit more code in js2 that pertains to sequence editing, timed text display and basic image editing. We include a base import of pixastic-lib & pixastic-editor... will work with the pixastic developer to try and ensure upstream compatibility on our usage of the library for in-browser photo and sequence manipulation.
2009-07-14 23:52:14 +00:00
/**
* Add a JavaScript file to be loaded as `<script>` on this page.
*
* Internal use only. Use OutputPage::addModules() if possible.
*
* @param string $file URL to file (absolute path, protocol-relative, or full url)
* @param string|null $unused Previously used to change the cache-busting query parameter
*/
public function addScriptFile( $file, $unused = null ) {
$this->addScript( Html::linkedScript( $file, $this->CSP->getNonce() ) );
}
/**
* Add a self-contained script tag with the given contents
* Internal use only. Use OutputPage::addModules() if possible.
*
resourceloader: Move queue formatting out of OutputPage HTML formatting of the queue was distributed over several OutputPage methods. Each method demanding a snippet of HTML by calling makeResourceLoaderLink() with a limited amount of information. As such, makeResourceLoaderLink() was unable to provide the client with the proper state information. Centralising it also allows it to better reduce duplication in HTML output and maintain a more accurate state. Problems fixed by centralising: 1. The 'user' module is special (due to per-user 'version' and 'user' params). It is manually requested via script-src. To avoid a separate (and wrong) request from something that requires it, we set state=loading directly. However, because the module is in the bottom, the old HTML formatter could only put state=loading in the bottom also. This sometimes caused a wrong request to be fired for modules=user if something in the top queue triggered a requirement for it. 2. Since a464d1d4 (T87871) we track states of page-style modules, with purpose of allowing dependencies on style modules without risking duplicate loading on pages where the styles are loaded already. This didn't work, because the state information about page-style modules is output near the stylesheet, which is after the script tag with mw.loader.load(). That runs first, and mw.loader would still make a duplicate request before it learns the state. Changes: * Document reasons for style/script tag order in getHeadHtml (per 09537e83). * Pass $type from getModuleStyles() to getAllowedModules(). This wasn't needed before since a duplicate check in makeResourceLoaderLink() verified the origin a second time. * Declare explicit position 'top' on 'user.options' and 'user.tokens' module. Previously, OutputPage hardcoded them in the top. The new formatter doesn't. * Remove getHeadScripts(). * Remove getInlineHeadScripts(). * Remove getExternalHeadScripts(). * Remove buildCssLinks(). * Remove getScriptsForBottomQueue(). * Change where Skin::setupSkinUserCss() is called. This methods lets the skin add modules to the queue. Previously it was called from buildCssLinks(), via headElement(), via prepareQuickTemplate(), via OutputPage::output(). It's now in OutputPage::output() directly (slightly earlier). This is needed because prepareQuickTemplate() calls bottomScripts() before headElement(). And bottomScript() would lazy-initialise the queue and lock it before setupSkinUserCss() is called from headElement(). This makes execution order more predictable instead of being dependent on the arbitrary order of data extraction in prepareQuickTemplate (which varies from one skin to another). * Compute isUserModulePreview() and isKnownEmpty() for the 'user' module early on so. This avoids wrongful loading and fixes problem 1. Effective changes in output: * mw.loader.state() is now before mw.loader.load(). This fixes problem 2. * mw.loader.state() now sets 'user.options' and 'user.tokens' to "loading". * mw.loader.state() now sets 'user' (as "loading" or "ready"). Fixes problem 1. * The <script async src> tag for 'startup' changed position (slightly). Previously it was after all inline scripts and stylesheets. It's still after all inline scripts and after most stylesheets, but before any user styles. Since the queue is now formatted outside OutputPage, it can't inject the meta-ResourceLoaderDynamicStyles tag and user-stylesheet hack in the middle of existing output. This shouldn't have any noticable impact. Bug: T87871 Change-Id: I605b8cd1e1fc009b4662a0edbc54d09dd65ee1df
2016-07-15 14:13:09 +00:00
* @param string $script JavaScript text, no script tags
*/
public function addInlineScript( $script ) {
$this->mScripts .= Html::inlineScript( "\n$script\n", $this->CSP->getNonce() ) . "\n";
}
/**
* Filter an array of modules to remove insufficiently trustworthy members, and modules
* which are no longer registered (eg a page is cached before an extension is disabled)
* @param string[] $modules
* @param string|null $position Unused
* @param string $type
* @return string[]
*/
protected function filterModules( array $modules, $position = null,
$type = RL\Module::TYPE_COMBINED
) {
$resourceLoader = $this->getResourceLoader();
$filteredModules = [];
foreach ( $modules as $val ) {
$module = $resourceLoader->getModule( $val );
if ( $module instanceof RL\Module
&& $module->getOrigin() <= $this->getAllowedModules( $type )
) {
if ( $this->mTarget && !in_array( $this->mTarget, $module->getTargets() ) ) {
$this->warnModuleTargetFilter( $module->getName() );
continue;
}
$filteredModules[] = $val;
}
}
return $filteredModules;
}
private function warnModuleTargetFilter( $moduleName ) {
static $warnings = [];
if ( isset( $warnings[$this->mTarget][$moduleName] ) ) {
return;
}
$warnings[$this->mTarget][$moduleName] = true;
$this->getResourceLoader()->getLogger()->debug(
'Module "{module}" not loadable on target "{target}".',
[
'module' => $moduleName,
'target' => $this->mTarget,
]
);
}
/**
* Get the list of modules to include on this page
2010-09-07 21:05:09 +00:00
*
* @param bool $filter Whether to filter out insufficiently trustworthy modules
* @param string|null $position Unused
* @param string $param
* @param string $type
* @return string[] Array of module names
*/
resourceloader: Move queue formatting out of OutputPage HTML formatting of the queue was distributed over several OutputPage methods. Each method demanding a snippet of HTML by calling makeResourceLoaderLink() with a limited amount of information. As such, makeResourceLoaderLink() was unable to provide the client with the proper state information. Centralising it also allows it to better reduce duplication in HTML output and maintain a more accurate state. Problems fixed by centralising: 1. The 'user' module is special (due to per-user 'version' and 'user' params). It is manually requested via script-src. To avoid a separate (and wrong) request from something that requires it, we set state=loading directly. However, because the module is in the bottom, the old HTML formatter could only put state=loading in the bottom also. This sometimes caused a wrong request to be fired for modules=user if something in the top queue triggered a requirement for it. 2. Since a464d1d4 (T87871) we track states of page-style modules, with purpose of allowing dependencies on style modules without risking duplicate loading on pages where the styles are loaded already. This didn't work, because the state information about page-style modules is output near the stylesheet, which is after the script tag with mw.loader.load(). That runs first, and mw.loader would still make a duplicate request before it learns the state. Changes: * Document reasons for style/script tag order in getHeadHtml (per 09537e83). * Pass $type from getModuleStyles() to getAllowedModules(). This wasn't needed before since a duplicate check in makeResourceLoaderLink() verified the origin a second time. * Declare explicit position 'top' on 'user.options' and 'user.tokens' module. Previously, OutputPage hardcoded them in the top. The new formatter doesn't. * Remove getHeadScripts(). * Remove getInlineHeadScripts(). * Remove getExternalHeadScripts(). * Remove buildCssLinks(). * Remove getScriptsForBottomQueue(). * Change where Skin::setupSkinUserCss() is called. This methods lets the skin add modules to the queue. Previously it was called from buildCssLinks(), via headElement(), via prepareQuickTemplate(), via OutputPage::output(). It's now in OutputPage::output() directly (slightly earlier). This is needed because prepareQuickTemplate() calls bottomScripts() before headElement(). And bottomScript() would lazy-initialise the queue and lock it before setupSkinUserCss() is called from headElement(). This makes execution order more predictable instead of being dependent on the arbitrary order of data extraction in prepareQuickTemplate (which varies from one skin to another). * Compute isUserModulePreview() and isKnownEmpty() for the 'user' module early on so. This avoids wrongful loading and fixes problem 1. Effective changes in output: * mw.loader.state() is now before mw.loader.load(). This fixes problem 2. * mw.loader.state() now sets 'user.options' and 'user.tokens' to "loading". * mw.loader.state() now sets 'user' (as "loading" or "ready"). Fixes problem 1. * The <script async src> tag for 'startup' changed position (slightly). Previously it was after all inline scripts and stylesheets. It's still after all inline scripts and after most stylesheets, but before any user styles. Since the queue is now formatted outside OutputPage, it can't inject the meta-ResourceLoaderDynamicStyles tag and user-stylesheet hack in the middle of existing output. This shouldn't have any noticable impact. Bug: T87871 Change-Id: I605b8cd1e1fc009b4662a0edbc54d09dd65ee1df
2016-07-15 14:13:09 +00:00
public function getModules( $filter = false, $position = null, $param = 'mModules',
$type = RL\Module::TYPE_COMBINED
resourceloader: Move queue formatting out of OutputPage HTML formatting of the queue was distributed over several OutputPage methods. Each method demanding a snippet of HTML by calling makeResourceLoaderLink() with a limited amount of information. As such, makeResourceLoaderLink() was unable to provide the client with the proper state information. Centralising it also allows it to better reduce duplication in HTML output and maintain a more accurate state. Problems fixed by centralising: 1. The 'user' module is special (due to per-user 'version' and 'user' params). It is manually requested via script-src. To avoid a separate (and wrong) request from something that requires it, we set state=loading directly. However, because the module is in the bottom, the old HTML formatter could only put state=loading in the bottom also. This sometimes caused a wrong request to be fired for modules=user if something in the top queue triggered a requirement for it. 2. Since a464d1d4 (T87871) we track states of page-style modules, with purpose of allowing dependencies on style modules without risking duplicate loading on pages where the styles are loaded already. This didn't work, because the state information about page-style modules is output near the stylesheet, which is after the script tag with mw.loader.load(). That runs first, and mw.loader would still make a duplicate request before it learns the state. Changes: * Document reasons for style/script tag order in getHeadHtml (per 09537e83). * Pass $type from getModuleStyles() to getAllowedModules(). This wasn't needed before since a duplicate check in makeResourceLoaderLink() verified the origin a second time. * Declare explicit position 'top' on 'user.options' and 'user.tokens' module. Previously, OutputPage hardcoded them in the top. The new formatter doesn't. * Remove getHeadScripts(). * Remove getInlineHeadScripts(). * Remove getExternalHeadScripts(). * Remove buildCssLinks(). * Remove getScriptsForBottomQueue(). * Change where Skin::setupSkinUserCss() is called. This methods lets the skin add modules to the queue. Previously it was called from buildCssLinks(), via headElement(), via prepareQuickTemplate(), via OutputPage::output(). It's now in OutputPage::output() directly (slightly earlier). This is needed because prepareQuickTemplate() calls bottomScripts() before headElement(). And bottomScript() would lazy-initialise the queue and lock it before setupSkinUserCss() is called from headElement(). This makes execution order more predictable instead of being dependent on the arbitrary order of data extraction in prepareQuickTemplate (which varies from one skin to another). * Compute isUserModulePreview() and isKnownEmpty() for the 'user' module early on so. This avoids wrongful loading and fixes problem 1. Effective changes in output: * mw.loader.state() is now before mw.loader.load(). This fixes problem 2. * mw.loader.state() now sets 'user.options' and 'user.tokens' to "loading". * mw.loader.state() now sets 'user' (as "loading" or "ready"). Fixes problem 1. * The <script async src> tag for 'startup' changed position (slightly). Previously it was after all inline scripts and stylesheets. It's still after all inline scripts and after most stylesheets, but before any user styles. Since the queue is now formatted outside OutputPage, it can't inject the meta-ResourceLoaderDynamicStyles tag and user-stylesheet hack in the middle of existing output. This shouldn't have any noticable impact. Bug: T87871 Change-Id: I605b8cd1e1fc009b4662a0edbc54d09dd65ee1df
2016-07-15 14:13:09 +00:00
) {
$modules = array_values( array_unique( $this->$param ) );
return $filter
? $this->filterModules( $modules, null, $type )
: $modules;
}
/**
* Load one or more ResourceLoader modules on this page.
2010-09-07 21:05:09 +00:00
*
* @param string|array $modules Module name (string) or array of module names
*/
public function addModules( $modules ) {
$this->mModules = array_merge( $this->mModules, (array)$modules );
}
/**
* Get the list of style-only modules to load on this page.
2010-09-07 21:05:09 +00:00
*
* @param bool $filter
* @param string|null $position Unused
* @return string[] Array of module names
*/
public function getModuleStyles( $filter = false, $position = null ) {
return $this->getModules( $filter, null, 'mModuleStyles',
RL\Module::TYPE_STYLES
resourceloader: Move queue formatting out of OutputPage HTML formatting of the queue was distributed over several OutputPage methods. Each method demanding a snippet of HTML by calling makeResourceLoaderLink() with a limited amount of information. As such, makeResourceLoaderLink() was unable to provide the client with the proper state information. Centralising it also allows it to better reduce duplication in HTML output and maintain a more accurate state. Problems fixed by centralising: 1. The 'user' module is special (due to per-user 'version' and 'user' params). It is manually requested via script-src. To avoid a separate (and wrong) request from something that requires it, we set state=loading directly. However, because the module is in the bottom, the old HTML formatter could only put state=loading in the bottom also. This sometimes caused a wrong request to be fired for modules=user if something in the top queue triggered a requirement for it. 2. Since a464d1d4 (T87871) we track states of page-style modules, with purpose of allowing dependencies on style modules without risking duplicate loading on pages where the styles are loaded already. This didn't work, because the state information about page-style modules is output near the stylesheet, which is after the script tag with mw.loader.load(). That runs first, and mw.loader would still make a duplicate request before it learns the state. Changes: * Document reasons for style/script tag order in getHeadHtml (per 09537e83). * Pass $type from getModuleStyles() to getAllowedModules(). This wasn't needed before since a duplicate check in makeResourceLoaderLink() verified the origin a second time. * Declare explicit position 'top' on 'user.options' and 'user.tokens' module. Previously, OutputPage hardcoded them in the top. The new formatter doesn't. * Remove getHeadScripts(). * Remove getInlineHeadScripts(). * Remove getExternalHeadScripts(). * Remove buildCssLinks(). * Remove getScriptsForBottomQueue(). * Change where Skin::setupSkinUserCss() is called. This methods lets the skin add modules to the queue. Previously it was called from buildCssLinks(), via headElement(), via prepareQuickTemplate(), via OutputPage::output(). It's now in OutputPage::output() directly (slightly earlier). This is needed because prepareQuickTemplate() calls bottomScripts() before headElement(). And bottomScript() would lazy-initialise the queue and lock it before setupSkinUserCss() is called from headElement(). This makes execution order more predictable instead of being dependent on the arbitrary order of data extraction in prepareQuickTemplate (which varies from one skin to another). * Compute isUserModulePreview() and isKnownEmpty() for the 'user' module early on so. This avoids wrongful loading and fixes problem 1. Effective changes in output: * mw.loader.state() is now before mw.loader.load(). This fixes problem 2. * mw.loader.state() now sets 'user.options' and 'user.tokens' to "loading". * mw.loader.state() now sets 'user' (as "loading" or "ready"). Fixes problem 1. * The <script async src> tag for 'startup' changed position (slightly). Previously it was after all inline scripts and stylesheets. It's still after all inline scripts and after most stylesheets, but before any user styles. Since the queue is now formatted outside OutputPage, it can't inject the meta-ResourceLoaderDynamicStyles tag and user-stylesheet hack in the middle of existing output. This shouldn't have any noticable impact. Bug: T87871 Change-Id: I605b8cd1e1fc009b4662a0edbc54d09dd65ee1df
2016-07-15 14:13:09 +00:00
);
}
/**
* Load the styles of one or more style-only ResourceLoader modules on this page.
*
* Module styles added through this function will be loaded as a stylesheet,
* using a standard `<link rel=stylesheet>` HTML tag, rather than as a combined
* Javascript and CSS package. Thus, they will even load when JavaScript is disabled.
2010-09-07 21:05:09 +00:00
*
* @param string|array $modules Module name (string) or array of module names
*/
public function addModuleStyles( $modules ) {
$this->mModuleStyles = array_merge( $this->mModuleStyles, (array)$modules );
}
/**
* @return null|string ResourceLoader target
*/
public function getTarget() {
return $this->mTarget;
}
/**
* Sets ResourceLoader target for load.php links. If null, will be omitted
*
* @param string|null $target
*/
public function setTarget( $target ) {
$this->mTarget = $target;
}
/**
* Force the given Content object for the given page, for things like page preview.
* @see self::addContentOverrideCallback()
* @since 1.32
* @param LinkTarget|PageReference $target
* @param Content $content
*/
public function addContentOverride( $target, Content $content ) {
if ( !$this->contentOverrides ) {
// Register a callback for $this->contentOverrides on the first call
$this->addContentOverrideCallback( function ( $target ) {
$key = $target->getNamespace() . ':' . $target->getDBkey();
return $this->contentOverrides[$key] ?? null;
} );
}
$key = $target->getNamespace() . ':' . $target->getDBkey();
$this->contentOverrides[$key] = $content;
}
/**
* Add a callback for mapping from a Title to a Content object, for things
* like page preview.
* @see RL\Context::getContentOverrideCallback()
* @since 1.32
* @param callable $callback
*/
public function addContentOverrideCallback( callable $callback ) {
$this->contentOverrideCallbacks[] = $callback;
}
/**
* Add a class to the <html> element. This should rarely be used.
* Instead use OutputPage::addBodyClasses() if possible.
*
* @unstable Experimental since 1.35. Prefer OutputPage::addBodyClasses()
* @param string|string[] $classes One or more classes to add
*/
public function addHtmlClasses( $classes ) {
$this->mAdditionalHtmlClasses = array_merge( $this->mAdditionalHtmlClasses, (array)$classes );
}
/**
* Get an array of head items
*
* @return string[]
*/
public function getHeadItemsArray() {
return $this->mHeadItems;
}
/**
* Add or replace a head item to the output
*
* Whenever possible, use more specific options like ResourceLoader modules,
* OutputPage::addLink(), OutputPage::addMeta() and OutputPage::addFeedLink()
* Fallback options for those are: OutputPage::addStyle, OutputPage::addScript(),
* OutputPage::addInlineScript() and OutputPage::addInlineStyle()
* This would be your very LAST fallback.
*
* @param string $name Item name
* @param string $value Raw HTML
*/
public function addHeadItem( $name, $value ) {
2007-04-29 10:15:05 +00:00
$this->mHeadItems[$name] = $value;
}
/**
* Add one or more head items to the output
*
* @since 1.28
* @param string|string[] $values Raw HTML
*/
public function addHeadItems( $values ) {
$this->mHeadItems = array_merge( $this->mHeadItems, (array)$values );
}
/**
* Check if the header item $name is already set
*
* @param string $name Item name
* @return bool
*/
public function hasHeadItem( $name ) {
return isset( $this->mHeadItems[$name] );
}
/**
* Add a class to the <body> element
*
* @since 1.30
* @param string|string[] $classes One or more classes to add
*/
public function addBodyClasses( $classes ) {
$this->mAdditionalBodyClasses = array_merge( $this->mAdditionalBodyClasses, (array)$classes );
}
/**
* Set whether the output should only contain the body of the article,
* without any skin, sidebar, etc.
* Used e.g. when calling with "action=render".
*
* @param bool $only Whether to output only the body of the article
*/
public function setArticleBodyOnly( $only ) {
$this->mArticleBodyOnly = $only;
2008-08-10 07:14:08 +00:00
}
2003-04-14 23:10:40 +00:00
/**
* Return whether the output will contain only the body of the article
*
* @return bool
*/
public function getArticleBodyOnly() {
return $this->mArticleBodyOnly;
}
/**
* Set an additional output property
* @since 1.21
*
* @param string $name
* @param mixed $value
*/
public function setProperty( $name, $value ) {
$this->mProperties[$name] = $value;
}
/**
* Get an additional output property
* @since 1.21
*
* @param string $name
* @return mixed Property value or null if not found
*/
public function getProperty( $name ) {
return $this->mProperties[$name] ?? null;
}
/**
* checkLastModified tells the client to use the client-cached page if
* possible. If successful, the OutputPage is disabled so that
* any future call to OutputPage->output() have no effect.
*
* Side effect: sets mLastModified for Last-Modified header
*
* @param string $timestamp
*
* @return bool True if cache-ok headers was sent.
*/
public function checkLastModified( $timestamp ) {
if ( !$timestamp || $timestamp == '19700101000000' ) {
wfDebug( __METHOD__ . ": CACHE DISABLED, NO TIMESTAMP" );
return false;
}
$config = $this->getConfig();
if ( !$config->get( MainConfigNames::CachePages ) ) {
wfDebug( __METHOD__ . ": CACHE DISABLED" );
return false;
2003-07-10 04:55:41 +00:00
}
$timestamp = wfTimestamp( TS_MW, $timestamp );
$modifiedTimes = [
'page' => $timestamp,
'user' => $this->getUser()->getTouched(),
'epoch' => $config->get( MainConfigNames::CacheEpoch )
];
if ( $config->get( MainConfigNames::UseCdn ) ) {
$modifiedTimes['sepoch'] = wfTimestamp( TS_MW, $this->getCdnCacheEpoch(
time(),
$config->get( MainConfigNames::CdnMaxAge )
) );
}
Hooks::run() call site migration Migrate all callers of Hooks::run() to use the new HookContainer/HookRunner system. General principles: * Use DI if it is already used. We're not changing the way state is managed in this patch. * HookContainer is always injected, not HookRunner. HookContainer is a service, it's a more generic interface, it is the only thing that provides isRegistered() which is needed in some cases, and a HookRunner can be efficiently constructed from it (confirmed by benchmark). Because HookContainer is needed for object construction, it is also needed by all factories. * "Ask your friendly local base class". Big hierarchies like SpecialPage and ApiBase have getHookContainer() and getHookRunner() methods in the base class, and classes that extend that base class are not expected to know or care where the base class gets its HookContainer from. * ProtectedHookAccessorTrait provides protected getHookContainer() and getHookRunner() methods, getting them from the global service container. The point of this is to ease migration to DI by ensuring that call sites ask their local friendly base class rather than getting a HookRunner from the service container directly. * Private $this->hookRunner. In some smaller classes where accessor methods did not seem warranted, there is a private HookRunner property which is accessed directly. Very rarely (two cases), there is a protected property, for consistency with code that conventionally assumes protected=private, but in cases where the class might actually be overridden, a protected accessor is preferred over a protected property. * The last resort: Hooks::runner(). Mostly for static, file-scope and global code. In a few cases it was used for objects with broken construction schemes, out of horror or laziness. Constructors with new required arguments: * AuthManager * BadFileLookup * BlockManager * ClassicInterwikiLookup * ContentHandlerFactory * ContentSecurityPolicy * DefaultOptionsManager * DerivedPageDataUpdater * FullSearchResultWidget * HtmlCacheUpdater * LanguageFactory * LanguageNameUtils * LinkRenderer * LinkRendererFactory * LocalisationCache * MagicWordFactory * MessageCache * NamespaceInfo * PageEditStash * PageHandlerFactory * PageUpdater * ParserFactory * PermissionManager * RevisionStore * RevisionStoreFactory * SearchEngineConfig * SearchEngineFactory * SearchFormWidget * SearchNearMatcher * SessionBackend * SpecialPageFactory * UserNameUtils * UserOptionsManager * WatchedItemQueryService * WatchedItemStore Constructors with new optional arguments: * DefaultPreferencesFactory * Language * LinkHolderArray * MovePage * Parser * ParserCache * PasswordReset * Router setHookContainer() now required after construction: * AuthenticationProvider * ResourceLoaderModule * SearchEngine Change-Id: Id442b0dbe43aba84bd5cf801d86dedc768b082c7
2020-03-19 02:42:09 +00:00
$this->getHookRunner()->onOutputPageCheckLastModified( $modifiedTimes, $this );
$maxModified = max( $modifiedTimes );
$this->mLastModified = wfTimestamp( TS_RFC2822, $maxModified );
$clientHeader = $this->getRequest()->getHeader( 'If-Modified-Since' );
if ( $clientHeader === false ) {
wfDebug( __METHOD__ . ": client did not send If-Modified-Since header", 'private' );
return false;
2003-04-14 23:10:40 +00:00
}
# IE sends sizes after the date like this:
# Wed, 20 Aug 2003 06:51:19 GMT; length=5202
# this breaks strtotime().
$clientHeader = preg_replace( '/;.*$/', '', $clientHeader );
// E_STRICT system time warnings
AtEase::suppressWarnings();
$clientHeaderTime = strtotime( $clientHeader );
AtEase::restoreWarnings();
if ( !$clientHeaderTime ) {
wfDebug( __METHOD__
. ": unable to parse the client's If-Modified-Since header: $clientHeader" );
return false;
}
$clientHeaderTime = wfTimestamp( TS_MW, $clientHeaderTime );
# Make debug info
$info = '';
foreach ( $modifiedTimes as $name => $value ) {
if ( $info !== '' ) {
$info .= ', ';
}
$info .= "$name=" . wfTimestamp( TS_ISO_8601, $value );
}
here it is ... the upload-api, script-server, js2 (javascript phase2) branch merge 1st attempt. Here is a short overview of changes and associated default configuration variables (most everything is off by default) also see ~soon to be updated~: http://www.mediawiki.org/wiki/Media_Projects_Overview = Upload Improvements = ==Upload API == * Based on the early work of Bryan Tong and others it adds the upload option to the api. * We rewrite Special:Upload page to include use the new refactoring * Added in token checks in both the SpecialUpload.php page so avoids DOS / xss copy-by-url JavaScript based cross site POST file submissions == Copy by URL== $wgAllowCopyUploads = false; * http class rewrite includes a new http background download see: includes/HttpFunctions.php * spins off a php process that calls: maintenance/http_session_download.php * pushes updates to the session and gives the user a progress bar on http copy uploads from other server progress (using js2 upload interface) (if not using the js2 upload interface it does the request in-place but the download is limited to the php ini timeout time) == Firefogg == * Firefogg enables resumable upload by chunks * progress indicators and conditional invokation (js2 system) * and of-course client side transcoding. = Script Server = $wgEnableScriptLoader = false; * off by default if $wgEnableScriptLoader is turned on script files are grouped, gziped, cached etc. for more info see: http://www.mediawiki.org/wiki/Extension:ScriptLoader * Includes some early skin js include fixes (skin/script system still lots of love) * Includes a "javascript class autoloader" this is packaged into mwEmbed so that the mwEmbed library can work in stand alone mode (while retaining localization and script serving) (one such application is the make page for firefogg.org : http://www.firefogg.org/make/index.html ) * The file that contains the autojavascript loading classes is: js2/php/jsAutoloadLocalClasses.php * One can use this auto class loading dependency system with extensions and add-ons but I need to better document that. = js2 system / mwEmbed= $wgEnableJS2system = false * includes initial rewrite towards more jquery based javascript code * especially for the Special:Upload page. * Also the edit page include support for the "add-media-wizard" * includes dependency loader for javascript that optionally takes advantage of the script-loader * remote embedding of javascript interfaces (like embedding video, or commons media searching) * $wgDebugJavaScript = false; .. .this variable lets you always get "always fresh javascript". When used with the script-loader it does not minify the script-loader output. = mwEmbed = * Will commit a separate patch to oggHandler that conditionally outputs <video tag> to use the new javascript video player. ** mv_embed player includes: play-head, volume control, remote embedding, oggz-chop support across plugins. * add-media-wizard adds easy inserts of media to pages (with import) == jQuery== * we include a base install of jQuery, jQuery ui and some plugins. * all the javascript classes are in the scriptloader so its easy to load any set of jquery ui components that you may need using the script-server. You get a callback so you can then execute js with dependencies loaded. == other stuff == there is a bit more code in js2 that pertains to sequence editing, timed text display and basic image editing. We include a base import of pixastic-lib & pixastic-editor... will work with the pixastic developer to try and ensure upstream compatibility on our usage of the library for in-browser photo and sequence manipulation.
2009-07-14 23:52:14 +00:00
wfDebug( __METHOD__ . ": client sent If-Modified-Since: " .
wfTimestamp( TS_ISO_8601, $clientHeaderTime ), 'private' );
here it is ... the upload-api, script-server, js2 (javascript phase2) branch merge 1st attempt. Here is a short overview of changes and associated default configuration variables (most everything is off by default) also see ~soon to be updated~: http://www.mediawiki.org/wiki/Media_Projects_Overview = Upload Improvements = ==Upload API == * Based on the early work of Bryan Tong and others it adds the upload option to the api. * We rewrite Special:Upload page to include use the new refactoring * Added in token checks in both the SpecialUpload.php page so avoids DOS / xss copy-by-url JavaScript based cross site POST file submissions == Copy by URL== $wgAllowCopyUploads = false; * http class rewrite includes a new http background download see: includes/HttpFunctions.php * spins off a php process that calls: maintenance/http_session_download.php * pushes updates to the session and gives the user a progress bar on http copy uploads from other server progress (using js2 upload interface) (if not using the js2 upload interface it does the request in-place but the download is limited to the php ini timeout time) == Firefogg == * Firefogg enables resumable upload by chunks * progress indicators and conditional invokation (js2 system) * and of-course client side transcoding. = Script Server = $wgEnableScriptLoader = false; * off by default if $wgEnableScriptLoader is turned on script files are grouped, gziped, cached etc. for more info see: http://www.mediawiki.org/wiki/Extension:ScriptLoader * Includes some early skin js include fixes (skin/script system still lots of love) * Includes a "javascript class autoloader" this is packaged into mwEmbed so that the mwEmbed library can work in stand alone mode (while retaining localization and script serving) (one such application is the make page for firefogg.org : http://www.firefogg.org/make/index.html ) * The file that contains the autojavascript loading classes is: js2/php/jsAutoloadLocalClasses.php * One can use this auto class loading dependency system with extensions and add-ons but I need to better document that. = js2 system / mwEmbed= $wgEnableJS2system = false * includes initial rewrite towards more jquery based javascript code * especially for the Special:Upload page. * Also the edit page include support for the "add-media-wizard" * includes dependency loader for javascript that optionally takes advantage of the script-loader * remote embedding of javascript interfaces (like embedding video, or commons media searching) * $wgDebugJavaScript = false; .. .this variable lets you always get "always fresh javascript". When used with the script-loader it does not minify the script-loader output. = mwEmbed = * Will commit a separate patch to oggHandler that conditionally outputs <video tag> to use the new javascript video player. ** mv_embed player includes: play-head, volume control, remote embedding, oggz-chop support across plugins. * add-media-wizard adds easy inserts of media to pages (with import) == jQuery== * we include a base install of jQuery, jQuery ui and some plugins. * all the javascript classes are in the scriptloader so its easy to load any set of jquery ui components that you may need using the script-server. You get a callback so you can then execute js with dependencies loaded. == other stuff == there is a bit more code in js2 that pertains to sequence editing, timed text display and basic image editing. We include a base import of pixastic-lib & pixastic-editor... will work with the pixastic developer to try and ensure upstream compatibility on our usage of the library for in-browser photo and sequence manipulation.
2009-07-14 23:52:14 +00:00
wfDebug( __METHOD__ . ": effective Last-Modified: " .
wfTimestamp( TS_ISO_8601, $maxModified ), 'private' );
if ( $clientHeaderTime < $maxModified ) {
wfDebug( __METHOD__ . ": STALE, $info", 'private' );
return false;
}
# Not modified
# Give a 304 Not Modified response code and disable body output
wfDebug( __METHOD__ . ": NOT MODIFIED, $info", 'private' );
// @phan-suppress-next-line PhanTypeMismatchArgumentInternal Scalar okay with php8.1
ini_set( 'zlib.output_compression', 0 );
$this->getRequest()->response()->statusHeader( 304 );
$this->sendCacheControl();
$this->disable();
// Don't output a compressed blob when using ob_gzhandler;
// it's technically against HTTP spec and seems to confuse
// Firefox when the response gets split over two packets.
wfResetOutputBuffers( false );
return true;
2003-04-14 23:10:40 +00:00
}
/**
* @param int $reqTime Time of request (eg. now)
* @param int $maxAge Cache TTL in seconds
* @return int Timestamp
*/
private function getCdnCacheEpoch( $reqTime, $maxAge ) {
// Ensure Last-Modified is never more than $wgCdnMaxAge in the past,
// because even if the wiki page content hasn't changed since, static
// resources may have changed (skin HTML, interface messages, urls, etc.)
// and must roll-over in a timely manner (T46570)
return $reqTime - $maxAge;
}
/**
* Override the last modified timestamp
*
* @param string $timestamp New timestamp, in a format readable by
* wfTimestamp()
*/
public function setLastModified( $timestamp ) {
$this->mLastModified = wfTimestamp( TS_RFC2822, $timestamp );
}
/**
* Set the robot policy for the page: <http://www.robotstxt.org/meta.html>
*
* @param string $policy The literal string to output as the contents of
* the meta tag. Will be parsed according to the spec and output in
* standardized form.
*/
public function setRobotPolicy( $policy ) {
$policy = Article::formatRobotPolicy( $policy );
if ( isset( $policy['index'] ) ) {
$this->setIndexPolicy( $policy['index'] );
}
if ( isset( $policy['follow'] ) ) {
$this->setFollowPolicy( $policy['follow'] );
}
}
/**
* Get the current robot policy for the page as a string in the form
* <index policy>,<follow policy>.
*
* @return string
*/
public function getRobotPolicy() {
return "{$this->mIndexPolicy},{$this->mFollowPolicy}";
}
/**
* Format an array of robots options as a string of directives.
*
* @return string The robots policy options.
*/
private function formatRobotsOptions(): string {
$options = $this->mRobotsOptions;
// Check if options array has any non-integer keys.
if ( count( array_filter( array_keys( $options ), 'is_string' ) ) > 0 ) {
// Robots meta tags can have directives that are single strings or
// have parameters that should be formatted like <directive>:<setting>.
// If the options keys are strings, format them accordingly.
// https://developers.google.com/search/docs/advanced/robots/robots_meta_tag
array_walk( $options, static function ( &$value, $key ) {
$value = is_string( $key ) ? "{$key}:{$value}" : "{$value}";
} );
}
return implode( ',', $options );
}
/**
* Set the robots policy with options for the page.
*
* @since 1.38
* @param array $options An array of key-value pairs or a string
* to populate the robots meta tag content attribute as a string.
*/
public function setRobotsOptions( array $options = [] ): void {
$this->mRobotsOptions = array_merge( $this->mRobotsOptions, $options );
}
/**
* Get the robots policy content attribute for the page
* as a string in the form <index policy>,<follow policy>,<options>.
*
* @return string
*/
private function getRobotsContent(): string {
$robotOptionString = $this->formatRobotsOptions();
$robotArgs = ( $this->mIndexPolicy === 'index' &&
$this->mFollowPolicy === 'follow' ) ?
[] :
[
$this->mIndexPolicy,
$this->mFollowPolicy,
];
if ( $robotOptionString ) {
$robotArgs[] = $robotOptionString;
}
return implode( ',', $robotArgs );
}
/**
* Set the index policy for the page, but leave the follow policy un-
* touched.
*
* @param string $policy Either 'index' or 'noindex'.
*/
public function setIndexPolicy( $policy ) {
$policy = trim( $policy );
if ( in_array( $policy, [ 'index', 'noindex' ] ) ) {
$this->mIndexPolicy = $policy;
}
}
/**
* Get the current index policy for the page as a string.
*
* @return string
*/
public function getIndexPolicy() {
return $this->mIndexPolicy;
}
/**
* Set the follow policy for the page, but leave the index policy un-
* touched.
*
* @param string $policy Either 'follow' or 'nofollow'.
*/
public function setFollowPolicy( $policy ) {
$policy = trim( $policy );
if ( in_array( $policy, [ 'follow', 'nofollow' ] ) ) {
$this->mFollowPolicy = $policy;
}
}
/**
* Get the current follow policy for the page as a string.
*
* @return string
*/
public function getFollowPolicy() {
return $this->mFollowPolicy;
}
/**
* "HTML title" means the contents of "<title>".
* It is stored as plain, unescaped text and will be run through htmlspecialchars in the skin file.
*
* @param string|Message $name
*/
public function setHTMLTitle( $name ) {
if ( $name instanceof Message ) {
$this->mHTMLtitle = $name->setContext( $this->getContext() )->text();
} else {
$this->mHTMLtitle = $name;
}
}
/**
* Return the "HTML title", i.e. the content of the "<title>" tag.
*
* @return string
*/
public function getHTMLTitle() {
return $this->mHTMLtitle;
}
/**
* Set $mRedirectedFrom, the page which redirected us to the current page.
*
* @param PageReference $t
*/
public function setRedirectedFrom( PageReference $t ) {
$this->mRedirectedFrom = $t;
}
/**
* "Page title" means the contents of \<h1\>. It is stored as a valid HTML
* fragment. This function allows good tags like \<sup\> in the \<h1\> tag,
* but not bad tags like \<script\>. This function automatically sets
* \<title\> to the same content as \<h1\> but with all tags removed. Bad
* tags that were escaped in \<h1\> will still be escaped in \<title\>, and
* good tags like \<i\> will be dropped entirely.
*
* @param string|Message $name
* @param-taint $name tainted
* Phan-taint-check gets very confused by $name being either a string or a Message
*/
public function setPageTitle( $name ) {
if ( $name instanceof Message ) {
$name = $name->setContext( $this->getContext() )->text();
}
# change "<script>foo&bar</script>" to "&lt;script&gt;foo&amp;bar&lt;/script&gt;"
# but leave "<i>foobar</i>" alone
Add Sanitizer::removeSomeTags() which uses Remex to tokenize The existing Sanitizer::removeHTMLtags() method, in addition to having dodgy capitalization, uses regular expressions to parse the HTML. That produces corner cases like T298401 and T67747 and is not guaranteed to yield balanced or well-formed HTML. Instead, introduce and use a new Sanitizer::removeSomeTags() method which is guaranteed to always return balanced and well-formed HTML. Note that Sanitizer::removeHTMLtags()/::removeSomeTags() take a callback argument which (as far as I can tell) is never used outside core. Mark that argument as @internal, and clean up the version used by ::removeSomeTags(). Use the new ::removeSomeTags() method in the two places where DISPLAYTITLE is handled (following up on T67747). The use by the legacy parser is more difficult to replace (and would have a performace cost), so leave the old ::removeHTMLtags() method in place for that call site for now: when the legacy parser is replaced by Parsoid the need for the old ::removeHTMLtags() will go away. In a follow-up patch we'll rename ::removeHTMLtags() and mark it @internal so that we can deprecate ::removeHTMLtags() for external use. Some benchmarking code added. On my machine, with PHP 7.4, the new method tidies short 30-character title strings at a rate of about 6764/s while the tidy-based method being replaced here managed 6384/s. Sanitizer::removeHTMLtags blazes through short strings 20x faster (120,915/s); some of this difference is due to the set up cost of creating the tag whitelist and the Remex pipeline, so further optimizations could doubtless be done if Sanitizer::removeSomeTags() is more widely used. Bug: T299722 Bug: T67747 Change-Id: Ic864c01471c292f11799c4fbdac4d7d30b8bc50f
2022-01-21 22:03:26 +00:00
$nameWithTags = Sanitizer::removeSomeTags( $name );
$this->mPageTitle = $nameWithTags;
# change "<i>foo&amp;bar</i>" to "foo&bar"
$this->setHTMLTitle(
$this->msg( 'pagetitle' )->plaintextParams( Sanitizer::stripAllTags( $nameWithTags ) )
->inContentLanguage()
);
}
here it is ... the upload-api, script-server, js2 (javascript phase2) branch merge 1st attempt. Here is a short overview of changes and associated default configuration variables (most everything is off by default) also see ~soon to be updated~: http://www.mediawiki.org/wiki/Media_Projects_Overview = Upload Improvements = ==Upload API == * Based on the early work of Bryan Tong and others it adds the upload option to the api. * We rewrite Special:Upload page to include use the new refactoring * Added in token checks in both the SpecialUpload.php page so avoids DOS / xss copy-by-url JavaScript based cross site POST file submissions == Copy by URL== $wgAllowCopyUploads = false; * http class rewrite includes a new http background download see: includes/HttpFunctions.php * spins off a php process that calls: maintenance/http_session_download.php * pushes updates to the session and gives the user a progress bar on http copy uploads from other server progress (using js2 upload interface) (if not using the js2 upload interface it does the request in-place but the download is limited to the php ini timeout time) == Firefogg == * Firefogg enables resumable upload by chunks * progress indicators and conditional invokation (js2 system) * and of-course client side transcoding. = Script Server = $wgEnableScriptLoader = false; * off by default if $wgEnableScriptLoader is turned on script files are grouped, gziped, cached etc. for more info see: http://www.mediawiki.org/wiki/Extension:ScriptLoader * Includes some early skin js include fixes (skin/script system still lots of love) * Includes a "javascript class autoloader" this is packaged into mwEmbed so that the mwEmbed library can work in stand alone mode (while retaining localization and script serving) (one such application is the make page for firefogg.org : http://www.firefogg.org/make/index.html ) * The file that contains the autojavascript loading classes is: js2/php/jsAutoloadLocalClasses.php * One can use this auto class loading dependency system with extensions and add-ons but I need to better document that. = js2 system / mwEmbed= $wgEnableJS2system = false * includes initial rewrite towards more jquery based javascript code * especially for the Special:Upload page. * Also the edit page include support for the "add-media-wizard" * includes dependency loader for javascript that optionally takes advantage of the script-loader * remote embedding of javascript interfaces (like embedding video, or commons media searching) * $wgDebugJavaScript = false; .. .this variable lets you always get "always fresh javascript". When used with the script-loader it does not minify the script-loader output. = mwEmbed = * Will commit a separate patch to oggHandler that conditionally outputs <video tag> to use the new javascript video player. ** mv_embed player includes: play-head, volume control, remote embedding, oggz-chop support across plugins. * add-media-wizard adds easy inserts of media to pages (with import) == jQuery== * we include a base install of jQuery, jQuery ui and some plugins. * all the javascript classes are in the scriptloader so its easy to load any set of jquery ui components that you may need using the script-server. You get a callback so you can then execute js with dependencies loaded. == other stuff == there is a bit more code in js2 that pertains to sequence editing, timed text display and basic image editing. We include a base import of pixastic-lib & pixastic-editor... will work with the pixastic developer to try and ensure upstream compatibility on our usage of the library for in-browser photo and sequence manipulation.
2009-07-14 23:52:14 +00:00
/**
* Return the "page title", i.e. the content of the \<h1\> tag.
*
* @return string
*/
public function getPageTitle() {
return $this->mPageTitle;
}
/**
* Same as page title but only contains name of the page, not any other text.
*
* @since 1.32
* @param string $html Page title text.
* @see OutputPage::setPageTitle
*/
public function setDisplayTitle( $html ) {
$this->displayTitle = $html;
}
/**
* Returns page display title.
*
* Performs some normalization, but this not as strict the magic word.
*
* @since 1.32
* @return string HTML
*/
public function getDisplayTitle() {
$html = $this->displayTitle;
if ( $html === null ) {
return htmlspecialchars( $this->getTitle()->getPrefixedText(), ENT_NOQUOTES );
}
Add Sanitizer::removeSomeTags() which uses Remex to tokenize The existing Sanitizer::removeHTMLtags() method, in addition to having dodgy capitalization, uses regular expressions to parse the HTML. That produces corner cases like T298401 and T67747 and is not guaranteed to yield balanced or well-formed HTML. Instead, introduce and use a new Sanitizer::removeSomeTags() method which is guaranteed to always return balanced and well-formed HTML. Note that Sanitizer::removeHTMLtags()/::removeSomeTags() take a callback argument which (as far as I can tell) is never used outside core. Mark that argument as @internal, and clean up the version used by ::removeSomeTags(). Use the new ::removeSomeTags() method in the two places where DISPLAYTITLE is handled (following up on T67747). The use by the legacy parser is more difficult to replace (and would have a performace cost), so leave the old ::removeHTMLtags() method in place for that call site for now: when the legacy parser is replaced by Parsoid the need for the old ::removeHTMLtags() will go away. In a follow-up patch we'll rename ::removeHTMLtags() and mark it @internal so that we can deprecate ::removeHTMLtags() for external use. Some benchmarking code added. On my machine, with PHP 7.4, the new method tidies short 30-character title strings at a rate of about 6764/s while the tidy-based method being replaced here managed 6384/s. Sanitizer::removeHTMLtags blazes through short strings 20x faster (120,915/s); some of this difference is due to the set up cost of creating the tag whitelist and the Remex pipeline, so further optimizations could doubtless be done if Sanitizer::removeSomeTags() is more widely used. Bug: T299722 Bug: T67747 Change-Id: Ic864c01471c292f11799c4fbdac4d7d30b8bc50f
2022-01-21 22:03:26 +00:00
return Sanitizer::removeSomeTags( $html );
}
/**
* Returns page display title without namespace prefix if possible.
*
Add markup to page titles to distinguish the namespace and the main text Pages outside of the main namespace now have the following markup in their <h1> page titles, using 'Talk:Hello' as an example: <h1> <span class="mw-page-title-namespace">Talk</span> <span class="mw-page-title-separator">:</span> <span class="mw-page-title-main">Hello</span> </h1> (line breaks and spaces added for readability) Pages in the main namespace only have the last part, e.g. for 'Hello': <h1> <span class="mw-page-title-main">Hello</span> </h1> The change is motivated by a desire to style the titles differently on talk pages in the DiscussionTools extension (T313636), but it could also be used for other things: * Language-specific tweaks (e.g. adding typographically-correct spaces around the colon separator: T249149, or replacing it with a different character: T36295) * Site-specific tweaks (e.g. de-emphasize or emphasize specific namespaces like 'Draft': T62973 / T236215) The markup is also added to automatically language-converted titles. It is not added when the title is overridden using the wikitext `{{DISPLAYTITLE:…}}` or `-{T|…}-` forms. I think this is a small limitation, as those forms mostly used in the main namespace, where the extra markup isn't very helpful anyway. This may be improved in the future. As a workaround, users could also just add the same HTML markup to their wikitext (as those forms accept it). It is not also added when the title is overridden by an extension like Translate. Maybe we'll have a better API before anyone wants to do that. If not, one could un-mark Parser::formatPageTitle() as @internal, and use that method to add the markup themselves. Bug: T306440 Change-Id: I62b17ef22de3606d736e6c261e542a34b58b5a05
2022-08-09 02:52:53 +00:00
* This method is unreliable and best avoided. (T314399)
*
* @since 1.32
* @return string HTML
*/
public function getUnprefixedDisplayTitle() {
$service = MediaWikiServices::getInstance();
$languageConverter = $service->getLanguageConverterFactory()
->getLanguageConverter( $service->getContentLanguage() );
$text = $this->getDisplayTitle();
Add markup to page titles to distinguish the namespace and the main text Pages outside of the main namespace now have the following markup in their <h1> page titles, using 'Talk:Hello' as an example: <h1> <span class="mw-page-title-namespace">Talk</span> <span class="mw-page-title-separator">:</span> <span class="mw-page-title-main">Hello</span> </h1> (line breaks and spaces added for readability) Pages in the main namespace only have the last part, e.g. for 'Hello': <h1> <span class="mw-page-title-main">Hello</span> </h1> The change is motivated by a desire to style the titles differently on talk pages in the DiscussionTools extension (T313636), but it could also be used for other things: * Language-specific tweaks (e.g. adding typographically-correct spaces around the colon separator: T249149, or replacing it with a different character: T36295) * Site-specific tweaks (e.g. de-emphasize or emphasize specific namespaces like 'Draft': T62973 / T236215) The markup is also added to automatically language-converted titles. It is not added when the title is overridden using the wikitext `{{DISPLAYTITLE:…}}` or `-{T|…}-` forms. I think this is a small limitation, as those forms mostly used in the main namespace, where the extra markup isn't very helpful anyway. This may be improved in the future. As a workaround, users could also just add the same HTML markup to their wikitext (as those forms accept it). It is not also added when the title is overridden by an extension like Translate. Maybe we'll have a better API before anyone wants to do that. If not, one could un-mark Parser::formatPageTitle() as @internal, and use that method to add the markup themselves. Bug: T306440 Change-Id: I62b17ef22de3606d736e6c261e542a34b58b5a05
2022-08-09 02:52:53 +00:00
// Create a regexp with matching groups as placeholders for the namespace, separator and main text
$pageTitleRegexp = "/^" . str_replace(
preg_quote( '(.+?)', '/' ),
'(.+?)',
preg_quote( Parser::formatPageTitle( '(.+?)', '(.+?)', '(.+?)' ), '/' )
) . "$/";
$matches = [];
if ( preg_match( $pageTitleRegexp, $text, $matches ) ) {
// The regexp above could be manipulated by malicious user input,
// sanitize the result just in case
return Sanitizer::removeSomeTags( $matches[3] );
}
$nsPrefix = $languageConverter->convertNamespace(
$this->getTitle()->getNamespace()
) . ':';
$prefix = preg_quote( $nsPrefix, '/' );
return preg_replace( "/^$prefix/i", '', $text );
}
/**
* Set the Title object to use
*
* @param PageReference $t
*/
public function setTitle( PageReference $t ) {
$t = Title::castFromPageReference( $t );
// @phan-suppress-next-next-line PhanUndeclaredMethod
// @fixme Not all implementations of IContextSource have this method!
$this->getContext()->setTitle( $t );
}
/**
* Replace the subtitle with $str
*
* @param string|Message $str New value of the subtitle. String should be safe HTML.
*/
public function setSubtitle( $str ) {
$this->clearSubtitle();
$this->addSubtitle( $str );
}
/**
* Add $str to the subtitle
*
* @param string|Message $str String or Message to add to the subtitle. String should be safe HTML.
*/
public function addSubtitle( $str ) {
if ( $str instanceof Message ) {
$this->mSubtitle[] = $str->setContext( $this->getContext() )->parse();
} else {
$this->mSubtitle[] = $str;
}
}
/**
* Build message object for a subtitle containing a backlink to a page
*
* @since 1.25
* @param PageReference $page Title to link to
* @param array $query Array of additional parameters to include in the link
* @return Message
*/
public static function buildBacklinkSubtitle( PageReference $page, $query = [] ) {
if ( $page instanceof PageRecord || $page instanceof Title ) {
// Callers will typically have a PageRecord
if ( $page->isRedirect() ) {
$query['redirect'] = 'no';
}
} elseif ( $page->getNamespace() !== NS_SPECIAL ) {
// We don't know whether it's a redirect, so add the parameter, just to be sure.
$query['redirect'] = 'no';
}
$linkRenderer = MediaWikiServices::getInstance()->getLinkRenderer();
return wfMessage( 'backlinksubtitle' )
->rawParams( $linkRenderer->makeLink( $page, null, [], $query ) );
}
/**
* Add a subtitle containing a backlink to a page
*
* @param PageReference $title Title to link to
* @param array $query Array of additional parameters to include in the link
*/
public function addBacklinkSubtitle( PageReference $title, $query = [] ) {
$this->addSubtitle( self::buildBacklinkSubtitle( $title, $query ) );
}
/**
* Clear the subtitles
*/
public function clearSubtitle() {
$this->mSubtitle = [];
}
/**
* @return string
*/
public function getSubtitle() {
return implode( "<br />\n\t\t\t\t", $this->mSubtitle );
}
/**
* Set the page as printable, i.e. it'll be displayed with all
* print styles included
*/
public function setPrintable() {
$this->mPrintable = true;
}
/**
* Return whether the page is "printable"
*
* @return bool
*/
public function isPrintable() {
return $this->mPrintable;
}
/**
* Disable output completely, i.e. calling output() will have no effect
*/
public function disable() {
$this->mDoNothing = true;
}
/**
* Return whether the output will be completely disabled
*
* @return bool
*/
public function isDisabled() {
return $this->mDoNothing;
}
/**
* Show an "add new section" link?
*
* @return bool
*/
public function showNewSectionLink() {
return $this->mNewSectionLink;
}
/**
* Forcibly hide the new section link?
*
* @return bool
*/
public function forceHideNewSectionLink() {
return $this->mHideNewSectionLink;
}
/**
* Add or remove feed links in the page header
* This is mainly kept for backward compatibility, see OutputPage::addFeedLink()
* for the new version
* @see addFeedLink()
*
* @param bool $show True: add default feeds, false: remove all feeds
*/
public function setSyndicated( $show = true ) {
if ( $show ) {
$this->setFeedAppendQuery( false );
} else {
$this->mFeedLinks = [];
}
}
/**
* Return effective list of advertised feed types
* @see addFeedLink()
*
* @return string[] Array of feed type names ( 'rss', 'atom' )
*/
protected function getAdvertisedFeedTypes() {
if ( $this->getConfig()->get( MainConfigNames::Feed ) ) {
return $this->getConfig()->get( MainConfigNames::AdvertisedFeedTypes );
} else {
return [];
}
}
/**
* Add default feeds to the page header
* This is mainly kept for backward compatibility, see OutputPage::addFeedLink()
* for the new version
* @see addFeedLink()
*
* @param string|false $val Query to append to feed links or false to output
* default links
*/
public function setFeedAppendQuery( $val ) {
$this->mFeedLinks = [];
foreach ( $this->getAdvertisedFeedTypes() as $type ) {
$query = "feed=$type";
if ( is_string( $val ) ) {
$query .= '&' . $val;
}
$this->mFeedLinks[$type] = $this->getTitle()->getLocalURL( $query );
}
}
/**
* Add a feed link to the page header
*
* @param string $format Feed type, should be a key of $wgFeedClasses
* @param string $href URL
*/
public function addFeedLink( $format, $href ) {
if ( in_array( $format, $this->getAdvertisedFeedTypes() ) ) {
$this->mFeedLinks[$format] = $href;
}
}
/**
2010-01-27 00:11:13 +00:00
* Should we output feed links for this page?
* @return bool
*/
public function isSyndicated() {
return count( $this->mFeedLinks ) > 0;
}
/**
* Return URLs for each supported syndication format for this page.
* @return array Associating format keys with URLs
*/
public function getSyndicationLinks() {
return $this->mFeedLinks;
}
/**
* Will currently always return null
*
* @return null
*/
public function getFeedAppendQuery() {
return $this->mFeedLinksAppendQuery;
}
/**
* Set whether the displayed content is related to the source of the
* corresponding article on the wiki
* Setting true will cause the change "article related" toggle to true
*
* @param bool $newVal
*/
public function setArticleFlag( $newVal ) {
$this->mIsArticle = $newVal;
if ( $newVal ) {
$this->mIsArticleRelated = $newVal;
}
}
/**
* Return whether the content displayed page is related to the source of
* the corresponding article on the wiki
*
* @return bool
*/
public function isArticle() {
return $this->mIsArticle;
}
/**
* Set whether this page is related an article on the wiki
* Setting false will cause the change of "article flag" toggle to false
*
* @param bool $newVal
*/
public function setArticleRelated( $newVal ) {
$this->mIsArticleRelated = $newVal;
if ( !$newVal ) {
$this->mIsArticle = false;
}
}
/**
* Return whether this page is related an article on the wiki
*
* @return bool
*/
public function isArticleRelated() {
return $this->mIsArticleRelated;
}
/**
* Set whether the standard copyright should be shown for the current page.
*
* @param bool $hasCopyright
*/
public function setCopyright( $hasCopyright ) {
$this->mHasCopyright = $hasCopyright;
}
/**
* Return whether the standard copyright should be shown for the current page.
* By default, it is true for all articles but other pages
* can signal it by using setCopyright( true ).
*
* Used by SkinTemplate to decided whether to show the copyright.
*
* @return bool
*/
public function showsCopyright() {
return $this->isArticle() || $this->mHasCopyright;
}
/**
* Add new language links
*
* @param string[] $newLinkArray Array of interwiki-prefixed (non DB key) titles
* (e.g. 'fr:Test page')
*/
public function addLanguageLinks( array $newLinkArray ) {
$this->mLanguageLinks = array_merge( $this->mLanguageLinks, $newLinkArray );
2004-06-01 18:29:31 +00:00
}
/**
* Reset the language links and add new language links
*
* @param string[] $newLinkArray Array of interwiki-prefixed (non DB key) titles
* (e.g. 'fr:Test page')
*/
public function setLanguageLinks( array $newLinkArray ) {
2004-06-01 18:29:31 +00:00
$this->mLanguageLinks = $newLinkArray;
}
/**
* Get the list of language links
*
* @return string[] Array of interwiki-prefixed (non DB key) titles (e.g. 'fr:Test page')
*/
public function getLanguageLinks() {
return $this->mLanguageLinks;
}
/**
* Add an array of categories, with names in the keys
*
* @param array $categories Mapping category name => sort key
*/
public function addCategoryLinks( array $categories ) {
if ( !$categories ) {
return;
}
$res = $this->addCategoryLinksToLBAndGetResult( $categories );
# Set all the values to 'normal'.
$categories = array_fill_keys( array_keys( $categories ), 'normal' );
$pageData = [];
# Mark hidden categories
foreach ( $res as $row ) {
if ( isset( $row->pp_value ) ) {
$categories[$row->page_title] = 'hidden';
}
// Page exists, cache results
if ( isset( $row->page_id ) ) {
$pageData[$row->page_title] = $row;
}
}
# Add the remaining categories to the skin
Hooks::run() call site migration Migrate all callers of Hooks::run() to use the new HookContainer/HookRunner system. General principles: * Use DI if it is already used. We're not changing the way state is managed in this patch. * HookContainer is always injected, not HookRunner. HookContainer is a service, it's a more generic interface, it is the only thing that provides isRegistered() which is needed in some cases, and a HookRunner can be efficiently constructed from it (confirmed by benchmark). Because HookContainer is needed for object construction, it is also needed by all factories. * "Ask your friendly local base class". Big hierarchies like SpecialPage and ApiBase have getHookContainer() and getHookRunner() methods in the base class, and classes that extend that base class are not expected to know or care where the base class gets its HookContainer from. * ProtectedHookAccessorTrait provides protected getHookContainer() and getHookRunner() methods, getting them from the global service container. The point of this is to ease migration to DI by ensuring that call sites ask their local friendly base class rather than getting a HookRunner from the service container directly. * Private $this->hookRunner. In some smaller classes where accessor methods did not seem warranted, there is a private HookRunner property which is accessed directly. Very rarely (two cases), there is a protected property, for consistency with code that conventionally assumes protected=private, but in cases where the class might actually be overridden, a protected accessor is preferred over a protected property. * The last resort: Hooks::runner(). Mostly for static, file-scope and global code. In a few cases it was used for objects with broken construction schemes, out of horror or laziness. Constructors with new required arguments: * AuthManager * BadFileLookup * BlockManager * ClassicInterwikiLookup * ContentHandlerFactory * ContentSecurityPolicy * DefaultOptionsManager * DerivedPageDataUpdater * FullSearchResultWidget * HtmlCacheUpdater * LanguageFactory * LanguageNameUtils * LinkRenderer * LinkRendererFactory * LocalisationCache * MagicWordFactory * MessageCache * NamespaceInfo * PageEditStash * PageHandlerFactory * PageUpdater * ParserFactory * PermissionManager * RevisionStore * RevisionStoreFactory * SearchEngineConfig * SearchEngineFactory * SearchFormWidget * SearchNearMatcher * SessionBackend * SpecialPageFactory * UserNameUtils * UserOptionsManager * WatchedItemQueryService * WatchedItemStore Constructors with new optional arguments: * DefaultPreferencesFactory * Language * LinkHolderArray * MovePage * Parser * ParserCache * PasswordReset * Router setHookContainer() now required after construction: * AuthenticationProvider * ResourceLoaderModule * SearchEngine Change-Id: Id442b0dbe43aba84bd5cf801d86dedc768b082c7
2020-03-19 02:42:09 +00:00
if ( $this->getHookRunner()->onOutputPageMakeCategoryLinks(
$this, $categories, $this->mCategoryLinks )
) {
$services = MediaWikiServices::getInstance();
$linkRenderer = $services->getLinkRenderer();
$languageConverter = $services->getLanguageConverterFactory()
->getLanguageConverter( $services->getContentLanguage() );
foreach ( $categories as $category => $type ) {
// array keys will cast numeric category names to ints, so cast back to string
$category = (string)$category;
$origcategory = $category;
if ( array_key_exists( $category, $pageData ) ) {
$title = Title::newFromRow( $pageData[$category] );
} else {
$title = Title::makeTitleSafe( NS_CATEGORY, $category );
}
if ( !$title ) {
continue;
}
$languageConverter->findVariantLink( $category, $title, true );
if ( $category != $origcategory && array_key_exists( $category, $categories ) ) {
continue;
}
$text = $languageConverter->convertHtml( $title->getText() );
$this->mCategories[$type][] = $title->getText();
$this->mCategoryLinks[$type][] = $linkRenderer->makeLink( $title, new HtmlArmor( $text ) );
}
}
2004-06-19 06:46:54 +00:00
}
/**
* @param array $categories
* @return bool|IResultWrapper
*/
protected function addCategoryLinksToLBAndGetResult( array $categories ) {
# Add the links to a LinkBatch
$arr = [ NS_CATEGORY => $categories ];
$linkBatchFactory = MediaWikiServices::getInstance()->getLinkBatchFactory();
$lb = $linkBatchFactory->newLinkBatch();
$lb->setArray( $arr );
# Fetch existence plus the hiddencat property
$dbr = wfGetDB( DB_REPLICA );
$fields = array_merge(
LinkCache::getSelectFields(),
[ 'pp_value' ]
);
$res = $dbr->newSelectQueryBuilder()
->select( $fields )
->from( 'page' )
->leftJoin( 'page_props', null, [
'pp_propname' => 'hiddencat',
'pp_page = page_id',
] )
->where( $lb->constructSet( 'page', $dbr ) )
->caller( __METHOD__ )
->fetchResultSet();
# Add the results to the link cache
$linkCache = MediaWikiServices::getInstance()->getLinkCache();
$lb->addResultToCache( $linkCache, $res );
return $res;
}
/**
* Reset the category links (but not the category list) and add $categories
*
* @param array $categories Mapping category name => sort key
*/
public function setCategoryLinks( array $categories ) {
$this->mCategoryLinks = [];
$this->addCategoryLinks( $categories );
}
/**
* Get the list of category links, in a 2-D array with the following format:
* $arr[$type][] = $link, where $type is either "normal" or "hidden" (for
* hidden categories) and $link a HTML fragment with a link to the category
* page
*
* @return string[][]
* @return-taint none
*/
public function getCategoryLinks() {
return $this->mCategoryLinks;
}
/**
* Get the list of category names this page belongs to.
*
* @param string $type The type of categories which should be returned. Possible values:
* * all: all categories of all types
* * hidden: only the hidden categories
* * normal: all categories, except hidden categories
* @return string[]
*/
public function getCategories( $type = 'all' ) {
if ( $type === 'all' ) {
$allCategories = [];
foreach ( $this->mCategories as $categories ) {
$allCategories = array_merge( $allCategories, $categories );
}
return $allCategories;
}
if ( !isset( $this->mCategories[$type] ) ) {
throw new InvalidArgumentException( 'Invalid category type given: ' . $type );
}
return $this->mCategories[$type];
2004-06-19 06:46:54 +00:00
}
Implement page status indicators Page status indicators are icons (or short text snippets) usually displayed in the top-right corner of the page, outside of the main content. Basically, <indicator name="foo">[[File:Foo.svg|20px]]</indicator> may be used on a page to place the icon in the indicator area. They are also known as top icons, page icons, heading icons or title icons. I found the discussion on bug 23796 highly illuminating. I suggest that everyone read it before suggesting different design choices. I spent some time with a thesaurus pondering the name. "Emblems" and "badges" were also considered, but the former has a much more limited meaning and the latter is already taken by Wikidata, with a similar but subtly different feature set. I am not aware of any naming conflicts ;) besides new talk page message "indicator" (used by core and Echo in some documents) and OOjs UI indicators (tiny icons like the arrow on a dropdown form element), which shouldn't be confusing. Potential use cases include: * "Lock" indicators for page protection levels * Featured/good article indicators * Redirect shortcuts display ("WP:VPT") * Links to help/manual for special pages * Coordinates?… or globe icon for inline pop-up maps Design features: * Skin-customizable. Skins can fully control where and how indicators are shown, or may just do <?php echo $this->getIndicators(); ?> to output the default structure. By default they are not shown at all. * Extension-customizable. Extensions can call ParserOutput::addIndicator() to insert an indicator from one of the numerous parser hooks. * Wiki-customizable. In addition to just using the parser functions, on-wiki styles and scripts can use the provided classes and ids (.mw-indicator, #mw-indicator-<name>) to customize their display. Design limitations: * Every indicator must have a unique identifier (name). It's not possible to create arrays, or to have several indicators with the same name. In case of duplicates, the latest occurrence of the parser function wins. * Indicators are displayed ordered by their names (and not occurrence order). This ensures consistency across pages and provides a simple means of ordering or grouping them. * Indicators are not stored, tracked or accessible outside of ParserOutput (in particular they're not in the page_props table). They are intended to merely reflect the content or metadata that is already present on the page, and not be data themselves. If you ever think you need to list pages with a given status indicator, instead figure out what it means and use the appropriate tracking category, special page report, already existing page_prop, or other means. Corresponding patch in Vector: I90a8ae15ac8275d084ea5f47b6b2684d5e6c7412. I'll implement support in the other three skins included in the tarball and document it on mediawiki.org after this is merged. Bug: 23796 Change-Id: I2389ff9a5332a2b1d033eb75f0946e5241cfaaf4
2014-09-24 10:44:16 +00:00
/**
* Add an array of indicators, with their identifiers as array
* keys and HTML contents as values.
Implement page status indicators Page status indicators are icons (or short text snippets) usually displayed in the top-right corner of the page, outside of the main content. Basically, <indicator name="foo">[[File:Foo.svg|20px]]</indicator> may be used on a page to place the icon in the indicator area. They are also known as top icons, page icons, heading icons or title icons. I found the discussion on bug 23796 highly illuminating. I suggest that everyone read it before suggesting different design choices. I spent some time with a thesaurus pondering the name. "Emblems" and "badges" were also considered, but the former has a much more limited meaning and the latter is already taken by Wikidata, with a similar but subtly different feature set. I am not aware of any naming conflicts ;) besides new talk page message "indicator" (used by core and Echo in some documents) and OOjs UI indicators (tiny icons like the arrow on a dropdown form element), which shouldn't be confusing. Potential use cases include: * "Lock" indicators for page protection levels * Featured/good article indicators * Redirect shortcuts display ("WP:VPT") * Links to help/manual for special pages * Coordinates?… or globe icon for inline pop-up maps Design features: * Skin-customizable. Skins can fully control where and how indicators are shown, or may just do <?php echo $this->getIndicators(); ?> to output the default structure. By default they are not shown at all. * Extension-customizable. Extensions can call ParserOutput::addIndicator() to insert an indicator from one of the numerous parser hooks. * Wiki-customizable. In addition to just using the parser functions, on-wiki styles and scripts can use the provided classes and ids (.mw-indicator, #mw-indicator-<name>) to customize their display. Design limitations: * Every indicator must have a unique identifier (name). It's not possible to create arrays, or to have several indicators with the same name. In case of duplicates, the latest occurrence of the parser function wins. * Indicators are displayed ordered by their names (and not occurrence order). This ensures consistency across pages and provides a simple means of ordering or grouping them. * Indicators are not stored, tracked or accessible outside of ParserOutput (in particular they're not in the page_props table). They are intended to merely reflect the content or metadata that is already present on the page, and not be data themselves. If you ever think you need to list pages with a given status indicator, instead figure out what it means and use the appropriate tracking category, special page report, already existing page_prop, or other means. Corresponding patch in Vector: I90a8ae15ac8275d084ea5f47b6b2684d5e6c7412. I'll implement support in the other three skins included in the tarball and document it on mediawiki.org after this is merged. Bug: 23796 Change-Id: I2389ff9a5332a2b1d033eb75f0946e5241cfaaf4
2014-09-24 10:44:16 +00:00
*
* In case of duplicate keys, existing values are overwritten.
*
* @note External code which calls this method should ensure that
* any indicators sourced from parsed wikitext are wrapped with
* the appropriate class; see note in ::getIndicators().
*
* @param string[] $indicators
Implement page status indicators Page status indicators are icons (or short text snippets) usually displayed in the top-right corner of the page, outside of the main content. Basically, <indicator name="foo">[[File:Foo.svg|20px]]</indicator> may be used on a page to place the icon in the indicator area. They are also known as top icons, page icons, heading icons or title icons. I found the discussion on bug 23796 highly illuminating. I suggest that everyone read it before suggesting different design choices. I spent some time with a thesaurus pondering the name. "Emblems" and "badges" were also considered, but the former has a much more limited meaning and the latter is already taken by Wikidata, with a similar but subtly different feature set. I am not aware of any naming conflicts ;) besides new talk page message "indicator" (used by core and Echo in some documents) and OOjs UI indicators (tiny icons like the arrow on a dropdown form element), which shouldn't be confusing. Potential use cases include: * "Lock" indicators for page protection levels * Featured/good article indicators * Redirect shortcuts display ("WP:VPT") * Links to help/manual for special pages * Coordinates?… or globe icon for inline pop-up maps Design features: * Skin-customizable. Skins can fully control where and how indicators are shown, or may just do <?php echo $this->getIndicators(); ?> to output the default structure. By default they are not shown at all. * Extension-customizable. Extensions can call ParserOutput::addIndicator() to insert an indicator from one of the numerous parser hooks. * Wiki-customizable. In addition to just using the parser functions, on-wiki styles and scripts can use the provided classes and ids (.mw-indicator, #mw-indicator-<name>) to customize their display. Design limitations: * Every indicator must have a unique identifier (name). It's not possible to create arrays, or to have several indicators with the same name. In case of duplicates, the latest occurrence of the parser function wins. * Indicators are displayed ordered by their names (and not occurrence order). This ensures consistency across pages and provides a simple means of ordering or grouping them. * Indicators are not stored, tracked or accessible outside of ParserOutput (in particular they're not in the page_props table). They are intended to merely reflect the content or metadata that is already present on the page, and not be data themselves. If you ever think you need to list pages with a given status indicator, instead figure out what it means and use the appropriate tracking category, special page report, already existing page_prop, or other means. Corresponding patch in Vector: I90a8ae15ac8275d084ea5f47b6b2684d5e6c7412. I'll implement support in the other three skins included in the tarball and document it on mediawiki.org after this is merged. Bug: 23796 Change-Id: I2389ff9a5332a2b1d033eb75f0946e5241cfaaf4
2014-09-24 10:44:16 +00:00
* @since 1.25
*/
public function setIndicators( array $indicators ) {
$this->mIndicators = $indicators + $this->mIndicators;
// Keep ordered by key
ksort( $this->mIndicators );
}
/**
* Get the indicators associated with this page.
*
* The array will be internally ordered by item keys.
*
* @return string[] Keys: identifiers, values: HTML contents
Implement page status indicators Page status indicators are icons (or short text snippets) usually displayed in the top-right corner of the page, outside of the main content. Basically, <indicator name="foo">[[File:Foo.svg|20px]]</indicator> may be used on a page to place the icon in the indicator area. They are also known as top icons, page icons, heading icons or title icons. I found the discussion on bug 23796 highly illuminating. I suggest that everyone read it before suggesting different design choices. I spent some time with a thesaurus pondering the name. "Emblems" and "badges" were also considered, but the former has a much more limited meaning and the latter is already taken by Wikidata, with a similar but subtly different feature set. I am not aware of any naming conflicts ;) besides new talk page message "indicator" (used by core and Echo in some documents) and OOjs UI indicators (tiny icons like the arrow on a dropdown form element), which shouldn't be confusing. Potential use cases include: * "Lock" indicators for page protection levels * Featured/good article indicators * Redirect shortcuts display ("WP:VPT") * Links to help/manual for special pages * Coordinates?… or globe icon for inline pop-up maps Design features: * Skin-customizable. Skins can fully control where and how indicators are shown, or may just do <?php echo $this->getIndicators(); ?> to output the default structure. By default they are not shown at all. * Extension-customizable. Extensions can call ParserOutput::addIndicator() to insert an indicator from one of the numerous parser hooks. * Wiki-customizable. In addition to just using the parser functions, on-wiki styles and scripts can use the provided classes and ids (.mw-indicator, #mw-indicator-<name>) to customize their display. Design limitations: * Every indicator must have a unique identifier (name). It's not possible to create arrays, or to have several indicators with the same name. In case of duplicates, the latest occurrence of the parser function wins. * Indicators are displayed ordered by their names (and not occurrence order). This ensures consistency across pages and provides a simple means of ordering or grouping them. * Indicators are not stored, tracked or accessible outside of ParserOutput (in particular they're not in the page_props table). They are intended to merely reflect the content or metadata that is already present on the page, and not be data themselves. If you ever think you need to list pages with a given status indicator, instead figure out what it means and use the appropriate tracking category, special page report, already existing page_prop, or other means. Corresponding patch in Vector: I90a8ae15ac8275d084ea5f47b6b2684d5e6c7412. I'll implement support in the other three skins included in the tarball and document it on mediawiki.org after this is merged. Bug: 23796 Change-Id: I2389ff9a5332a2b1d033eb75f0946e5241cfaaf4
2014-09-24 10:44:16 +00:00
* @since 1.25
*/
public function getIndicators() {
// Note that some -- but not all -- indicators will be wrapped
// with a class appropriate for user-generated wikitext content
// (usually .mw-parser-output). The exceptions would be an
// indicator added via ::addHelpLink() below, which adds content
// which don't come from the parser and is not user-generated;
// and any indicators added by extensions which may call
// OutputPage::setIndicators() directly. In the latter case the
// caller is responsible for wrapping any parser-generated
// indicators.
Implement page status indicators Page status indicators are icons (or short text snippets) usually displayed in the top-right corner of the page, outside of the main content. Basically, <indicator name="foo">[[File:Foo.svg|20px]]</indicator> may be used on a page to place the icon in the indicator area. They are also known as top icons, page icons, heading icons or title icons. I found the discussion on bug 23796 highly illuminating. I suggest that everyone read it before suggesting different design choices. I spent some time with a thesaurus pondering the name. "Emblems" and "badges" were also considered, but the former has a much more limited meaning and the latter is already taken by Wikidata, with a similar but subtly different feature set. I am not aware of any naming conflicts ;) besides new talk page message "indicator" (used by core and Echo in some documents) and OOjs UI indicators (tiny icons like the arrow on a dropdown form element), which shouldn't be confusing. Potential use cases include: * "Lock" indicators for page protection levels * Featured/good article indicators * Redirect shortcuts display ("WP:VPT") * Links to help/manual for special pages * Coordinates?… or globe icon for inline pop-up maps Design features: * Skin-customizable. Skins can fully control where and how indicators are shown, or may just do <?php echo $this->getIndicators(); ?> to output the default structure. By default they are not shown at all. * Extension-customizable. Extensions can call ParserOutput::addIndicator() to insert an indicator from one of the numerous parser hooks. * Wiki-customizable. In addition to just using the parser functions, on-wiki styles and scripts can use the provided classes and ids (.mw-indicator, #mw-indicator-<name>) to customize their display. Design limitations: * Every indicator must have a unique identifier (name). It's not possible to create arrays, or to have several indicators with the same name. In case of duplicates, the latest occurrence of the parser function wins. * Indicators are displayed ordered by their names (and not occurrence order). This ensures consistency across pages and provides a simple means of ordering or grouping them. * Indicators are not stored, tracked or accessible outside of ParserOutput (in particular they're not in the page_props table). They are intended to merely reflect the content or metadata that is already present on the page, and not be data themselves. If you ever think you need to list pages with a given status indicator, instead figure out what it means and use the appropriate tracking category, special page report, already existing page_prop, or other means. Corresponding patch in Vector: I90a8ae15ac8275d084ea5f47b6b2684d5e6c7412. I'll implement support in the other three skins included in the tarball and document it on mediawiki.org after this is merged. Bug: 23796 Change-Id: I2389ff9a5332a2b1d033eb75f0946e5241cfaaf4
2014-09-24 10:44:16 +00:00
return $this->mIndicators;
}
/**
* Adds help link with an icon via page indicators.
* Link target can be overridden by a local message containing a wikilink:
* the message key is: lowercase action or special page name + '-helppage'.
* @param string $to Target MediaWiki.org page title or encoded URL.
* @param bool $overrideBaseUrl Whether $url is a full URL, to avoid MW.o.
* @since 1.25
*/
public function addHelpLink( $to, $overrideBaseUrl = false ) {
$this->addModuleStyles( 'mediawiki.helplink' );
$text = $this->msg( 'helppage-top-gethelp' )->escaped();
if ( $overrideBaseUrl ) {
$helpUrl = $to;
} else {
$toUrlencoded = wfUrlencode( str_replace( ' ', '_', $to ) );
$helpUrl = "https://www.mediawiki.org/wiki/Special:MyLanguage/$toUrlencoded";
}
$link = Html::rawElement(
'a',
[
'href' => $helpUrl,
'target' => '_blank',
'class' => 'mw-helplink',
],
$text
);
// See note in ::getIndicators() above -- unlike wikitext-generated
// indicators which come from ParserOutput, this indicator will not
// be wrapped.
$this->setIndicators( [ 'mw-helplink' => $link ] );
}
/**
* Do not allow scripts which can be modified by wiki users to load on this page;
* only allow scripts bundled with, or generated by, the software.
* Site-wide styles are controlled by a config setting, since they can be
* used to create a custom skin/theme, but not user-specific ones.
*
* @todo this should be given a more accurate name
*/
public function disallowUserJs() {
$this->reduceAllowedModules(
RL\Module::TYPE_SCRIPTS,
RL\Module::ORIGIN_CORE_INDIVIDUAL
);
// Site-wide styles are controlled by a config setting, see T73621
// for background on why. User styles are never allowed.
if ( $this->getConfig()->get( MainConfigNames::AllowSiteCSSOnRestrictedPages ) ) {
$styleOrigin = RL\Module::ORIGIN_USER_SITEWIDE;
} else {
$styleOrigin = RL\Module::ORIGIN_CORE_INDIVIDUAL;
}
$this->reduceAllowedModules(
RL\Module::TYPE_STYLES,
$styleOrigin
);
}
/**
* Show what level of JavaScript / CSS untrustworthiness is allowed on this page
* @see RL\Module::$origin
* @param string $type RL\Module TYPE_ constant
* @return int Module ORIGIN_ class constant
*/
public function getAllowedModules( $type ) {
if ( $type == RL\Module::TYPE_COMBINED ) {
return min( array_values( $this->mAllowedModules ) );
} else {
return $this->mAllowedModules[$type] ?? RL\Module::ORIGIN_ALL;
}
}
/**
* Limit the highest level of CSS/JS untrustworthiness allowed.
*
* If passed the same or a higher level than the current level of untrustworthiness set, the
* level will remain unchanged.
*
* @param string $type
* @param int $level RL\Module class constant
*/
public function reduceAllowedModules( $type, $level ) {
$this->mAllowedModules[$type] = min( $this->getAllowedModules( $type ), $level );
}
/**
* Prepend $text to the body HTML
*
* @param string $text HTML
*/
public function prependHTML( $text ) {
$this->mBodytext = $text . $this->mBodytext;
}
/**
* Append $text to the body HTML
*
* @param string $text HTML
*/
public function addHTML( $text ) {
$this->mBodytext .= $text;
}
/**
* Shortcut for adding an Html::element via addHTML.
*
* @since 1.19
*
* @param string $element
* @param array $attribs
* @param string $contents
*/
public function addElement( $element, array $attribs = [], $contents = '' ) {
$this->addHTML( Html::element( $element, $attribs, $contents ) );
}
/**
* Clear the body HTML
*/
public function clearHTML() {
$this->mBodytext = '';
}
/**
* Get the body HTML
*
* @return string HTML
*/
public function getHTML() {
return $this->mBodytext;
}
/**
* Get/set the ParserOptions object to use for wikitext parsing
*
* @return ParserOptions
*/
public function parserOptions() {
Merged localisation-work branch: * Made lines from initialiseMessages() appear as list items during installation * Moved the bulk of the localisation data from the Language*.php files to the Messages*.php files. Deleted most of the Languages*.php files. * Introduced "stub global" framework to provide deferred initialisation of core modules. * Removed placeholder values for $wgTitle and $wgArticle, these variables will now be null during the initialisation process, until they are set by index.php or another entry point. * Added DBA cache type, for BDB-style caches. * Removed custom date format functions, replacing them with a format string in the style of PHP's date(). Used string identifiers instead of integer identifiers, in both the language files and user preferences. Migration should be transparent in most cases. * Simplified the initialisation API for LoadBalancer objects. * Removed the broken altencoding feature. * Moved default user options and toggles from Language to User. Language objects are still able to define default preference overrides and extra user toggles, via a slightly different interface. * Don't include the date option in the parser cache rendering hash unless $wgUseDynamicDates is enabled. * Merged LanguageUtf8 with Language. Removed LanguageUtf8.php. * Removed inclusion of language files from the bottom of Language.php. This is now consistently done from Language::factory(). * Add the name of the executing maintenance script to the debug log. Start the profiler during maintenance scripts. * Added "serialized" directory, for storing precompiled data in serialized form.
2006-07-26 07:15:39 +00:00
if ( !$this->mParserOptions ) {
if ( !$this->getUser()->isSafeToLoad() ) {
// Context user isn't unstubbable yet, so don't try to get a
// ParserOptions for it. And don't cache this ParserOptions
// either.
$po = ParserOptions::newFromAnon();
$po->setAllowUnsafeRawHtml( false );
return $po;
}
$this->mParserOptions = ParserOptions::newFromContext( $this->getContext() );
$this->mParserOptions->setAllowUnsafeRawHtml( false );
Merged localisation-work branch: * Made lines from initialiseMessages() appear as list items during installation * Moved the bulk of the localisation data from the Language*.php files to the Messages*.php files. Deleted most of the Languages*.php files. * Introduced "stub global" framework to provide deferred initialisation of core modules. * Removed placeholder values for $wgTitle and $wgArticle, these variables will now be null during the initialisation process, until they are set by index.php or another entry point. * Added DBA cache type, for BDB-style caches. * Removed custom date format functions, replacing them with a format string in the style of PHP's date(). Used string identifiers instead of integer identifiers, in both the language files and user preferences. Migration should be transparent in most cases. * Simplified the initialisation API for LoadBalancer objects. * Removed the broken altencoding feature. * Moved default user options and toggles from Language to User. Language objects are still able to define default preference overrides and extra user toggles, via a slightly different interface. * Don't include the date option in the parser cache rendering hash unless $wgUseDynamicDates is enabled. * Merged LanguageUtf8 with Language. Removed LanguageUtf8.php. * Removed inclusion of language files from the bottom of Language.php. This is now consistently done from Language::factory(). * Add the name of the executing maintenance script to the debug log. Start the profiler during maintenance scripts. * Added "serialized" directory, for storing precompiled data in serialized form.
2006-07-26 07:15:39 +00:00
}
return $this->mParserOptions;
}
2006-01-07 13:31:29 +00:00
/**
* Set the revision ID which will be seen by the wiki text parser
* for things such as embedded {{REVISIONID}} variable use.
*
* @param int|null $revid A positive integer, or null
* @return mixed Previous value
*/
public function setRevisionId( $revid ) {
$val = $revid === null ? null : intval( $revid );
return wfSetVar( $this->mRevisionId, $val, true );
}
here it is ... the upload-api, script-server, js2 (javascript phase2) branch merge 1st attempt. Here is a short overview of changes and associated default configuration variables (most everything is off by default) also see ~soon to be updated~: http://www.mediawiki.org/wiki/Media_Projects_Overview = Upload Improvements = ==Upload API == * Based on the early work of Bryan Tong and others it adds the upload option to the api. * We rewrite Special:Upload page to include use the new refactoring * Added in token checks in both the SpecialUpload.php page so avoids DOS / xss copy-by-url JavaScript based cross site POST file submissions == Copy by URL== $wgAllowCopyUploads = false; * http class rewrite includes a new http background download see: includes/HttpFunctions.php * spins off a php process that calls: maintenance/http_session_download.php * pushes updates to the session and gives the user a progress bar on http copy uploads from other server progress (using js2 upload interface) (if not using the js2 upload interface it does the request in-place but the download is limited to the php ini timeout time) == Firefogg == * Firefogg enables resumable upload by chunks * progress indicators and conditional invokation (js2 system) * and of-course client side transcoding. = Script Server = $wgEnableScriptLoader = false; * off by default if $wgEnableScriptLoader is turned on script files are grouped, gziped, cached etc. for more info see: http://www.mediawiki.org/wiki/Extension:ScriptLoader * Includes some early skin js include fixes (skin/script system still lots of love) * Includes a "javascript class autoloader" this is packaged into mwEmbed so that the mwEmbed library can work in stand alone mode (while retaining localization and script serving) (one such application is the make page for firefogg.org : http://www.firefogg.org/make/index.html ) * The file that contains the autojavascript loading classes is: js2/php/jsAutoloadLocalClasses.php * One can use this auto class loading dependency system with extensions and add-ons but I need to better document that. = js2 system / mwEmbed= $wgEnableJS2system = false * includes initial rewrite towards more jquery based javascript code * especially for the Special:Upload page. * Also the edit page include support for the "add-media-wizard" * includes dependency loader for javascript that optionally takes advantage of the script-loader * remote embedding of javascript interfaces (like embedding video, or commons media searching) * $wgDebugJavaScript = false; .. .this variable lets you always get "always fresh javascript". When used with the script-loader it does not minify the script-loader output. = mwEmbed = * Will commit a separate patch to oggHandler that conditionally outputs <video tag> to use the new javascript video player. ** mv_embed player includes: play-head, volume control, remote embedding, oggz-chop support across plugins. * add-media-wizard adds easy inserts of media to pages (with import) == jQuery== * we include a base install of jQuery, jQuery ui and some plugins. * all the javascript classes are in the scriptloader so its easy to load any set of jquery ui components that you may need using the script-server. You get a callback so you can then execute js with dependencies loaded. == other stuff == there is a bit more code in js2 that pertains to sequence editing, timed text display and basic image editing. We include a base import of pixastic-lib & pixastic-editor... will work with the pixastic developer to try and ensure upstream compatibility on our usage of the library for in-browser photo and sequence manipulation.
2009-07-14 23:52:14 +00:00
/**
* Get the displayed revision ID
*
* @return int|null
*/
2008-08-11 13:23:45 +00:00
public function getRevisionId() {
return $this->mRevisionId;
}
/**
* Set whether the revision displayed (as set in ::setRevisionId())
* is the latest revision of the page.
*
* @param bool $isCurrent
*/
public function setRevisionIsCurrent( bool $isCurrent ): void {
$this->mRevisionIsCurrent = $isCurrent;
}
/**
* Whether the revision displayed is the latest revision of the page
*
* @since 1.34
* @return bool
*/
public function isRevisionCurrent(): bool {
return $this->mRevisionId == 0 || (
$this->mRevisionIsCurrent ?? (
$this->mRevisionId == $this->getTitle()->getLatestRevID()
)
);
}
/**
* Set the timestamp of the revision which will be displayed. This is used
* to avoid a extra DB call in Skin::lastModified().
*
* @param string|null $timestamp
* @return mixed Previous value
*/
public function setRevisionTimestamp( $timestamp ) {
return wfSetVar( $this->mRevisionTimestamp, $timestamp, true );
}
/**
* Get the timestamp of displayed revision.
* This will be null if not filled by setRevisionTimestamp().
*
* @return string|null
*/
public function getRevisionTimestamp() {
return $this->mRevisionTimestamp;
}
/**
* Set the displayed file version
*
* @param File|null $file
* @return mixed Previous value
*/
public function setFileVersion( $file ) {
$val = null;
if ( $file instanceof File && $file->exists() ) {
$val = [ 'time' => $file->getTimestamp(), 'sha1' => $file->getSha1() ];
}
return wfSetVar( $this->mFileVersion, $val, true );
}
/**
* Get the displayed file version
*
* @return array|null ('time' => MW timestamp, 'sha1' => sha1)
*/
public function getFileVersion() {
return $this->mFileVersion;
}
/**
* Get the templates used on this page
*
* @return array (namespace => dbKey => revId)
* @since 1.18
*/
public function getTemplateIds() {
return $this->mTemplateIds;
}
/**
* Get the files used on this page
*
* @return array [ dbKey => [ 'time' => MW timestamp or null, 'sha1' => sha1 or '' ] ]
* @since 1.18
*/
public function getFileSearchOptions() {
return $this->mImageTimeKeys;
}
/**
* Convert wikitext *in the user interface language* to HTML and
* add it to the buffer. The result will not be
* language-converted, as user interface messages are already
* localized into a specific variant. Assumes that the current
* page title will be used if optional $title is not
* provided. Output will be tidy.
*
* @param string $text Wikitext in the user interface language
* @param bool $linestart Is this the start of a line? (Defaults to true)
* @param PageReference|null $title Optional title to use; default of `null`
* means use current page title.
* @throws MWException if $title is not provided and OutputPage::getTitle()
* is null
* @since 1.32
*/
public function addWikiTextAsInterface(
$text, $linestart = true, PageReference $title = null
) {
$title ??= $this->getTitle();
if ( !$title ) {
throw new MWException( 'Title is null' );
}
$this->addWikiTextTitleInternal( $text, $title, $linestart, /*interface*/true );
}
/**
* Convert wikitext *in the user interface language* to HTML and
* add it to the buffer with a `<div class="$wrapperClass">`
* wrapper. The result will not be language-converted, as user
* interface messages as already localized into a specific
* variant. The $text will be parsed in start-of-line context.
* Output will be tidy.
*
* @param string $wrapperClass The class attribute value for the <div>
* wrapper in the output HTML
* @param string $text Wikitext in the user interface language
* @since 1.32
*/
public function wrapWikiTextAsInterface(
$wrapperClass, $text
) {
$this->addWikiTextTitleInternal(
$text, $this->getTitle(),
/*linestart*/true, /*interface*/true,
$wrapperClass
);
}
/**
* Convert wikitext *in the page content language* to HTML and add
* it to the buffer. The result with be language-converted to the
* user's preferred variant. Assumes that the current page title
* will be used if optional $title is not provided. Output will be
* tidy.
*
* @param string $text Wikitext in the page content language
* @param bool $linestart Is this the start of a line? (Defaults to true)
* @param PageReference|null $title Optional title to use; default of `null`
* means use current page title.
* @throws MWException if $title is not provided and OutputPage::getTitle()
* is null
* @since 1.32
*/
public function addWikiTextAsContent(
$text, $linestart = true, PageReference $title = null
) {
$title ??= $this->getTitle();
if ( !$title ) {
throw new MWException( 'Title is null' );
}
$this->addWikiTextTitleInternal( $text, $title, $linestart, /*interface*/false );
}
/**
* Add wikitext with a custom Title object.
* Output is unwrapped.
*
* @param string $text Wikitext
* @param PageReference $title
* @param bool $linestart Is this the start of a line?@param
* @param bool $interface Whether it is an interface message
* (for example disables conversion)
* @param string|null $wrapperClass if not empty, wraps the output in
* a `<div class="$wrapperClass">`
*/
private function addWikiTextTitleInternal(
$text, PageReference $title, $linestart, $interface, $wrapperClass = null
) {
$parserOutput = $this->parseInternal(
$text, $title, $linestart, $interface
);
$this->addParserOutput( $parserOutput, [
'enableSectionEditLinks' => false,
'wrapperDivClass' => $wrapperClass ?? '',
] );
2006-01-01 20:08:08 +00:00
}
/**
Generate/set/get TOCData/SectionMetadata objects instead of arrays * ParserOutput::setSections()/::getSections() are expected to be deprecated. Uses in extensions and skins will need to be migrated in follow up patches once the new interface has stabilized. * In the skins code, the metadata is converted back to an array. Downstream skin TOC consumers will need to be migrated as well before we can remove the toLegacy() conversion. * Fixed SerializationTestTrait's validation method - Not sure if this is overkill but should handle all future complex objects we might stuff into the ParserCache. * This patch emits a backward-compatible Sections property in order to avoid changing the parser cache serialization format. T327439 has been filed to eventually use the JsonCodec support for object serialization, but for this initial patch it makes sense to avoid the need for a concurrent ParserCache format migration by using a backward-compatible serialization. * TOCData is nullable because the intent is that ParserOutput::setTOCData() is MW_MERGE_STRATEGY_WRITE_ONCE; that is, only the top-level fragment composing a page will set the TOCData. This will be enforced in the future via wfDeprecated() (T327429), but again our first patch is as backward-compatible as possible. Bug: T296025 Depends-On: I1b267d23cf49d147c5379b914531303744481b68 Co-Authored-By: C. Scott Ananian <cananian@wikimedia.org> Co-Authored-By: Subramanya Sastry <ssastry@wikimedia.org> Change-Id: I8329864535f0b1dd5f9163868a08d6cb1ffcb78f
2022-09-01 23:07:29 +00:00
* Adds Table of Contents data to OutputPage from ParserOutput
* @param TOCData $tocData
* @internal For use by Article.php
*/
Generate/set/get TOCData/SectionMetadata objects instead of arrays * ParserOutput::setSections()/::getSections() are expected to be deprecated. Uses in extensions and skins will need to be migrated in follow up patches once the new interface has stabilized. * In the skins code, the metadata is converted back to an array. Downstream skin TOC consumers will need to be migrated as well before we can remove the toLegacy() conversion. * Fixed SerializationTestTrait's validation method - Not sure if this is overkill but should handle all future complex objects we might stuff into the ParserCache. * This patch emits a backward-compatible Sections property in order to avoid changing the parser cache serialization format. T327439 has been filed to eventually use the JsonCodec support for object serialization, but for this initial patch it makes sense to avoid the need for a concurrent ParserCache format migration by using a backward-compatible serialization. * TOCData is nullable because the intent is that ParserOutput::setTOCData() is MW_MERGE_STRATEGY_WRITE_ONCE; that is, only the top-level fragment composing a page will set the TOCData. This will be enforced in the future via wfDeprecated() (T327429), but again our first patch is as backward-compatible as possible. Bug: T296025 Depends-On: I1b267d23cf49d147c5379b914531303744481b68 Co-Authored-By: C. Scott Ananian <cananian@wikimedia.org> Co-Authored-By: Subramanya Sastry <ssastry@wikimedia.org> Change-Id: I8329864535f0b1dd5f9163868a08d6cb1ffcb78f
2022-09-01 23:07:29 +00:00
public function setTOCData( TOCData $tocData ) {
$this->tocData = $tocData;
}
/**
Generate/set/get TOCData/SectionMetadata objects instead of arrays * ParserOutput::setSections()/::getSections() are expected to be deprecated. Uses in extensions and skins will need to be migrated in follow up patches once the new interface has stabilized. * In the skins code, the metadata is converted back to an array. Downstream skin TOC consumers will need to be migrated as well before we can remove the toLegacy() conversion. * Fixed SerializationTestTrait's validation method - Not sure if this is overkill but should handle all future complex objects we might stuff into the ParserCache. * This patch emits a backward-compatible Sections property in order to avoid changing the parser cache serialization format. T327439 has been filed to eventually use the JsonCodec support for object serialization, but for this initial patch it makes sense to avoid the need for a concurrent ParserCache format migration by using a backward-compatible serialization. * TOCData is nullable because the intent is that ParserOutput::setTOCData() is MW_MERGE_STRATEGY_WRITE_ONCE; that is, only the top-level fragment composing a page will set the TOCData. This will be enforced in the future via wfDeprecated() (T327429), but again our first patch is as backward-compatible as possible. Bug: T296025 Depends-On: I1b267d23cf49d147c5379b914531303744481b68 Co-Authored-By: C. Scott Ananian <cananian@wikimedia.org> Co-Authored-By: Subramanya Sastry <ssastry@wikimedia.org> Change-Id: I8329864535f0b1dd5f9163868a08d6cb1ffcb78f
2022-09-01 23:07:29 +00:00
* @internal For usage in Skin::getTOCData() only.
* @return ?TOCData Table of Contents data, or
* null if OutputPage::setTOCData() has not been called.
*/
Generate/set/get TOCData/SectionMetadata objects instead of arrays * ParserOutput::setSections()/::getSections() are expected to be deprecated. Uses in extensions and skins will need to be migrated in follow up patches once the new interface has stabilized. * In the skins code, the metadata is converted back to an array. Downstream skin TOC consumers will need to be migrated as well before we can remove the toLegacy() conversion. * Fixed SerializationTestTrait's validation method - Not sure if this is overkill but should handle all future complex objects we might stuff into the ParserCache. * This patch emits a backward-compatible Sections property in order to avoid changing the parser cache serialization format. T327439 has been filed to eventually use the JsonCodec support for object serialization, but for this initial patch it makes sense to avoid the need for a concurrent ParserCache format migration by using a backward-compatible serialization. * TOCData is nullable because the intent is that ParserOutput::setTOCData() is MW_MERGE_STRATEGY_WRITE_ONCE; that is, only the top-level fragment composing a page will set the TOCData. This will be enforced in the future via wfDeprecated() (T327429), but again our first patch is as backward-compatible as possible. Bug: T296025 Depends-On: I1b267d23cf49d147c5379b914531303744481b68 Co-Authored-By: C. Scott Ananian <cananian@wikimedia.org> Co-Authored-By: Subramanya Sastry <ssastry@wikimedia.org> Change-Id: I8329864535f0b1dd5f9163868a08d6cb1ffcb78f
2022-09-01 23:07:29 +00:00
public function getTOCData(): ?TOCData {
return $this->tocData;
}
/**
* Add all metadata associated with a ParserOutput object, but without the actual HTML. This
* includes categories, language links, ResourceLoader modules, effects of certain magic words,
* and so on. It does *not* include section information.
*
* @since 1.24
* @param ParserOutput $parserOutput
*/
public function addParserOutputMetadata( ParserOutput $parserOutput ) {
// T301020 This should eventually use the standard "merge ParserOutput"
// function between $parserOutput and $this->metadata.
$this->mLanguageLinks =
array_merge( $this->mLanguageLinks, $parserOutput->getLanguageLinks() );
$this->addCategoryLinks( $parserOutput->getCategories() );
// Parser-generated indicators get wrapped like other parser output.
$wrapClass = $parserOutput->getWrapperDivClass();
$result = [];
foreach ( $parserOutput->getIndicators() as $name => $html ) {
if ( $html !== '' && $wrapClass !== '' ) {
$html = Html::rawElement( 'div', [ 'class' => $wrapClass ], $html );
}
$result[$name] = $html;
}
$this->setIndicators( $result );
Generate/set/get TOCData/SectionMetadata objects instead of arrays * ParserOutput::setSections()/::getSections() are expected to be deprecated. Uses in extensions and skins will need to be migrated in follow up patches once the new interface has stabilized. * In the skins code, the metadata is converted back to an array. Downstream skin TOC consumers will need to be migrated as well before we can remove the toLegacy() conversion. * Fixed SerializationTestTrait's validation method - Not sure if this is overkill but should handle all future complex objects we might stuff into the ParserCache. * This patch emits a backward-compatible Sections property in order to avoid changing the parser cache serialization format. T327439 has been filed to eventually use the JsonCodec support for object serialization, but for this initial patch it makes sense to avoid the need for a concurrent ParserCache format migration by using a backward-compatible serialization. * TOCData is nullable because the intent is that ParserOutput::setTOCData() is MW_MERGE_STRATEGY_WRITE_ONCE; that is, only the top-level fragment composing a page will set the TOCData. This will be enforced in the future via wfDeprecated() (T327429), but again our first patch is as backward-compatible as possible. Bug: T296025 Depends-On: I1b267d23cf49d147c5379b914531303744481b68 Co-Authored-By: C. Scott Ananian <cananian@wikimedia.org> Co-Authored-By: Subramanya Sastry <ssastry@wikimedia.org> Change-Id: I8329864535f0b1dd5f9163868a08d6cb1ffcb78f
2022-09-01 23:07:29 +00:00
$tocData = $parserOutput->getTOCData();
if ( $tocData !== null ) {
$this->setTOCData( $tocData );
}
// FIXME: Best practice is for OutputPage to be an accumulator, as
// addParserOutputMetadata() may be called multiple times, but the
// following lines overwrite any previous data. These should
// be migrated to an injection pattern. (T301020, T300979)
$this->mNewSectionLink = $parserOutput->getNewSection();
$this->mHideNewSectionLink = $parserOutput->getHideNewSection();
$this->mNoGallery = $parserOutput->getNoGallery();
if ( !$parserOutput->isCacheable() ) {
$this->disableClientCache();
}
$this->mHeadItems = array_merge( $this->mHeadItems, $parserOutput->getHeadItems() );
$this->addModules( $parserOutput->getModules() );
$this->addModuleStyles( $parserOutput->getModuleStyles() );
$this->addJsConfigVars( $parserOutput->getJsConfigVars() );
$this->mPreventClickjacking = $this->mPreventClickjacking
|| $parserOutput->getPreventClickjacking();
$scriptSrcs = $parserOutput->getExtraCSPScriptSrcs();
foreach ( $scriptSrcs as $src ) {
$this->getCSP()->addScriptSrc( $src );
}
$defaultSrcs = $parserOutput->getExtraCSPDefaultSrcs();
foreach ( $defaultSrcs as $src ) {
$this->getCSP()->addDefaultSrc( $src );
}
$styleSrcs = $parserOutput->getExtraCSPStyleSrcs();
foreach ( $styleSrcs as $src ) {
$this->getCSP()->addStyleSrc( $src );
}
// If $wgImagePreconnect is true, and if the output contains images, give the user-agent
// a hint about a remote hosts from which images may be served. Launched in T123582.
if ( $this->getConfig()->get( MainConfigNames::ImagePreconnect ) && count( $parserOutput->getImages() ) ) {
$preconnect = [];
// Optimization: Instead of processing each image, assume that wikis either serve both
// foreign and local from the same remote hostname (e.g. public wikis at WMF), or that
// foreign images are common enough to be worth the preconnect (e.g. private wikis).
$repoGroup = MediaWikiServices::getInstance()->getRepoGroup();
$repoGroup->forEachForeignRepo( static function ( $repo ) use ( &$preconnect ) {
$preconnect[] = $repo->getZoneUrl( 'thumb' );
} );
// Consider both foreign and local repos. While LocalRepo by default uses a relative
// path on the same domain, wiki farms may configure it to use a dedicated hostname.
$preconnect[] = $repoGroup->getLocalRepo()->getZoneUrl( 'thumb' );
foreach ( $preconnect as $url ) {
$host = parse_url( $url, PHP_URL_HOST );
// It is expected that file URLs are often path-only, without hostname (T317329).
if ( $host ) {
$this->addLink( [ 'rel' => 'preconnect', 'href' => '//' . $host ] );
break;
}
}
}
// Template versioning...
foreach ( (array)$parserOutput->getTemplateIds() as $ns => $dbks ) {
if ( isset( $this->mTemplateIds[$ns] ) ) {
$this->mTemplateIds[$ns] = $dbks + $this->mTemplateIds[$ns];
} else {
$this->mTemplateIds[$ns] = $dbks;
}
}
// File versioning...
foreach ( (array)$parserOutput->getFileSearchOptions() as $dbk => $data ) {
$this->mImageTimeKeys[$dbk] = $data;
}
// Hooks registered in the object
// Deprecated! See T292321; should be done in the OutputPageParserOutput
// hook instead.
$parserOutputHooks = $this->getConfig()->get( MainConfigNames::ParserOutputHooks );
foreach ( $parserOutput->getOutputHooks() as $hookInfo ) {
[ $hookName, $data ] = $hookInfo;
if ( isset( $parserOutputHooks[$hookName] ) ) {
$parserOutputHooks[$hookName]( $this, $parserOutput, $data );
}
}
// Enable OOUI if requested via ParserOutput
if ( $parserOutput->getEnableOOUI() ) {
$this->enableOOUI();
}
// Include parser limit report
// FIXME: This should append, rather than overwrite, or else this
// data should be injected into the OutputPage like is done for the
Generate/set/get TOCData/SectionMetadata objects instead of arrays * ParserOutput::setSections()/::getSections() are expected to be deprecated. Uses in extensions and skins will need to be migrated in follow up patches once the new interface has stabilized. * In the skins code, the metadata is converted back to an array. Downstream skin TOC consumers will need to be migrated as well before we can remove the toLegacy() conversion. * Fixed SerializationTestTrait's validation method - Not sure if this is overkill but should handle all future complex objects we might stuff into the ParserCache. * This patch emits a backward-compatible Sections property in order to avoid changing the parser cache serialization format. T327439 has been filed to eventually use the JsonCodec support for object serialization, but for this initial patch it makes sense to avoid the need for a concurrent ParserCache format migration by using a backward-compatible serialization. * TOCData is nullable because the intent is that ParserOutput::setTOCData() is MW_MERGE_STRATEGY_WRITE_ONCE; that is, only the top-level fragment composing a page will set the TOCData. This will be enforced in the future via wfDeprecated() (T327429), but again our first patch is as backward-compatible as possible. Bug: T296025 Depends-On: I1b267d23cf49d147c5379b914531303744481b68 Co-Authored-By: C. Scott Ananian <cananian@wikimedia.org> Co-Authored-By: Subramanya Sastry <ssastry@wikimedia.org> Change-Id: I8329864535f0b1dd5f9163868a08d6cb1ffcb78f
2022-09-01 23:07:29 +00:00
// other page-level things (like OutputPage::setTOCData()).
if ( !$this->limitReportJSData ) {
$this->limitReportJSData = $parserOutput->getLimitReportJSData();
}
// Link flags are ignored for now, but may in the future be
// used to mark individual language links.
$linkFlags = [];
Hooks::run() call site migration Migrate all callers of Hooks::run() to use the new HookContainer/HookRunner system. General principles: * Use DI if it is already used. We're not changing the way state is managed in this patch. * HookContainer is always injected, not HookRunner. HookContainer is a service, it's a more generic interface, it is the only thing that provides isRegistered() which is needed in some cases, and a HookRunner can be efficiently constructed from it (confirmed by benchmark). Because HookContainer is needed for object construction, it is also needed by all factories. * "Ask your friendly local base class". Big hierarchies like SpecialPage and ApiBase have getHookContainer() and getHookRunner() methods in the base class, and classes that extend that base class are not expected to know or care where the base class gets its HookContainer from. * ProtectedHookAccessorTrait provides protected getHookContainer() and getHookRunner() methods, getting them from the global service container. The point of this is to ease migration to DI by ensuring that call sites ask their local friendly base class rather than getting a HookRunner from the service container directly. * Private $this->hookRunner. In some smaller classes where accessor methods did not seem warranted, there is a private HookRunner property which is accessed directly. Very rarely (two cases), there is a protected property, for consistency with code that conventionally assumes protected=private, but in cases where the class might actually be overridden, a protected accessor is preferred over a protected property. * The last resort: Hooks::runner(). Mostly for static, file-scope and global code. In a few cases it was used for objects with broken construction schemes, out of horror or laziness. Constructors with new required arguments: * AuthManager * BadFileLookup * BlockManager * ClassicInterwikiLookup * ContentHandlerFactory * ContentSecurityPolicy * DefaultOptionsManager * DerivedPageDataUpdater * FullSearchResultWidget * HtmlCacheUpdater * LanguageFactory * LanguageNameUtils * LinkRenderer * LinkRendererFactory * LocalisationCache * MagicWordFactory * MessageCache * NamespaceInfo * PageEditStash * PageHandlerFactory * PageUpdater * ParserFactory * PermissionManager * RevisionStore * RevisionStoreFactory * SearchEngineConfig * SearchEngineFactory * SearchFormWidget * SearchNearMatcher * SessionBackend * SpecialPageFactory * UserNameUtils * UserOptionsManager * WatchedItemQueryService * WatchedItemStore Constructors with new optional arguments: * DefaultPreferencesFactory * Language * LinkHolderArray * MovePage * Parser * ParserCache * PasswordReset * Router setHookContainer() now required after construction: * AuthenticationProvider * ResourceLoaderModule * SearchEngine Change-Id: Id442b0dbe43aba84bd5cf801d86dedc768b082c7
2020-03-19 02:42:09 +00:00
$this->getHookRunner()->onLanguageLinks( $this->getTitle(), $this->mLanguageLinks, $linkFlags );
Hooks::run() call site migration Migrate all callers of Hooks::run() to use the new HookContainer/HookRunner system. General principles: * Use DI if it is already used. We're not changing the way state is managed in this patch. * HookContainer is always injected, not HookRunner. HookContainer is a service, it's a more generic interface, it is the only thing that provides isRegistered() which is needed in some cases, and a HookRunner can be efficiently constructed from it (confirmed by benchmark). Because HookContainer is needed for object construction, it is also needed by all factories. * "Ask your friendly local base class". Big hierarchies like SpecialPage and ApiBase have getHookContainer() and getHookRunner() methods in the base class, and classes that extend that base class are not expected to know or care where the base class gets its HookContainer from. * ProtectedHookAccessorTrait provides protected getHookContainer() and getHookRunner() methods, getting them from the global service container. The point of this is to ease migration to DI by ensuring that call sites ask their local friendly base class rather than getting a HookRunner from the service container directly. * Private $this->hookRunner. In some smaller classes where accessor methods did not seem warranted, there is a private HookRunner property which is accessed directly. Very rarely (two cases), there is a protected property, for consistency with code that conventionally assumes protected=private, but in cases where the class might actually be overridden, a protected accessor is preferred over a protected property. * The last resort: Hooks::runner(). Mostly for static, file-scope and global code. In a few cases it was used for objects with broken construction schemes, out of horror or laziness. Constructors with new required arguments: * AuthManager * BadFileLookup * BlockManager * ClassicInterwikiLookup * ContentHandlerFactory * ContentSecurityPolicy * DefaultOptionsManager * DerivedPageDataUpdater * FullSearchResultWidget * HtmlCacheUpdater * LanguageFactory * LanguageNameUtils * LinkRenderer * LinkRendererFactory * LocalisationCache * MagicWordFactory * MessageCache * NamespaceInfo * PageEditStash * PageHandlerFactory * PageUpdater * ParserFactory * PermissionManager * RevisionStore * RevisionStoreFactory * SearchEngineConfig * SearchEngineFactory * SearchFormWidget * SearchNearMatcher * SessionBackend * SpecialPageFactory * UserNameUtils * UserOptionsManager * WatchedItemQueryService * WatchedItemStore Constructors with new optional arguments: * DefaultPreferencesFactory * Language * LinkHolderArray * MovePage * Parser * ParserCache * PasswordReset * Router setHookContainer() now required after construction: * AuthenticationProvider * ResourceLoaderModule * SearchEngine Change-Id: Id442b0dbe43aba84bd5cf801d86dedc768b082c7
2020-03-19 02:42:09 +00:00
$this->getHookRunner()->onOutputPageParserOutput( $this, $parserOutput );
// This check must be after 'OutputPageParserOutput' runs in addParserOutputMetadata
// so that extensions may modify ParserOutput to toggle TOC.
// This cannot be moved to addParserOutputText because that is not
// called by EditPage for Preview.
// T294950/T293513: ParserOutput::getTOCHTML() will be
Generate/set/get TOCData/SectionMetadata objects instead of arrays * ParserOutput::setSections()/::getSections() are expected to be deprecated. Uses in extensions and skins will need to be migrated in follow up patches once the new interface has stabilized. * In the skins code, the metadata is converted back to an array. Downstream skin TOC consumers will need to be migrated as well before we can remove the toLegacy() conversion. * Fixed SerializationTestTrait's validation method - Not sure if this is overkill but should handle all future complex objects we might stuff into the ParserCache. * This patch emits a backward-compatible Sections property in order to avoid changing the parser cache serialization format. T327439 has been filed to eventually use the JsonCodec support for object serialization, but for this initial patch it makes sense to avoid the need for a concurrent ParserCache format migration by using a backward-compatible serialization. * TOCData is nullable because the intent is that ParserOutput::setTOCData() is MW_MERGE_STRATEGY_WRITE_ONCE; that is, only the top-level fragment composing a page will set the TOCData. This will be enforced in the future via wfDeprecated() (T327429), but again our first patch is as backward-compatible as possible. Bug: T296025 Depends-On: I1b267d23cf49d147c5379b914531303744481b68 Co-Authored-By: C. Scott Ananian <cananian@wikimedia.org> Co-Authored-By: Subramanya Sastry <ssastry@wikimedia.org> Change-Id: I8329864535f0b1dd5f9163868a08d6cb1ffcb78f
2022-09-01 23:07:29 +00:00
// replaced by ParserOutput::getTOCData(), and
// ParserOutputFlags::SHOW_TOC is used to indicate whether the TOC
// should be shown (or hidden) in the output.
$this->mEnableTOC = $this->mEnableTOC ||
$parserOutput->getOutputFlag( ParserOutputFlags::SHOW_TOC );
// But extensions used to be able to modify ParserOutput::setTOCHTML()
// to toggle TOC in the OutputPageParserOutput hook; so for backward
// compatibility check to see if that happened.
$isTocPresent = (bool)$parserOutput->getTOCHTML();
if ( $isTocPresent && !$this->mEnableTOC ) {
// Eventually we'll emit a deprecation message here (T293513)
$this->mEnableTOC = true;
}
2006-01-01 20:08:08 +00:00
}
2006-01-07 13:31:29 +00:00
/**
* Add the HTML and enhancements for it (like ResourceLoader modules) associated with a
* ParserOutput object, without any other metadata.
*
* @since 1.24
* @param ParserOutput $parserOutput
* @param array $poOptions Options to ParserOutput::getText()
*/
public function addParserOutputContent( ParserOutput $parserOutput, $poOptions = [] ) {
$this->addParserOutputText( $parserOutput, $poOptions );
$this->addModules( $parserOutput->getModules() );
$this->addModuleStyles( $parserOutput->getModuleStyles() );
$this->addJsConfigVars( $parserOutput->getJsConfigVars() );
}
/**
* Add the HTML associated with a ParserOutput object, without any metadata.
*
* @since 1.24
* @param ParserOutput $parserOutput
* @param array $poOptions Options to ParserOutput::getText()
*/
public function addParserOutputText( ParserOutput $parserOutput, $poOptions = [] ) {
// Add default options from the skin
$skin = $this->getSkin();
$skinOptions = $skin->getOptions();
$poOptions += [
'skin' => $skin,
'injectTOC' => $skinOptions['toc'],
];
$text = $parserOutput->getText( $poOptions );
Hooks::run() call site migration Migrate all callers of Hooks::run() to use the new HookContainer/HookRunner system. General principles: * Use DI if it is already used. We're not changing the way state is managed in this patch. * HookContainer is always injected, not HookRunner. HookContainer is a service, it's a more generic interface, it is the only thing that provides isRegistered() which is needed in some cases, and a HookRunner can be efficiently constructed from it (confirmed by benchmark). Because HookContainer is needed for object construction, it is also needed by all factories. * "Ask your friendly local base class". Big hierarchies like SpecialPage and ApiBase have getHookContainer() and getHookRunner() methods in the base class, and classes that extend that base class are not expected to know or care where the base class gets its HookContainer from. * ProtectedHookAccessorTrait provides protected getHookContainer() and getHookRunner() methods, getting them from the global service container. The point of this is to ease migration to DI by ensuring that call sites ask their local friendly base class rather than getting a HookRunner from the service container directly. * Private $this->hookRunner. In some smaller classes where accessor methods did not seem warranted, there is a private HookRunner property which is accessed directly. Very rarely (two cases), there is a protected property, for consistency with code that conventionally assumes protected=private, but in cases where the class might actually be overridden, a protected accessor is preferred over a protected property. * The last resort: Hooks::runner(). Mostly for static, file-scope and global code. In a few cases it was used for objects with broken construction schemes, out of horror or laziness. Constructors with new required arguments: * AuthManager * BadFileLookup * BlockManager * ClassicInterwikiLookup * ContentHandlerFactory * ContentSecurityPolicy * DefaultOptionsManager * DerivedPageDataUpdater * FullSearchResultWidget * HtmlCacheUpdater * LanguageFactory * LanguageNameUtils * LinkRenderer * LinkRendererFactory * LocalisationCache * MagicWordFactory * MessageCache * NamespaceInfo * PageEditStash * PageHandlerFactory * PageUpdater * ParserFactory * PermissionManager * RevisionStore * RevisionStoreFactory * SearchEngineConfig * SearchEngineFactory * SearchFormWidget * SearchNearMatcher * SessionBackend * SpecialPageFactory * UserNameUtils * UserOptionsManager * WatchedItemQueryService * WatchedItemStore Constructors with new optional arguments: * DefaultPreferencesFactory * Language * LinkHolderArray * MovePage * Parser * ParserCache * PasswordReset * Router setHookContainer() now required after construction: * AuthenticationProvider * ResourceLoaderModule * SearchEngine Change-Id: Id442b0dbe43aba84bd5cf801d86dedc768b082c7
2020-03-19 02:42:09 +00:00
$this->getHookRunner()->onOutputPageBeforeHTML( $this, $text );
$this->addHTML( $text );
}
/**
* Add everything from a ParserOutput object.
*
* @param ParserOutput $parserOutput
* @param array $poOptions Options to ParserOutput::getText()
*/
public function addParserOutput( ParserOutput $parserOutput, $poOptions = [] ) {
$this->addParserOutputMetadata( $parserOutput );
$this->addParserOutputText( $parserOutput, $poOptions );
}
/**
* Add the output of a QuickTemplate to the output buffer
*
* @param QuickTemplate &$template
*/
public function addTemplate( &$template ) {
$this->addHTML( $template->getHTML() );
}
/**
* Parse wikitext *in the page content language* and return the HTML.
* The result will be language-converted to the user's preferred variant.
* Output will be tidy.
*
* @param string $text Wikitext in the page content language
* @param bool $linestart Is this the start of a line? (Defaults to true)
* @throws MWException
* @return string HTML
* @since 1.32
*/
public function parseAsContent( $text, $linestart = true ) {
return $this->parseInternal(
$text, $this->getTitle(), $linestart, /*interface*/false
)->getText( [
'allowTOC' => false,
'enableSectionEditLinks' => false,
'wrapperDivClass' => '',
'userLang' => $this->getContext()->getLanguage(),
] );
}
/**
* Parse wikitext *in the user interface language* and return the HTML.
* The result will not be language-converted, as user interface messages
* are already localized into a specific variant.
* Output will be tidy.
*
* @param string $text Wikitext in the user interface language
* @param bool $linestart Is this the start of a line? (Defaults to true)
* @throws MWException
* @return string HTML
* @since 1.32
*/
public function parseAsInterface( $text, $linestart = true ) {
return $this->parseInternal(
$text, $this->getTitle(), $linestart, /*interface*/true
)->getText( [
'allowTOC' => false,
'enableSectionEditLinks' => false,
'wrapperDivClass' => '',
'userLang' => $this->getContext()->getLanguage(),
] );
}
/**
* Parse wikitext *in the user interface language*, strip
* paragraph wrapper, and return the HTML.
* The result will not be language-converted, as user interface messages
* are already localized into a specific variant.
* Output will be tidy. Outer paragraph wrapper will only be stripped
* if the result is a single paragraph.
*
* @param string $text Wikitext in the user interface language
* @param bool $linestart Is this the start of a line? (Defaults to true)
* @throws MWException
* @return string HTML
* @since 1.32
*/
public function parseInlineAsInterface( $text, $linestart = true ) {
return Parser::stripOuterParagraph(
$this->parseAsInterface( $text, $linestart )
);
}
/**
* Parse wikitext and return the HTML (internal implementation helper)
*
* @param string $text
* @param PageReference $title The title to use
* @param bool $linestart Is this the start of a line?
* @param bool $interface Use interface language (instead of content language) while parsing
* language sensitive magic words like GRAMMAR and PLURAL. This also disables
* LanguageConverter.
* @throws MWException
* @return ParserOutput
*/
private function parseInternal( $text, $title, $linestart, $interface ) {
if ( $title === null ) {
throw new MWException( 'Empty $mTitle in ' . __METHOD__ );
}
Merged localisation-work branch: * Made lines from initialiseMessages() appear as list items during installation * Moved the bulk of the localisation data from the Language*.php files to the Messages*.php files. Deleted most of the Languages*.php files. * Introduced "stub global" framework to provide deferred initialisation of core modules. * Removed placeholder values for $wgTitle and $wgArticle, these variables will now be null during the initialisation process, until they are set by index.php or another entry point. * Added DBA cache type, for BDB-style caches. * Removed custom date format functions, replacing them with a format string in the style of PHP's date(). Used string identifiers instead of integer identifiers, in both the language files and user preferences. Migration should be transparent in most cases. * Simplified the initialisation API for LoadBalancer objects. * Removed the broken altencoding feature. * Moved default user options and toggles from Language to User. Language objects are still able to define default preference overrides and extra user toggles, via a slightly different interface. * Don't include the date option in the parser cache rendering hash unless $wgUseDynamicDates is enabled. * Merged LanguageUtf8 with Language. Removed LanguageUtf8.php. * Removed inclusion of language files from the bottom of Language.php. This is now consistently done from Language::factory(). * Add the name of the executing maintenance script to the debug log. Start the profiler during maintenance scripts. * Added "serialized" directory, for storing precompiled data in serialized form.
2006-07-26 07:15:39 +00:00
$popts = $this->parserOptions();
$oldInterface = $popts->setInterfaceMessage( (bool)$interface );
$parserOutput = MediaWikiServices::getInstance()->getParserFactory()->getInstance()
->parse(
$text, $title, $popts,
$linestart, true, $this->mRevisionId
);
$popts->setInterfaceMessage( $oldInterface );
return $parserOutput;
}
/**
* Set the value of the "s-maxage" part of the "Cache-control" HTTP header
*
* @param int $maxage Maximum cache time on the CDN, in seconds.
*/
public function setCdnMaxage( $maxage ) {
$this->mCdnMaxage = min( $maxage, $this->mCdnMaxageLimit );
}
/**
* Set the value of the "s-maxage" part of the "Cache-control" HTTP header to $maxage if that is
* lower than the current s-maxage. Either way, $maxage is now an upper limit on s-maxage, so
* that future calls to setCdnMaxage() will no longer be able to raise the s-maxage above
* $maxage.
*
* @param int $maxage Maximum cache time on the CDN, in seconds
* @since 1.27
*/
public function lowerCdnMaxage( $maxage ) {
$this->mCdnMaxageLimit = min( $maxage, $this->mCdnMaxageLimit );
$this->setCdnMaxage( $this->mCdnMaxage );
}
/**
* Get TTL in [$minTTL,$maxTTL] and pass it to lowerCdnMaxage()
*
* This sets and returns $minTTL if $mtime is false or null. Otherwise,
* the TTL is higher the older the $mtime timestamp is. Essentially, the
* TTL is 90% of the age of the object, subject to the min and max.
*
* @param string|int|float|bool|null $mtime Last-Modified timestamp
* @param int $minTTL Minimum TTL in seconds [default: 1 minute]
* @param int $maxTTL Maximum TTL in seconds [default: $wgCdnMaxAge]
* @since 1.28
*/
public function adaptCdnTTL( $mtime, $minTTL = 0, $maxTTL = 0 ) {
$minTTL = $minTTL ?: IExpiringStore::TTL_MINUTE;
$maxTTL = $maxTTL ?: $this->getConfig()->get( MainConfigNames::CdnMaxAge );
if ( $mtime === null || $mtime === false ) {
return; // entity does not exist
}
$age = MWTimestamp::time() - (int)wfTimestamp( TS_UNIX, $mtime );
$adaptiveTTL = max( 0.9 * $age, $minTTL );
$adaptiveTTL = min( $adaptiveTTL, $maxTTL );
$this->lowerCdnMaxage( (int)$adaptiveTTL );
}
/**
* Do not send nocache headers
*/
public function enableClientCache(): void {
$this->mEnableClientCache = true;
2004-03-23 10:19:31 +00:00
}
/**
* Force the page to send nocache headers
* @since 1.38
*/
public function disableClientCache(): void {
$this->mEnableClientCache = false;
}
block: Allow cookie-block tracking from any uncached web request This was previously hardcoded from three places: 1) Upon viewing EditPage, 2) Upon viewing SpecialCreateAccount, 3) For any url if the user is logged-in (User::loadFromSession/isLoggedIn). == User::loadFromSession Performing cookie blocks from here created a circular dependency because Block may need the user language for localisation, which is determined by asking the User object. This was previously worked around by using a DeferredUpdate (T180050, T226777). Moving this logic explicitly to the end of the pre-send cycle in MediaWiki::preOutputCommit breaks the cycle. This is also where other request-specific handling resides already. == Limited effect on unregistered users When an unregistered user performs an edit, and gets blocked, the cookie block is not applied until they open built-in editor or CreateAccount page. This makes it more likely for a user's IP to change meanwhile. Either intentionally, or simply due to IPs varying naturally (e.g. between mobile locations, or when going on/off WiFi). By applying it throughout sessioned page views for unregistered users, it is more likely to get set. Similar to what was already done for logged-in users. This commit also makes the intent of not caching EditPage and SpecialCreateAccount explicit. This was previously implicit through nothing having called setCdnMaxage() and/or due to Session::persist being checked for by OutputPage::sendCacheControl. Bug: T233594 Change-Id: Icf5a00f9b41d31bb6d4742c049feca0039d0c9d9
2019-09-07 23:44:46 +00:00
/**
* Whether the output might become publicly cached.
*
* @since 1.34
* @return bool
*/
public function couldBePublicCached() {
if ( !$this->cacheIsFinal ) {
// - The entry point handles its own caching and/or doesn't use OutputPage.
// (such as load.php, or MediaWiki\Rest\EntryPoint).
block: Allow cookie-block tracking from any uncached web request This was previously hardcoded from three places: 1) Upon viewing EditPage, 2) Upon viewing SpecialCreateAccount, 3) For any url if the user is logged-in (User::loadFromSession/isLoggedIn). == User::loadFromSession Performing cookie blocks from here created a circular dependency because Block may need the user language for localisation, which is determined by asking the User object. This was previously worked around by using a DeferredUpdate (T180050, T226777). Moving this logic explicitly to the end of the pre-send cycle in MediaWiki::preOutputCommit breaks the cycle. This is also where other request-specific handling resides already. == Limited effect on unregistered users When an unregistered user performs an edit, and gets blocked, the cookie block is not applied until they open built-in editor or CreateAccount page. This makes it more likely for a user's IP to change meanwhile. Either intentionally, or simply due to IPs varying naturally (e.g. between mobile locations, or when going on/off WiFi). By applying it throughout sessioned page views for unregistered users, it is more likely to get set. Similar to what was already done for logged-in users. This commit also makes the intent of not caching EditPage and SpecialCreateAccount explicit. This was previously implicit through nothing having called setCdnMaxage() and/or due to Session::persist being checked for by OutputPage::sendCacheControl. Bug: T233594 Change-Id: Icf5a00f9b41d31bb6d4742c049feca0039d0c9d9
2019-09-07 23:44:46 +00:00
//
// - Or, we haven't finished processing the main part of the request yet
// (e.g. Action::show, SpecialPage::execute), and the state may still
// change via enableClientCache().
return true;
}
// e.g. various error-type pages disable all client caching
return $this->mEnableClientCache;
}
/**
* Set the expectation that cache control will not change after this point.
*
* This should be called after the main processing logic has completed
* (e.g. Action::show or SpecialPage::execute), but may be called
* before Skin output has started (OutputPage::output).
*
* @since 1.34
*/
public function considerCacheSettingsFinal() {
$this->cacheIsFinal = true;
}
/**
* Get the list of cookie names that will influence the cache
*
* @return array
*/
public function getCacheVaryCookies() {
if ( self::$cacheVaryCookies === null ) {
$config = $this->getConfig();
self::$cacheVaryCookies = array_values( array_unique( array_merge(
SessionManager::singleton()->getVaryCookies(),
[
'forceHTTPS',
],
$config->get( MainConfigNames::CacheVaryCookies )
) ) );
$this->getHookRunner()->onGetCacheVaryCookies( $this, self::$cacheVaryCookies );
}
return self::$cacheVaryCookies;
}
/**
* Check if the request has a cache-varying cookie header
* If it does, it's very important that we don't allow public caching
*
* @return bool
*/
public function haveCacheVaryCookies() {
$request = $this->getRequest();
foreach ( $this->getCacheVaryCookies() as $cookieName ) {
if ( $request->getCookie( $cookieName, '', '' ) !== '' ) {
wfDebug( __METHOD__ . ": found $cookieName" );
return true;
}
}
wfDebug( __METHOD__ . ": no cache-varying cookies found" );
return false;
}
/**
* Add an HTTP header that will influence on the cache
*
* @param string $header Header name
* @param string[]|null $option Deprecated; formerly options for the
* Key header, deprecated in 1.32 and removed in 1.34. See
* https://datatracker.ietf.org/doc/draft-fielding-http-key/
* for the list of formerly-valid options.
*/
public function addVaryHeader( $header, array $option = null ) {
if ( $option !== null && count( $option ) > 0 ) {
wfDeprecatedMsg(
'The $option parameter to addVaryHeader is ignored since MediaWiki 1.34',
'1.34' );
}
if ( !array_key_exists( $header, $this->mVaryHeader ) ) {
$this->mVaryHeader[$header] = null;
}
}
/**
* Return a Vary: header on which to vary caches. Based on the keys of $mVaryHeader,
* such as Accept-Encoding or Cookie
*
* @return string
*/
public function getVaryHeader() {
// If we vary on cookies, let's make sure it's always included here too.
if ( $this->getCacheVaryCookies() ) {
$this->addVaryHeader( 'Cookie' );
}
foreach ( SessionManager::singleton()->getVaryHeaders() as $header => $options ) {
$this->addVaryHeader( $header, $options );
}
return 'Vary: ' . implode( ', ', array_keys( $this->mVaryHeader ) );
}
/**
* Add an HTTP Link: header
*
* @param string $header Header value
*/
public function addLinkHeader( $header ) {
$this->mLinkHeader[] = $header;
}
/**
* Return a Link: header. Based on the values of $mLinkHeader.
*
* @return string|false
*/
public function getLinkHeader() {
if ( !$this->mLinkHeader ) {
return false;
}
return 'Link: ' . implode( ',', $this->mLinkHeader );
}
/**
* T23672: Add Accept-Language to Vary header if there's no 'variant' parameter in GET.
*
* For example:
* /w/index.php?title=Main_page will vary based on Accept-Language; but
* /w/index.php?title=Main_page&variant=zh-cn will not.
*/
private function addAcceptLanguage() {
$title = $this->getTitle();
if ( !$title instanceof Title ) {
return;
}
$languageConverter = MediaWikiServices::getInstance()->getLanguageConverterFactory()
->getLanguageConverter( $title->getPageLanguage() );
if ( !$this->getRequest()->getCheck( 'variant' ) && $languageConverter->hasVariants() ) {
$this->addVaryHeader( 'Accept-Language' );
}
}
/**
2011-04-23 19:28:35 +00:00
* Set a flag which will cause an X-Frame-Options header appropriate for
* edit pages to be sent. The header value is controlled by
* $wgEditPageFrameOptions.
*
2011-04-23 19:28:35 +00:00
* This is the default for special pages. If you display a CSRF-protected
* form on an ordinary view page, then you need to call this function.
*
* @param bool $enable
* @deprecated since 1.38, use ::setPreventClickjacking( true )
*/
public function preventClickjacking( $enable = true ) {
$this->mPreventClickjacking = $enable;
}
/**
* Turn off frame-breaking. Alias for $this->preventClickjacking(false).
* This can be called from pages which do not contain any CSRF-protected
* HTML form.
*
* @deprecated since 1.38, use ::setPreventClickjacking( false )
*/
public function allowClickjacking() {
$this->mPreventClickjacking = false;
}
/**
* Set the prevent-clickjacking flag.
*
* If true, will cause an X-Frame-Options header appropriate for
* edit pages to be sent. The header value is controlled by
* $wgEditPageFrameOptions. This is the default for special
* pages. If you display a CSRF-protected form on an ordinary view
* page, then you need to call this function.
*
* Setting this flag to false will turn off frame-breaking. This
* can be called from pages which do not contain any
* CSRF-protected HTML form.
*
* @param bool $enable If true, will cause an X-Frame-Options header
* appropriate for edit pages to be sent.
*
* @since 1.38
*/
public function setPreventClickjacking( bool $enable ) {
$this->mPreventClickjacking = $enable;
}
/**
* Get the prevent-clickjacking flag
*
* @since 1.24
* @return bool
*/
public function getPreventClickjacking() {
return $this->mPreventClickjacking;
}
/**
2011-04-23 19:28:35 +00:00
* Get the X-Frame-Options header value (without the name part), or false
* if there isn't one. This is used by Skin to determine whether to enable
* JavaScript frame-breaking, for clients that don't support X-Frame-Options.
*
* @return string|false
*/
public function getFrameOptions() {
$config = $this->getConfig();
if ( $config->get( MainConfigNames::BreakFrames ) ) {
return 'DENY';
} elseif ( $this->mPreventClickjacking && $config->get( MainConfigNames::EditPageFrameOptions ) ) {
return $config->get( MainConfigNames::EditPageFrameOptions );
}
return false;
}
private function getReportTo() {
$config = $this->getConfig();
$expiry = $config->get( MainConfigNames::ReportToExpiry );
if ( !$expiry ) {
return false;
}
$endpoints = $config->get( MainConfigNames::ReportToEndpoints );
if ( !$endpoints ) {
return false;
}
$output = [ 'max_age' => $expiry, 'endpoints' => [] ];
foreach ( $endpoints as $endpoint ) {
$output['endpoints'][] = [ 'url' => $endpoint ];
}
return json_encode( $output, JSON_UNESCAPED_SLASHES );
}
private function getFeaturePolicyReportOnly() {
$config = $this->getConfig();
$features = $config->get( MainConfigNames::FeaturePolicyReportOnly );
return implode( ';', $features );
}
/**
* Send cache control HTTP headers
*/
public function sendCacheControl() {
$response = $this->getRequest()->response();
$config = $this->getConfig();
$this->addVaryHeader( 'Cookie' );
$this->addAcceptLanguage();
# don't serve compressed data to clients who can't handle it
2005-03-08 02:58:43 +00:00
# maintain different caches for logged-in users and non-logged in ones
$response->header( $this->getVaryHeader() );
if ( $this->mEnableClientCache ) {
if ( !$config->get( MainConfigNames::UseCdn ) ) {
$privateReason = 'config';
} elseif ( $response->hasCookies() ) {
$privateReason = 'set-cookies';
// The client might use methods other than cookies to appear logged-in.
// E.g. HTTP headers, or query parameter tokens, OAuth, etc.
} elseif ( SessionManager::getGlobalSession()->isPersistent() ) {
$privateReason = 'session';
} elseif ( $this->isPrintable() ) {
$privateReason = 'printable';
} elseif ( $this->mCdnMaxage == 0 ) {
$privateReason = 'no-maxage';
} elseif ( $this->haveCacheVaryCookies() ) {
$privateReason = 'cache-vary-cookies';
} else {
$privateReason = false;
}
if ( $privateReason === false ) {
# We'll purge the proxy cache for anons explicitly, but require end user agents
# to revalidate against the proxy on each visit.
# IMPORTANT! The CDN needs to replace the Cache-Control header with
# Cache-Control: s-maxage=0, must-revalidate, max-age=0
wfDebug( __METHOD__ .
": local proxy caching; {$this->mLastModified} **", 'private' );
# start with a shorter timeout for initial testing
# header( "Cache-Control: s-maxage=2678400, must-revalidate, max-age=0" );
$response->header( "Cache-Control: " .
"s-maxage={$this->mCdnMaxage}, must-revalidate, max-age=0" );
} else {
# We do want clients to cache if they can, but they *must* check for updates
# on revisiting the page.
wfDebug( __METHOD__ . ": private caching ($privateReason); {$this->mLastModified} **", 'private' );
$response->header( 'Expires: ' . gmdate( 'D, d M Y H:i:s', 0 ) . ' GMT' );
$response->header( "Cache-Control: private, must-revalidate, max-age=0" );
}
if ( $this->mLastModified ) {
$response->header( "Last-Modified: {$this->mLastModified}" );
}
} else {
wfDebug( __METHOD__ . ": no caching **", 'private' );
2004-03-23 10:19:31 +00:00
# In general, the absence of a last modified header should be enough to prevent
# the client from using its cache. We send a few other things just to make sure.
$response->header( 'Expires: ' . gmdate( 'D, d M Y H:i:s', 0 ) . ' GMT' );
$response->header( 'Cache-Control: no-cache, no-store, max-age=0, must-revalidate' );
$response->header( 'Pragma: no-cache' );
}
}
/**
* Transfer styles and JavaScript modules from skin.
*
* @param Skin $sk to load modules for
*/
public function loadSkinModules( $sk ) {
foreach ( $sk->getDefaultModules() as $group => $modules ) {
if ( $group === 'styles' ) {
foreach ( $modules as $moduleMembers ) {
$this->addModuleStyles( $moduleMembers );
}
} else {
$this->addModules( $modules );
}
}
}
/**
* Finally, all the text has been munged and accumulated into
* the object, let's actually output it:
*
* @param bool $return Set to true to get the result as a string rather than sending it
* @return string|null
* @throws Exception
* @throws FatalError
* @throws MWException
*/
public function output( $return = false ) {
if ( $this->mDoNothing ) {
return $return ? '' : null;
}
$response = $this->getRequest()->response();
$config = $this->getConfig();
if ( $this->mRedirect != '' ) {
# Standards require redirect URLs to be absolute
$this->mRedirect = wfExpandUrl( $this->mRedirect, PROTO_CURRENT );
$redirect = $this->mRedirect;
$code = $this->mRedirectCode;
$content = '';
Hooks::run() call site migration Migrate all callers of Hooks::run() to use the new HookContainer/HookRunner system. General principles: * Use DI if it is already used. We're not changing the way state is managed in this patch. * HookContainer is always injected, not HookRunner. HookContainer is a service, it's a more generic interface, it is the only thing that provides isRegistered() which is needed in some cases, and a HookRunner can be efficiently constructed from it (confirmed by benchmark). Because HookContainer is needed for object construction, it is also needed by all factories. * "Ask your friendly local base class". Big hierarchies like SpecialPage and ApiBase have getHookContainer() and getHookRunner() methods in the base class, and classes that extend that base class are not expected to know or care where the base class gets its HookContainer from. * ProtectedHookAccessorTrait provides protected getHookContainer() and getHookRunner() methods, getting them from the global service container. The point of this is to ease migration to DI by ensuring that call sites ask their local friendly base class rather than getting a HookRunner from the service container directly. * Private $this->hookRunner. In some smaller classes where accessor methods did not seem warranted, there is a private HookRunner property which is accessed directly. Very rarely (two cases), there is a protected property, for consistency with code that conventionally assumes protected=private, but in cases where the class might actually be overridden, a protected accessor is preferred over a protected property. * The last resort: Hooks::runner(). Mostly for static, file-scope and global code. In a few cases it was used for objects with broken construction schemes, out of horror or laziness. Constructors with new required arguments: * AuthManager * BadFileLookup * BlockManager * ClassicInterwikiLookup * ContentHandlerFactory * ContentSecurityPolicy * DefaultOptionsManager * DerivedPageDataUpdater * FullSearchResultWidget * HtmlCacheUpdater * LanguageFactory * LanguageNameUtils * LinkRenderer * LinkRendererFactory * LocalisationCache * MagicWordFactory * MessageCache * NamespaceInfo * PageEditStash * PageHandlerFactory * PageUpdater * ParserFactory * PermissionManager * RevisionStore * RevisionStoreFactory * SearchEngineConfig * SearchEngineFactory * SearchFormWidget * SearchNearMatcher * SessionBackend * SpecialPageFactory * UserNameUtils * UserOptionsManager * WatchedItemQueryService * WatchedItemStore Constructors with new optional arguments: * DefaultPreferencesFactory * Language * LinkHolderArray * MovePage * Parser * ParserCache * PasswordReset * Router setHookContainer() now required after construction: * AuthenticationProvider * ResourceLoaderModule * SearchEngine Change-Id: Id442b0dbe43aba84bd5cf801d86dedc768b082c7
2020-03-19 02:42:09 +00:00
if ( $this->getHookRunner()->onBeforePageRedirect( $this, $redirect, $code ) ) {
if ( $code == '301' || $code == '303' ) {
if ( !$config->get( MainConfigNames::DebugRedirects ) ) {
$response->statusHeader( (int)$code );
}
$this->mLastModified = wfTimestamp( TS_RFC2822 );
}
if ( $config->get( MainConfigNames::VaryOnXFP ) ) {
$this->addVaryHeader( 'X-Forwarded-Proto' );
}
$this->sendCacheControl();
exception: Simplify MWExceptionRenderer to reduce influence of config Remove use of two configuration globals. This follows-up to commit 47adb6d65a (I1a691f01cd82e60) which aimed to access all config via MediaWikiServices, but that isn't safe during error handling. These two were only used in the low-level "plain text" and "basic HTML" error pages, which already can't have any branding, skinning or localisation; and are not how most exceptions are rendered. in those edge cases, we can use the name of the software instead of (trying) to use the name of the site. == Remove use of $wgSitename == In msg() and reportHTML(), remove use of $wgSitename in favour of a generic fallback matching DefaulSettings.php. This does not affect the common case of runtime fatals and timeouts, as we're only changing the fallback after wfMessage() fails in msg(), or when OutputPage is unavailable, which is typically only if services, localisation or DB are also down (or not yet loaded). Most exceptions happen when and after those have initialised fine. Test case 1: (Clean state) Edit ViewAction::show() to add `throw new RuntimeException();` as its first statement, then try to view the main page. This error page is unchanged. It is skinned, localised, and still uses the configured sitename in the doc title. Test case 2: Edit index.php to call foo() instead of wfIndexMain(), then try to view the main page. Before, this "minimal HTML" error page would have a doc title of "Internal error - MyWiki", and now "Internal error - MediaWiki". Test case 3: (Clean state) Edit Message::text() to add `throw new RuntimeException();`, then try to view the main page. This results in a "plain text" error page that doesn't even have an HTML doc, and is also unchanged. == Remove use of $wgMimeType == In output(), remove use of $wgMimeType and remove the Content-Type header that it was used for. This was redundant because the next statements (reportHTML) already outputs Content-type. In reportHTML, we sometimes delegate to OutputPage (if safe) and that honours $wgMimeType already. In other cases, it is handled inline in with a basic HTML error page, and that branch also sets the Content-Type header already. In one case (reportOutageHTML) a header was not yet set. For that one, I've added the missing header call and made it explicitly text/html. This is technically a bugfix, because our basic HTML error page is HTML5, whereas $wgMimeType (which exists to allow enabling XHTML) can be XHTML which we weren't following. In OutputPage and Html::htmlHeader that would normally result in outputting `<?xml`. Test case: Edit ViewAction::show(), and add `throw new RuntimeException();` as its first statement, then try to view the main page. In devtools>network, there is still a proper Content-Type and charset on the error page document. Change-Id: I03cfa2b6155fb711582164852e7cab4c325a1b92
2022-01-12 23:05:34 +00:00
$response->header( 'Content-Type: text/html; charset=UTF-8' );
if ( $config->get( MainConfigNames::DebugRedirects ) ) {
$url = htmlspecialchars( $redirect );
$content = "<!DOCTYPE html>\n<html>\n<head>\n"
. "<title>Redirect</title>\n</head>\n<body>\n"
. "<p>Location: <a href=\"$url\">$url</a></p>\n"
. "</body>\n</html>\n";
if ( !$return ) {
print $content;
}
} else {
$response->header( 'Location: ' . $redirect );
}
}
return $return ? $content : null;
} elseif ( $this->mStatusCode ) {
$response->statusHeader( $this->mStatusCode );
}
2010-05-22 11:47:56 +00:00
# Buffer output; final headers may depend on later processing
ob_start();
$response->header( 'Content-type: ' . $config->get( MainConfigNames::MimeType ) . '; charset=UTF-8' );
$response->header( 'Content-language: ' .
MediaWikiServices::getInstance()->getContentLanguage()->getHtmlCode() );
2003-04-14 23:10:40 +00:00
$linkHeader = $this->getLinkHeader();
if ( $linkHeader ) {
$response->header( $linkHeader );
}
// Prevent framing, if requested
$frameOptions = $this->getFrameOptions();
if ( $frameOptions ) {
$response->header( "X-Frame-Options: $frameOptions" );
}
// Get the Origin-Trial header values. This is used to enable Chrome Origin
// Trials: https://github.com/GoogleChrome/OriginTrials
$originTrials = $config->get( MainConfigNames::OriginTrials );
foreach ( $originTrials as $originTrial ) {
$response->header( "Origin-Trial: $originTrial", false );
}
$reportTo = $this->getReportTo();
if ( $reportTo ) {
$response->header( "Report-To: $reportTo" );
}
$featurePolicyReportOnly = $this->getFeaturePolicyReportOnly();
if ( $featurePolicyReportOnly ) {
$response->header( "Feature-Policy-Report-Only: $featurePolicyReportOnly" );
}
if ( $this->mArticleBodyOnly ) {
$this->CSP->sendHeaders();
echo $this->mBodytext;
2005-07-03 04:00:33 +00:00
} else {
// Enable safe mode if requested (T152169)
if ( $this->getRequest()->getBool( 'safemode' ) ) {
$this->disallowUserJs();
}
$sk = $this->getSkin();
$this->loadSkinModules( $sk );
MWDebug::addModules( $this );
// Hook that allows last minute changes to the output page, e.g.
// adding of CSS or Javascript by extensions, adding CSP sources.
Hooks::run() call site migration Migrate all callers of Hooks::run() to use the new HookContainer/HookRunner system. General principles: * Use DI if it is already used. We're not changing the way state is managed in this patch. * HookContainer is always injected, not HookRunner. HookContainer is a service, it's a more generic interface, it is the only thing that provides isRegistered() which is needed in some cases, and a HookRunner can be efficiently constructed from it (confirmed by benchmark). Because HookContainer is needed for object construction, it is also needed by all factories. * "Ask your friendly local base class". Big hierarchies like SpecialPage and ApiBase have getHookContainer() and getHookRunner() methods in the base class, and classes that extend that base class are not expected to know or care where the base class gets its HookContainer from. * ProtectedHookAccessorTrait provides protected getHookContainer() and getHookRunner() methods, getting them from the global service container. The point of this is to ease migration to DI by ensuring that call sites ask their local friendly base class rather than getting a HookRunner from the service container directly. * Private $this->hookRunner. In some smaller classes where accessor methods did not seem warranted, there is a private HookRunner property which is accessed directly. Very rarely (two cases), there is a protected property, for consistency with code that conventionally assumes protected=private, but in cases where the class might actually be overridden, a protected accessor is preferred over a protected property. * The last resort: Hooks::runner(). Mostly for static, file-scope and global code. In a few cases it was used for objects with broken construction schemes, out of horror or laziness. Constructors with new required arguments: * AuthManager * BadFileLookup * BlockManager * ClassicInterwikiLookup * ContentHandlerFactory * ContentSecurityPolicy * DefaultOptionsManager * DerivedPageDataUpdater * FullSearchResultWidget * HtmlCacheUpdater * LanguageFactory * LanguageNameUtils * LinkRenderer * LinkRendererFactory * LocalisationCache * MagicWordFactory * MessageCache * NamespaceInfo * PageEditStash * PageHandlerFactory * PageUpdater * ParserFactory * PermissionManager * RevisionStore * RevisionStoreFactory * SearchEngineConfig * SearchEngineFactory * SearchFormWidget * SearchNearMatcher * SessionBackend * SpecialPageFactory * UserNameUtils * UserOptionsManager * WatchedItemQueryService * WatchedItemStore Constructors with new optional arguments: * DefaultPreferencesFactory * Language * LinkHolderArray * MovePage * Parser * ParserCache * PasswordReset * Router setHookContainer() now required after construction: * AuthenticationProvider * ResourceLoaderModule * SearchEngine Change-Id: Id442b0dbe43aba84bd5cf801d86dedc768b082c7
2020-03-19 02:42:09 +00:00
$this->getHookRunner()->onBeforePageDisplay( $this, $sk );
$this->CSP->sendHeaders();
try {
$sk->outputPage();
} catch ( Exception $e ) {
ob_end_clean(); // bug T129657
throw $e;
}
2005-07-03 04:00:33 +00:00
}
try {
// This hook allows last minute changes to final overall output by modifying output buffer
Hooks::run() call site migration Migrate all callers of Hooks::run() to use the new HookContainer/HookRunner system. General principles: * Use DI if it is already used. We're not changing the way state is managed in this patch. * HookContainer is always injected, not HookRunner. HookContainer is a service, it's a more generic interface, it is the only thing that provides isRegistered() which is needed in some cases, and a HookRunner can be efficiently constructed from it (confirmed by benchmark). Because HookContainer is needed for object construction, it is also needed by all factories. * "Ask your friendly local base class". Big hierarchies like SpecialPage and ApiBase have getHookContainer() and getHookRunner() methods in the base class, and classes that extend that base class are not expected to know or care where the base class gets its HookContainer from. * ProtectedHookAccessorTrait provides protected getHookContainer() and getHookRunner() methods, getting them from the global service container. The point of this is to ease migration to DI by ensuring that call sites ask their local friendly base class rather than getting a HookRunner from the service container directly. * Private $this->hookRunner. In some smaller classes where accessor methods did not seem warranted, there is a private HookRunner property which is accessed directly. Very rarely (two cases), there is a protected property, for consistency with code that conventionally assumes protected=private, but in cases where the class might actually be overridden, a protected accessor is preferred over a protected property. * The last resort: Hooks::runner(). Mostly for static, file-scope and global code. In a few cases it was used for objects with broken construction schemes, out of horror or laziness. Constructors with new required arguments: * AuthManager * BadFileLookup * BlockManager * ClassicInterwikiLookup * ContentHandlerFactory * ContentSecurityPolicy * DefaultOptionsManager * DerivedPageDataUpdater * FullSearchResultWidget * HtmlCacheUpdater * LanguageFactory * LanguageNameUtils * LinkRenderer * LinkRendererFactory * LocalisationCache * MagicWordFactory * MessageCache * NamespaceInfo * PageEditStash * PageHandlerFactory * PageUpdater * ParserFactory * PermissionManager * RevisionStore * RevisionStoreFactory * SearchEngineConfig * SearchEngineFactory * SearchFormWidget * SearchNearMatcher * SessionBackend * SpecialPageFactory * UserNameUtils * UserOptionsManager * WatchedItemQueryService * WatchedItemStore Constructors with new optional arguments: * DefaultPreferencesFactory * Language * LinkHolderArray * MovePage * Parser * ParserCache * PasswordReset * Router setHookContainer() now required after construction: * AuthenticationProvider * ResourceLoaderModule * SearchEngine Change-Id: Id442b0dbe43aba84bd5cf801d86dedc768b082c7
2020-03-19 02:42:09 +00:00
$this->getHookRunner()->onAfterFinalPageOutput( $this );
} catch ( Exception $e ) {
ob_end_clean(); // bug T129657
throw $e;
}
$this->sendCacheControl();
if ( $return ) {
return ob_get_clean();
} else {
ob_end_flush();
return null;
}
2003-04-14 23:10:40 +00:00
}
/**
* Prepare this object to display an error page; disable caching and
* indexing, clear the current text and redirect, set the page's title
* and optionally an custom HTML title (content of the "<title>" tag).
*
* @param string|Message $pageTitle Will be passed directly to setPageTitle()
* @param string|Message|false $htmlTitle Will be passed directly to setHTMLTitle();
* optional, if not passed the "<title>" attribute will be
* based on $pageTitle
*/
public function prepareErrorPage( $pageTitle, $htmlTitle = false ) {
$this->setPageTitle( $pageTitle );
if ( $htmlTitle !== false ) {
$this->setHTMLTitle( $htmlTitle );
}
$this->setRobotPolicy( 'noindex,nofollow' );
$this->setArticleRelated( false );
$this->disableClientCache();
$this->mRedirect = '';
$this->clearSubtitle();
$this->clearHTML();
}
/**
* Output a standard error page
*
* showErrorPage( 'titlemsg', 'pagetextmsg' );
* showErrorPage( 'titlemsg', 'pagetextmsg', [ 'param1', 'param2' ] );
* showErrorPage( 'titlemsg', $messageObject );
* showErrorPage( $titleMessageObject, $messageObject );
*
* @param string|Message $title Message key (string) for page title, or a Message object
* @param string|Message $msg Message key (string) for page text, or a Message object
* @param array $params Message parameters; ignored if $msg is a Message object
* @param PageReference|LinkTarget|string|null $returnto Page to show a return link to;
* defaults to the 'returnto' URL parameter
* @param string|null $returntoquery Query string for the return to link;
* defaults to the 'returntoquery' URL parameter
*/
public function showErrorPage(
$title, $msg, $params = [], $returnto = null, $returntoquery = null
) {
if ( !$title instanceof Message ) {
$title = $this->msg( $title );
}
$this->prepareErrorPage( $title );
if ( $msg instanceof Message ) {
if ( $params !== [] ) {
trigger_error( 'Argument ignored: $params. The message parameters argument '
. 'is discarded when the $msg argument is a Message object instead of '
. 'a string.', E_USER_NOTICE );
}
$this->addHTML( $msg->parseAsBlock() );
} else {
2011-08-25 10:56:46 +00:00
$this->addWikiMsgArray( $msg, $params );
}
$this->returnToMain( null, $returnto, $returntoquery );
2003-04-14 23:10:40 +00:00
}
/**
* Output a standard permission error page
*
* @param array $errors Error message keys or [key, param...] arrays
* @param string|null $action Action that was denied or null if unknown
*/
public function showPermissionsErrorPage( array $errors, $action = null ) {
$services = MediaWikiServices::getInstance();
$groupPermissionsLookup = $services->getGroupPermissionsLookup();
foreach ( $errors as $key => $error ) {
$errors[$key] = (array)$error;
}
// For some action (read, edit, create and upload), display a "login to do this action"
// error if all of the following conditions are met:
// 1. the user is not logged in
// 2. the only error is insufficient permissions (i.e. no block or something else)
// 3. the error can be avoided simply by logging in
if ( in_array( $action, [ 'read', 'edit', 'createpage', 'createtalk', 'upload' ] )
&& $this->getUser()->isAnon() && count( $errors ) == 1 && isset( $errors[0][0] )
&& ( $errors[0][0] == 'badaccess-groups' || $errors[0][0] == 'badaccess-group0' )
&& ( $groupPermissionsLookup->groupHasPermission( 'user', $action )
|| $groupPermissionsLookup->groupHasPermission( 'autoconfirmed', $action ) )
) {
$displayReturnto = null;
# Due to T34276, if a user does not have read permissions,
2011-11-29 21:04:20 +00:00
# $this->getTitle() will just give Special:Badtitle, which is
# not especially useful as a returnto parameter. Use the title
# from the request instead, if there was one.
$request = $this->getRequest();
$returnto = Title::newFromText( $request->getText( 'title' ) );
if ( $action == 'edit' ) {
$msg = 'whitelistedittext';
$displayReturnto = $returnto;
} elseif ( $action == 'createpage' || $action == 'createtalk' ) {
$msg = 'nocreatetext';
} elseif ( $action == 'upload' ) {
$msg = 'uploadnologintext';
} else { # Read
$msg = 'loginreqpagetext';
$displayReturnto = Title::newMainPage();
}
$query = [];
if ( $returnto ) {
$query['returnto'] = $returnto->getPrefixedText();
if ( !$request->wasPosted() ) {
$returntoquery = $request->getValues();
unset( $returntoquery['title'] );
unset( $returntoquery['returnto'] );
unset( $returntoquery['returntoquery'] );
$query['returntoquery'] = wfArrayToCgi( $returntoquery );
}
}
$title = SpecialPage::getTitleFor( 'Userlogin' );
$linkRenderer = $services->getLinkRenderer();
$loginUrl = $title->getLinkURL( $query, false, PROTO_RELATIVE );
$loginLink = $linkRenderer->makeKnownLink(
$title,
$this->msg( 'loginreqlink' )->text(),
[],
$query
);
$this->prepareErrorPage( $this->msg( 'loginreqtitle' ) );
$this->addHTML( $this->msg( $msg )->rawParams( $loginLink )->params( $loginUrl )->parse() );
# Don't return to a page the user can't read otherwise
# we'll end up in a pointless loop
if ( $displayReturnto && $this->getAuthority()->probablyCan( 'read', $displayReturnto ) ) {
$this->returnToMain( null, $displayReturnto );
}
} else {
$this->prepareErrorPage( $this->msg( 'permissionserrors' ) );
$this->addWikiTextAsInterface( $this->formatPermissionsErrorMessage( $errors, $action ) );
}
}
/**
* Display an error page indicating that a given version of MediaWiki is
* required to use it
*
* @param mixed $version The version of MediaWiki needed to use the page
*/
public function versionRequired( $version ) {
$this->prepareErrorPage( $this->msg( 'versionrequired', $version ) );
$this->addWikiMsg( 'versionrequiredtext', $version );
$this->returnToMain();
}
/**
* Format permission $status obtained from Authority for display.
*
* @param PermissionStatus $status
* @param string|null $action that was denied or null if unknown
* @return string
*/
public function formatPermissionStatus( PermissionStatus $status, string $action = null ): string {
if ( $status->isGood() ) {
return '';
}
return $this->formatPermissionsErrorMessage( $status->toLegacyErrorArray(), $action );
}
/**
* Format a list of error messages
*
* @deprecated since 1.36. Use ::formatPermissionStatus instead
* @param array $errors Array of arrays returned by PermissionManager::getPermissionErrors
* @phan-param non-empty-array[] $errors
* @param string|null $action Action that was denied or null if unknown
* @return string The wikitext error-messages, formatted into a list.
*/
public function formatPermissionsErrorMessage( array $errors, $action = null ) {
if ( $action == null ) {
$text = $this->msg( 'permissionserrorstext', count( $errors ) )->plain() . "\n\n";
} else {
$action_desc = $this->msg( "action-$action" )->plain();
$text = $this->msg(
'permissionserrorstext-withaction',
count( $errors ),
$action_desc
)->plain() . "\n\n";
}
if ( count( $errors ) > 1 ) {
$text .= '<ul class="permissions-errors">' . "\n";
foreach ( $errors as $error ) {
$text .= '<li>';
$text .= $this->msg( ...$error )->plain();
$text .= "</li>\n";
}
$text .= '</ul>';
} else {
$text .= "<div class=\"permissions-errors\">\n" .
// @phan-suppress-next-line PhanParamTooFewUnpack Elements of $errors already annotated as non-empty
$this->msg( ...reset( $errors ) )->plain() .
"\n</div>";
}
return $text;
}
/**
* Show a warning about replica DB lag
*
* If the lag is higher than $wgDatabaseReplicaLagCritical seconds,
* then the warning is a bit more obvious. If the lag is
* lower than $wgDatabaseReplicaLagWarning, then no warning is shown.
*
* @param int $lag Replica lag
*/
public function showLagWarning( $lag ) {
$config = $this->getConfig();
if ( $lag >= $config->get( MainConfigNames::DatabaseReplicaLagWarning ) ) {
$lag = floor( $lag ); // floor to avoid nano seconds to display
$message = $lag < $config->get( MainConfigNames::DatabaseReplicaLagCritical )
? 'lag-warn-normal'
: 'lag-warn-high';
// For grep: mw-lag-warn-normal, mw-lag-warn-high
$wrap = Html::rawElement( 'div', [ 'class' => "mw-{$message}" ], "\n$1\n" );
$this->wrapWikiMsg( "$wrap\n", [ $message, $this->getLanguage()->formatNum( $lag ) ] );
}
}
/**
* Output an error page
*
* @note FatalError exception class provides an alternative.
* @param string $message Error to output. Must be escaped for HTML.
*/
public function showFatalError( $message ) {
$this->prepareErrorPage( $this->msg( 'internalerror' ) );
$this->addHTML( $message );
2003-04-14 23:10:40 +00:00
}
/**
* Add a "return to" link pointing to a specified title
*
* @param LinkTarget $title Title to link
* @param array $query Query string parameters
* @param string|null $text Text of the link (input is not escaped)
* @param array $options Options array to pass to Linker
*/
public function addReturnTo( $title, array $query = [], $text = null, $options = [] ) {
$linkRenderer = MediaWikiServices::getInstance()
->getLinkRendererFactory()->createFromLegacyOptions( $options );
$link = $this->msg( 'returnto' )->rawParams(
$linkRenderer->makeLink( $title, $text, [], $query ) )->escaped();
$this->addHTML( "<p id=\"mw-returnto\">{$link}</p>\n" );
}
/**
* Add a "return to" link pointing to a specified title,
* or the title indicated in the request, or else the main page
*
* @param mixed|null $unused
* @param PageReference|LinkTarget|string|null $returnto Page to return to
* @param string|null $returntoquery Query string for the return to link
*/
public function returnToMain( $unused = null, $returnto = null, $returntoquery = null ) {
$returnto ??= $this->getRequest()->getText( 'returnto' );
2009-08-07 00:16:54 +00:00
$returntoquery ??= $this->getRequest()->getText( 'returntoquery' );
if ( $returnto === '' ) {
$returnto = Title::newMainPage();
2003-04-14 23:10:40 +00:00
}
if ( is_object( $returnto ) ) {
$linkTarget = TitleValue::castPageToLinkTarget( $returnto );
} else {
$linkTarget = Title::newFromText( $returnto );
}
// We don't want people to return to external interwiki. That
// might potentially be used as part of a phishing scheme
if ( !is_object( $linkTarget ) || $linkTarget->isExternal() ) {
$linkTarget = Title::newMainPage();
2006-06-23 06:53:05 +00:00
}
$this->addReturnTo( $linkTarget, wfCgiToArray( $returntoquery ) );
2003-04-14 23:10:40 +00:00
}
resourceloader: Move queue formatting out of OutputPage HTML formatting of the queue was distributed over several OutputPage methods. Each method demanding a snippet of HTML by calling makeResourceLoaderLink() with a limited amount of information. As such, makeResourceLoaderLink() was unable to provide the client with the proper state information. Centralising it also allows it to better reduce duplication in HTML output and maintain a more accurate state. Problems fixed by centralising: 1. The 'user' module is special (due to per-user 'version' and 'user' params). It is manually requested via script-src. To avoid a separate (and wrong) request from something that requires it, we set state=loading directly. However, because the module is in the bottom, the old HTML formatter could only put state=loading in the bottom also. This sometimes caused a wrong request to be fired for modules=user if something in the top queue triggered a requirement for it. 2. Since a464d1d4 (T87871) we track states of page-style modules, with purpose of allowing dependencies on style modules without risking duplicate loading on pages where the styles are loaded already. This didn't work, because the state information about page-style modules is output near the stylesheet, which is after the script tag with mw.loader.load(). That runs first, and mw.loader would still make a duplicate request before it learns the state. Changes: * Document reasons for style/script tag order in getHeadHtml (per 09537e83). * Pass $type from getModuleStyles() to getAllowedModules(). This wasn't needed before since a duplicate check in makeResourceLoaderLink() verified the origin a second time. * Declare explicit position 'top' on 'user.options' and 'user.tokens' module. Previously, OutputPage hardcoded them in the top. The new formatter doesn't. * Remove getHeadScripts(). * Remove getInlineHeadScripts(). * Remove getExternalHeadScripts(). * Remove buildCssLinks(). * Remove getScriptsForBottomQueue(). * Change where Skin::setupSkinUserCss() is called. This methods lets the skin add modules to the queue. Previously it was called from buildCssLinks(), via headElement(), via prepareQuickTemplate(), via OutputPage::output(). It's now in OutputPage::output() directly (slightly earlier). This is needed because prepareQuickTemplate() calls bottomScripts() before headElement(). And bottomScript() would lazy-initialise the queue and lock it before setupSkinUserCss() is called from headElement(). This makes execution order more predictable instead of being dependent on the arbitrary order of data extraction in prepareQuickTemplate (which varies from one skin to another). * Compute isUserModulePreview() and isKnownEmpty() for the 'user' module early on so. This avoids wrongful loading and fixes problem 1. Effective changes in output: * mw.loader.state() is now before mw.loader.load(). This fixes problem 2. * mw.loader.state() now sets 'user.options' and 'user.tokens' to "loading". * mw.loader.state() now sets 'user' (as "loading" or "ready"). Fixes problem 1. * The <script async src> tag for 'startup' changed position (slightly). Previously it was after all inline scripts and stylesheets. It's still after all inline scripts and after most stylesheets, but before any user styles. Since the queue is now formatted outside OutputPage, it can't inject the meta-ResourceLoaderDynamicStyles tag and user-stylesheet hack in the middle of existing output. This shouldn't have any noticable impact. Bug: T87871 Change-Id: I605b8cd1e1fc009b4662a0edbc54d09dd65ee1df
2016-07-15 14:13:09 +00:00
private function getRlClientContext() {
if ( !$this->rlClientContext ) {
$query = ResourceLoader::makeLoaderQuery(
[], // modules; not relevant
$this->getLanguage()->getCode(),
$this->getSkin()->getSkinName(),
$this->getUser()->isRegistered() ? $this->getUser()->getName() : null,
resourceloader: Move queue formatting out of OutputPage HTML formatting of the queue was distributed over several OutputPage methods. Each method demanding a snippet of HTML by calling makeResourceLoaderLink() with a limited amount of information. As such, makeResourceLoaderLink() was unable to provide the client with the proper state information. Centralising it also allows it to better reduce duplication in HTML output and maintain a more accurate state. Problems fixed by centralising: 1. The 'user' module is special (due to per-user 'version' and 'user' params). It is manually requested via script-src. To avoid a separate (and wrong) request from something that requires it, we set state=loading directly. However, because the module is in the bottom, the old HTML formatter could only put state=loading in the bottom also. This sometimes caused a wrong request to be fired for modules=user if something in the top queue triggered a requirement for it. 2. Since a464d1d4 (T87871) we track states of page-style modules, with purpose of allowing dependencies on style modules without risking duplicate loading on pages where the styles are loaded already. This didn't work, because the state information about page-style modules is output near the stylesheet, which is after the script tag with mw.loader.load(). That runs first, and mw.loader would still make a duplicate request before it learns the state. Changes: * Document reasons for style/script tag order in getHeadHtml (per 09537e83). * Pass $type from getModuleStyles() to getAllowedModules(). This wasn't needed before since a duplicate check in makeResourceLoaderLink() verified the origin a second time. * Declare explicit position 'top' on 'user.options' and 'user.tokens' module. Previously, OutputPage hardcoded them in the top. The new formatter doesn't. * Remove getHeadScripts(). * Remove getInlineHeadScripts(). * Remove getExternalHeadScripts(). * Remove buildCssLinks(). * Remove getScriptsForBottomQueue(). * Change where Skin::setupSkinUserCss() is called. This methods lets the skin add modules to the queue. Previously it was called from buildCssLinks(), via headElement(), via prepareQuickTemplate(), via OutputPage::output(). It's now in OutputPage::output() directly (slightly earlier). This is needed because prepareQuickTemplate() calls bottomScripts() before headElement(). And bottomScript() would lazy-initialise the queue and lock it before setupSkinUserCss() is called from headElement(). This makes execution order more predictable instead of being dependent on the arbitrary order of data extraction in prepareQuickTemplate (which varies from one skin to another). * Compute isUserModulePreview() and isKnownEmpty() for the 'user' module early on so. This avoids wrongful loading and fixes problem 1. Effective changes in output: * mw.loader.state() is now before mw.loader.load(). This fixes problem 2. * mw.loader.state() now sets 'user.options' and 'user.tokens' to "loading". * mw.loader.state() now sets 'user' (as "loading" or "ready"). Fixes problem 1. * The <script async src> tag for 'startup' changed position (slightly). Previously it was after all inline scripts and stylesheets. It's still after all inline scripts and after most stylesheets, but before any user styles. Since the queue is now formatted outside OutputPage, it can't inject the meta-ResourceLoaderDynamicStyles tag and user-stylesheet hack in the middle of existing output. This shouldn't have any noticable impact. Bug: T87871 Change-Id: I605b8cd1e1fc009b4662a0edbc54d09dd65ee1df
2016-07-15 14:13:09 +00:00
null, // version; not relevant
ResourceLoader::inDebugMode(),
null, // only; not relevant
$this->isPrintable()
resourceloader: Move queue formatting out of OutputPage HTML formatting of the queue was distributed over several OutputPage methods. Each method demanding a snippet of HTML by calling makeResourceLoaderLink() with a limited amount of information. As such, makeResourceLoaderLink() was unable to provide the client with the proper state information. Centralising it also allows it to better reduce duplication in HTML output and maintain a more accurate state. Problems fixed by centralising: 1. The 'user' module is special (due to per-user 'version' and 'user' params). It is manually requested via script-src. To avoid a separate (and wrong) request from something that requires it, we set state=loading directly. However, because the module is in the bottom, the old HTML formatter could only put state=loading in the bottom also. This sometimes caused a wrong request to be fired for modules=user if something in the top queue triggered a requirement for it. 2. Since a464d1d4 (T87871) we track states of page-style modules, with purpose of allowing dependencies on style modules without risking duplicate loading on pages where the styles are loaded already. This didn't work, because the state information about page-style modules is output near the stylesheet, which is after the script tag with mw.loader.load(). That runs first, and mw.loader would still make a duplicate request before it learns the state. Changes: * Document reasons for style/script tag order in getHeadHtml (per 09537e83). * Pass $type from getModuleStyles() to getAllowedModules(). This wasn't needed before since a duplicate check in makeResourceLoaderLink() verified the origin a second time. * Declare explicit position 'top' on 'user.options' and 'user.tokens' module. Previously, OutputPage hardcoded them in the top. The new formatter doesn't. * Remove getHeadScripts(). * Remove getInlineHeadScripts(). * Remove getExternalHeadScripts(). * Remove buildCssLinks(). * Remove getScriptsForBottomQueue(). * Change where Skin::setupSkinUserCss() is called. This methods lets the skin add modules to the queue. Previously it was called from buildCssLinks(), via headElement(), via prepareQuickTemplate(), via OutputPage::output(). It's now in OutputPage::output() directly (slightly earlier). This is needed because prepareQuickTemplate() calls bottomScripts() before headElement(). And bottomScript() would lazy-initialise the queue and lock it before setupSkinUserCss() is called from headElement(). This makes execution order more predictable instead of being dependent on the arbitrary order of data extraction in prepareQuickTemplate (which varies from one skin to another). * Compute isUserModulePreview() and isKnownEmpty() for the 'user' module early on so. This avoids wrongful loading and fixes problem 1. Effective changes in output: * mw.loader.state() is now before mw.loader.load(). This fixes problem 2. * mw.loader.state() now sets 'user.options' and 'user.tokens' to "loading". * mw.loader.state() now sets 'user' (as "loading" or "ready"). Fixes problem 1. * The <script async src> tag for 'startup' changed position (slightly). Previously it was after all inline scripts and stylesheets. It's still after all inline scripts and after most stylesheets, but before any user styles. Since the queue is now formatted outside OutputPage, it can't inject the meta-ResourceLoaderDynamicStyles tag and user-stylesheet hack in the middle of existing output. This shouldn't have any noticable impact. Bug: T87871 Change-Id: I605b8cd1e1fc009b4662a0edbc54d09dd65ee1df
2016-07-15 14:13:09 +00:00
);
$this->rlClientContext = new RL\Context(
resourceloader: Move queue formatting out of OutputPage HTML formatting of the queue was distributed over several OutputPage methods. Each method demanding a snippet of HTML by calling makeResourceLoaderLink() with a limited amount of information. As such, makeResourceLoaderLink() was unable to provide the client with the proper state information. Centralising it also allows it to better reduce duplication in HTML output and maintain a more accurate state. Problems fixed by centralising: 1. The 'user' module is special (due to per-user 'version' and 'user' params). It is manually requested via script-src. To avoid a separate (and wrong) request from something that requires it, we set state=loading directly. However, because the module is in the bottom, the old HTML formatter could only put state=loading in the bottom also. This sometimes caused a wrong request to be fired for modules=user if something in the top queue triggered a requirement for it. 2. Since a464d1d4 (T87871) we track states of page-style modules, with purpose of allowing dependencies on style modules without risking duplicate loading on pages where the styles are loaded already. This didn't work, because the state information about page-style modules is output near the stylesheet, which is after the script tag with mw.loader.load(). That runs first, and mw.loader would still make a duplicate request before it learns the state. Changes: * Document reasons for style/script tag order in getHeadHtml (per 09537e83). * Pass $type from getModuleStyles() to getAllowedModules(). This wasn't needed before since a duplicate check in makeResourceLoaderLink() verified the origin a second time. * Declare explicit position 'top' on 'user.options' and 'user.tokens' module. Previously, OutputPage hardcoded them in the top. The new formatter doesn't. * Remove getHeadScripts(). * Remove getInlineHeadScripts(). * Remove getExternalHeadScripts(). * Remove buildCssLinks(). * Remove getScriptsForBottomQueue(). * Change where Skin::setupSkinUserCss() is called. This methods lets the skin add modules to the queue. Previously it was called from buildCssLinks(), via headElement(), via prepareQuickTemplate(), via OutputPage::output(). It's now in OutputPage::output() directly (slightly earlier). This is needed because prepareQuickTemplate() calls bottomScripts() before headElement(). And bottomScript() would lazy-initialise the queue and lock it before setupSkinUserCss() is called from headElement(). This makes execution order more predictable instead of being dependent on the arbitrary order of data extraction in prepareQuickTemplate (which varies from one skin to another). * Compute isUserModulePreview() and isKnownEmpty() for the 'user' module early on so. This avoids wrongful loading and fixes problem 1. Effective changes in output: * mw.loader.state() is now before mw.loader.load(). This fixes problem 2. * mw.loader.state() now sets 'user.options' and 'user.tokens' to "loading". * mw.loader.state() now sets 'user' (as "loading" or "ready"). Fixes problem 1. * The <script async src> tag for 'startup' changed position (slightly). Previously it was after all inline scripts and stylesheets. It's still after all inline scripts and after most stylesheets, but before any user styles. Since the queue is now formatted outside OutputPage, it can't inject the meta-ResourceLoaderDynamicStyles tag and user-stylesheet hack in the middle of existing output. This shouldn't have any noticable impact. Bug: T87871 Change-Id: I605b8cd1e1fc009b4662a0edbc54d09dd65ee1df
2016-07-15 14:13:09 +00:00
$this->getResourceLoader(),
new FauxRequest( $query )
);
if ( $this->contentOverrideCallbacks ) {
$this->rlClientContext = new RL\DerivativeContext( $this->rlClientContext );
$this->rlClientContext->setContentOverrideCallback( function ( $title ) {
foreach ( $this->contentOverrideCallbacks as $callback ) {
$content = $callback( $title );
if ( $content !== null ) {
$text = ( $content instanceof TextContent ) ? $content->getText() : '';
if ( strpos( $text, '</script>' ) !== false ) {
// Proactively replace this so that we can display a message
// to the user, instead of letting it go to Html::inlineScript(),
// where it would be considered a server-side issue.
$content = new JavaScriptContent(
Xml::encodeJsCall( 'mw.log.error', [
"Cannot preview $title due to script-closing tag."
] )
);
}
return $content;
}
}
return null;
} );
}
resourceloader: Move queue formatting out of OutputPage HTML formatting of the queue was distributed over several OutputPage methods. Each method demanding a snippet of HTML by calling makeResourceLoaderLink() with a limited amount of information. As such, makeResourceLoaderLink() was unable to provide the client with the proper state information. Centralising it also allows it to better reduce duplication in HTML output and maintain a more accurate state. Problems fixed by centralising: 1. The 'user' module is special (due to per-user 'version' and 'user' params). It is manually requested via script-src. To avoid a separate (and wrong) request from something that requires it, we set state=loading directly. However, because the module is in the bottom, the old HTML formatter could only put state=loading in the bottom also. This sometimes caused a wrong request to be fired for modules=user if something in the top queue triggered a requirement for it. 2. Since a464d1d4 (T87871) we track states of page-style modules, with purpose of allowing dependencies on style modules without risking duplicate loading on pages where the styles are loaded already. This didn't work, because the state information about page-style modules is output near the stylesheet, which is after the script tag with mw.loader.load(). That runs first, and mw.loader would still make a duplicate request before it learns the state. Changes: * Document reasons for style/script tag order in getHeadHtml (per 09537e83). * Pass $type from getModuleStyles() to getAllowedModules(). This wasn't needed before since a duplicate check in makeResourceLoaderLink() verified the origin a second time. * Declare explicit position 'top' on 'user.options' and 'user.tokens' module. Previously, OutputPage hardcoded them in the top. The new formatter doesn't. * Remove getHeadScripts(). * Remove getInlineHeadScripts(). * Remove getExternalHeadScripts(). * Remove buildCssLinks(). * Remove getScriptsForBottomQueue(). * Change where Skin::setupSkinUserCss() is called. This methods lets the skin add modules to the queue. Previously it was called from buildCssLinks(), via headElement(), via prepareQuickTemplate(), via OutputPage::output(). It's now in OutputPage::output() directly (slightly earlier). This is needed because prepareQuickTemplate() calls bottomScripts() before headElement(). And bottomScript() would lazy-initialise the queue and lock it before setupSkinUserCss() is called from headElement(). This makes execution order more predictable instead of being dependent on the arbitrary order of data extraction in prepareQuickTemplate (which varies from one skin to another). * Compute isUserModulePreview() and isKnownEmpty() for the 'user' module early on so. This avoids wrongful loading and fixes problem 1. Effective changes in output: * mw.loader.state() is now before mw.loader.load(). This fixes problem 2. * mw.loader.state() now sets 'user.options' and 'user.tokens' to "loading". * mw.loader.state() now sets 'user' (as "loading" or "ready"). Fixes problem 1. * The <script async src> tag for 'startup' changed position (slightly). Previously it was after all inline scripts and stylesheets. It's still after all inline scripts and after most stylesheets, but before any user styles. Since the queue is now formatted outside OutputPage, it can't inject the meta-ResourceLoaderDynamicStyles tag and user-stylesheet hack in the middle of existing output. This shouldn't have any noticable impact. Bug: T87871 Change-Id: I605b8cd1e1fc009b4662a0edbc54d09dd65ee1df
2016-07-15 14:13:09 +00:00
}
return $this->rlClientContext;
}
/**
* Call this to freeze the module queue and JS config and create a formatter.
*
* Depending on the Skin, this may get lazy-initialised in either headElement() or
* getBottomScripts(). See SkinTemplate::prepareQuickTemplate(). Calling this too early may
* cause unexpected side-effects since disallowUserJs() may be called at any time to change
* the module filters retroactively. Skins and extension hooks may also add modules until very
* late in the request lifecycle.
*
* @return RL\ClientHtml
resourceloader: Move queue formatting out of OutputPage HTML formatting of the queue was distributed over several OutputPage methods. Each method demanding a snippet of HTML by calling makeResourceLoaderLink() with a limited amount of information. As such, makeResourceLoaderLink() was unable to provide the client with the proper state information. Centralising it also allows it to better reduce duplication in HTML output and maintain a more accurate state. Problems fixed by centralising: 1. The 'user' module is special (due to per-user 'version' and 'user' params). It is manually requested via script-src. To avoid a separate (and wrong) request from something that requires it, we set state=loading directly. However, because the module is in the bottom, the old HTML formatter could only put state=loading in the bottom also. This sometimes caused a wrong request to be fired for modules=user if something in the top queue triggered a requirement for it. 2. Since a464d1d4 (T87871) we track states of page-style modules, with purpose of allowing dependencies on style modules without risking duplicate loading on pages where the styles are loaded already. This didn't work, because the state information about page-style modules is output near the stylesheet, which is after the script tag with mw.loader.load(). That runs first, and mw.loader would still make a duplicate request before it learns the state. Changes: * Document reasons for style/script tag order in getHeadHtml (per 09537e83). * Pass $type from getModuleStyles() to getAllowedModules(). This wasn't needed before since a duplicate check in makeResourceLoaderLink() verified the origin a second time. * Declare explicit position 'top' on 'user.options' and 'user.tokens' module. Previously, OutputPage hardcoded them in the top. The new formatter doesn't. * Remove getHeadScripts(). * Remove getInlineHeadScripts(). * Remove getExternalHeadScripts(). * Remove buildCssLinks(). * Remove getScriptsForBottomQueue(). * Change where Skin::setupSkinUserCss() is called. This methods lets the skin add modules to the queue. Previously it was called from buildCssLinks(), via headElement(), via prepareQuickTemplate(), via OutputPage::output(). It's now in OutputPage::output() directly (slightly earlier). This is needed because prepareQuickTemplate() calls bottomScripts() before headElement(). And bottomScript() would lazy-initialise the queue and lock it before setupSkinUserCss() is called from headElement(). This makes execution order more predictable instead of being dependent on the arbitrary order of data extraction in prepareQuickTemplate (which varies from one skin to another). * Compute isUserModulePreview() and isKnownEmpty() for the 'user' module early on so. This avoids wrongful loading and fixes problem 1. Effective changes in output: * mw.loader.state() is now before mw.loader.load(). This fixes problem 2. * mw.loader.state() now sets 'user.options' and 'user.tokens' to "loading". * mw.loader.state() now sets 'user' (as "loading" or "ready"). Fixes problem 1. * The <script async src> tag for 'startup' changed position (slightly). Previously it was after all inline scripts and stylesheets. It's still after all inline scripts and after most stylesheets, but before any user styles. Since the queue is now formatted outside OutputPage, it can't inject the meta-ResourceLoaderDynamicStyles tag and user-stylesheet hack in the middle of existing output. This shouldn't have any noticable impact. Bug: T87871 Change-Id: I605b8cd1e1fc009b4662a0edbc54d09dd65ee1df
2016-07-15 14:13:09 +00:00
*/
public function getRlClient() {
if ( !$this->rlClient ) {
$context = $this->getRlClientContext();
$rl = $this->getResourceLoader();
resourceloader: Move queue formatting out of OutputPage HTML formatting of the queue was distributed over several OutputPage methods. Each method demanding a snippet of HTML by calling makeResourceLoaderLink() with a limited amount of information. As such, makeResourceLoaderLink() was unable to provide the client with the proper state information. Centralising it also allows it to better reduce duplication in HTML output and maintain a more accurate state. Problems fixed by centralising: 1. The 'user' module is special (due to per-user 'version' and 'user' params). It is manually requested via script-src. To avoid a separate (and wrong) request from something that requires it, we set state=loading directly. However, because the module is in the bottom, the old HTML formatter could only put state=loading in the bottom also. This sometimes caused a wrong request to be fired for modules=user if something in the top queue triggered a requirement for it. 2. Since a464d1d4 (T87871) we track states of page-style modules, with purpose of allowing dependencies on style modules without risking duplicate loading on pages where the styles are loaded already. This didn't work, because the state information about page-style modules is output near the stylesheet, which is after the script tag with mw.loader.load(). That runs first, and mw.loader would still make a duplicate request before it learns the state. Changes: * Document reasons for style/script tag order in getHeadHtml (per 09537e83). * Pass $type from getModuleStyles() to getAllowedModules(). This wasn't needed before since a duplicate check in makeResourceLoaderLink() verified the origin a second time. * Declare explicit position 'top' on 'user.options' and 'user.tokens' module. Previously, OutputPage hardcoded them in the top. The new formatter doesn't. * Remove getHeadScripts(). * Remove getInlineHeadScripts(). * Remove getExternalHeadScripts(). * Remove buildCssLinks(). * Remove getScriptsForBottomQueue(). * Change where Skin::setupSkinUserCss() is called. This methods lets the skin add modules to the queue. Previously it was called from buildCssLinks(), via headElement(), via prepareQuickTemplate(), via OutputPage::output(). It's now in OutputPage::output() directly (slightly earlier). This is needed because prepareQuickTemplate() calls bottomScripts() before headElement(). And bottomScript() would lazy-initialise the queue and lock it before setupSkinUserCss() is called from headElement(). This makes execution order more predictable instead of being dependent on the arbitrary order of data extraction in prepareQuickTemplate (which varies from one skin to another). * Compute isUserModulePreview() and isKnownEmpty() for the 'user' module early on so. This avoids wrongful loading and fixes problem 1. Effective changes in output: * mw.loader.state() is now before mw.loader.load(). This fixes problem 2. * mw.loader.state() now sets 'user.options' and 'user.tokens' to "loading". * mw.loader.state() now sets 'user' (as "loading" or "ready"). Fixes problem 1. * The <script async src> tag for 'startup' changed position (slightly). Previously it was after all inline scripts and stylesheets. It's still after all inline scripts and after most stylesheets, but before any user styles. Since the queue is now formatted outside OutputPage, it can't inject the meta-ResourceLoaderDynamicStyles tag and user-stylesheet hack in the middle of existing output. This shouldn't have any noticable impact. Bug: T87871 Change-Id: I605b8cd1e1fc009b4662a0edbc54d09dd65ee1df
2016-07-15 14:13:09 +00:00
$this->addModules( [
'user',
resourceloader: Move queue formatting out of OutputPage HTML formatting of the queue was distributed over several OutputPage methods. Each method demanding a snippet of HTML by calling makeResourceLoaderLink() with a limited amount of information. As such, makeResourceLoaderLink() was unable to provide the client with the proper state information. Centralising it also allows it to better reduce duplication in HTML output and maintain a more accurate state. Problems fixed by centralising: 1. The 'user' module is special (due to per-user 'version' and 'user' params). It is manually requested via script-src. To avoid a separate (and wrong) request from something that requires it, we set state=loading directly. However, because the module is in the bottom, the old HTML formatter could only put state=loading in the bottom also. This sometimes caused a wrong request to be fired for modules=user if something in the top queue triggered a requirement for it. 2. Since a464d1d4 (T87871) we track states of page-style modules, with purpose of allowing dependencies on style modules without risking duplicate loading on pages where the styles are loaded already. This didn't work, because the state information about page-style modules is output near the stylesheet, which is after the script tag with mw.loader.load(). That runs first, and mw.loader would still make a duplicate request before it learns the state. Changes: * Document reasons for style/script tag order in getHeadHtml (per 09537e83). * Pass $type from getModuleStyles() to getAllowedModules(). This wasn't needed before since a duplicate check in makeResourceLoaderLink() verified the origin a second time. * Declare explicit position 'top' on 'user.options' and 'user.tokens' module. Previously, OutputPage hardcoded them in the top. The new formatter doesn't. * Remove getHeadScripts(). * Remove getInlineHeadScripts(). * Remove getExternalHeadScripts(). * Remove buildCssLinks(). * Remove getScriptsForBottomQueue(). * Change where Skin::setupSkinUserCss() is called. This methods lets the skin add modules to the queue. Previously it was called from buildCssLinks(), via headElement(), via prepareQuickTemplate(), via OutputPage::output(). It's now in OutputPage::output() directly (slightly earlier). This is needed because prepareQuickTemplate() calls bottomScripts() before headElement(). And bottomScript() would lazy-initialise the queue and lock it before setupSkinUserCss() is called from headElement(). This makes execution order more predictable instead of being dependent on the arbitrary order of data extraction in prepareQuickTemplate (which varies from one skin to another). * Compute isUserModulePreview() and isKnownEmpty() for the 'user' module early on so. This avoids wrongful loading and fixes problem 1. Effective changes in output: * mw.loader.state() is now before mw.loader.load(). This fixes problem 2. * mw.loader.state() now sets 'user.options' and 'user.tokens' to "loading". * mw.loader.state() now sets 'user' (as "loading" or "ready"). Fixes problem 1. * The <script async src> tag for 'startup' changed position (slightly). Previously it was after all inline scripts and stylesheets. It's still after all inline scripts and after most stylesheets, but before any user styles. Since the queue is now formatted outside OutputPage, it can't inject the meta-ResourceLoaderDynamicStyles tag and user-stylesheet hack in the middle of existing output. This shouldn't have any noticable impact. Bug: T87871 Change-Id: I605b8cd1e1fc009b4662a0edbc54d09dd65ee1df
2016-07-15 14:13:09 +00:00
'user.options',
] );
$this->addModuleStyles( [
'site.styles',
'noscript',
'user.styles',
] );
// Prepare exempt modules for buildExemptModules()
$exemptGroups = [
RL\Module::GROUP_SITE => [],
RL\Module::GROUP_NOSCRIPT => [],
RL\Module::GROUP_PRIVATE => [],
RL\Module::GROUP_USER => []
];
$exemptStates = [];
$moduleStyles = $this->getModuleStyles( /*filter*/ true );
// Preload getTitleInfo for isKnownEmpty calls below and in RL\ClientHtml
// Separate user-specific batch for improved cache-hit ratio.
$userBatch = [ 'user.styles', 'user' ];
$siteBatch = array_diff( $moduleStyles, $userBatch );
$dbr = wfGetDB( DB_REPLICA );
RL\WikiModule::preloadTitleInfo( $context, $dbr, $siteBatch );
RL\WikiModule::preloadTitleInfo( $context, $dbr, $userBatch );
// Filter out modules handled by buildExemptModules()
$moduleStyles = array_filter( $moduleStyles,
static function ( $name ) use ( $rl, $context, &$exemptGroups, &$exemptStates ) {
$module = $rl->getModule( $name );
if ( $module ) {
$group = $module->getGroup();
if ( $group !== null && isset( $exemptGroups[$group] ) ) {
// The `noscript` module is excluded from the client
// side registry, no need to set its state either.
// But we still output it. See T291735
if ( $group !== RL\Module::GROUP_NOSCRIPT ) {
$exemptStates[$name] = 'ready';
}
if ( !$module->isKnownEmpty( $context ) ) {
// E.g. Don't output empty <styles>
$exemptGroups[$group][] = $name;
}
return false;
}
}
return true;
}
);
$this->rlExemptStyleModules = $exemptGroups;
ResourceLoader: Follow-up to adding ResourceLoaderClientPreferences Minor clean up: * Fix broken `@see` in MainConfigSchema. * Add missing `@since`. * Doc experimental nature, as per the Ic3b6eec1995393 msg. * Doc anonymous scope, and mention general strategy for elsewhere. * Dependency inject, to separate concerns and keep ClientHtml decoupled from MediaWiki settings like wgCookiePrefix, which otherwise break testing this class with only RL-specific config. * Apply JS conventions. Made easier by using "JS" as the heredoc identifier, which IDEs recognise as for highlighting. * Move code together with the other documentElement.className statement. This helps both with understanding the PHP side in terms of related logic and how it interacts, as well as the frontend as it literally brings <html script>, client-js, and clientpref all next to each other. HTML weight of default Main_Page on localhost, logged-out: * vector : 23.21 kB / 140.48 kB * vector-2022 : 24.17 kB / 146.43 kB +6.0 kB * vector-2022 ClientPref=true before : 24.28 kB / 146.70 kB +6.3 kB * vector-2022 ClientPref=true after : 24.27 kB / 146.68 kB +6.2 kB Given: * $wgResourceLoaderClientPreferences = true; Test plan: 1. View /wiki/Main_Page?useskin=vector-2022 while logged-out, confirm the inline script is there, and "vector-feature-limited-width-content" is set on <html class>, layout width appears fixed. 2. Run mw.cookie.set('mwclientprefs', 'vector-feature-limited-width-content'); 3. Refresh and confirm the class is changed at runtime and layout width is fluid. Use mw.cookie.set('mwclientprefs', null) to undo. Bug: T321498 Change-Id: I07f471b815ffadfca9eb4f7bd228cb72dfd1ec9b
2023-01-25 01:21:41 +00:00
$config = $this->getConfig();
$clientPrefEnabled = (
$config->get( MainConfigNames::ResourceLoaderClientPreferences ) &&
!$this->getUser()->isRegistered()
);
$clientPrefCookiePrefix = $config->get( MainConfigNames::CookiePrefix );
$rlClient = new RL\ClientHtml( $context, [
'target' => $this->getTarget(),
'nonce' => $this->CSP->getNonce(),
// When 'safemode', disallowUserJs(), or reduceAllowedModules() is used
// to only restrict modules to ORIGIN_CORE (ie. disallow ORIGIN_USER), the list of
// modules enqueued for loading on this page is filtered to just those.
// However, to make sure we also apply the restriction to dynamic dependencies and
// lazy-loaded modules at run-time on the client-side, pass 'safemode' down to the
// StartupModule so that the client-side registry will not contain any restricted
// modules either. (T152169, T185303)
'safemode' => ( $this->getAllowedModules( RL\Module::TYPE_COMBINED )
<= RL\Module::ORIGIN_CORE_INDIVIDUAL
) ? '1' : null,
ResourceLoader: Follow-up to adding ResourceLoaderClientPreferences Minor clean up: * Fix broken `@see` in MainConfigSchema. * Add missing `@since`. * Doc experimental nature, as per the Ic3b6eec1995393 msg. * Doc anonymous scope, and mention general strategy for elsewhere. * Dependency inject, to separate concerns and keep ClientHtml decoupled from MediaWiki settings like wgCookiePrefix, which otherwise break testing this class with only RL-specific config. * Apply JS conventions. Made easier by using "JS" as the heredoc identifier, which IDEs recognise as for highlighting. * Move code together with the other documentElement.className statement. This helps both with understanding the PHP side in terms of related logic and how it interacts, as well as the frontend as it literally brings <html script>, client-js, and clientpref all next to each other. HTML weight of default Main_Page on localhost, logged-out: * vector : 23.21 kB / 140.48 kB * vector-2022 : 24.17 kB / 146.43 kB +6.0 kB * vector-2022 ClientPref=true before : 24.28 kB / 146.70 kB +6.3 kB * vector-2022 ClientPref=true after : 24.27 kB / 146.68 kB +6.2 kB Given: * $wgResourceLoaderClientPreferences = true; Test plan: 1. View /wiki/Main_Page?useskin=vector-2022 while logged-out, confirm the inline script is there, and "vector-feature-limited-width-content" is set on <html class>, layout width appears fixed. 2. Run mw.cookie.set('mwclientprefs', 'vector-feature-limited-width-content'); 3. Refresh and confirm the class is changed at runtime and layout width is fluid. Use mw.cookie.set('mwclientprefs', null) to undo. Bug: T321498 Change-Id: I07f471b815ffadfca9eb4f7bd228cb72dfd1ec9b
2023-01-25 01:21:41 +00:00
'clientPrefEnabled' => $clientPrefEnabled,
'clientPrefCookiePrefix' => $clientPrefCookiePrefix,
] );
$rlClient->setConfig( $this->getJSVars( self::JS_VAR_EARLY ) );
resourceloader: Move queue formatting out of OutputPage HTML formatting of the queue was distributed over several OutputPage methods. Each method demanding a snippet of HTML by calling makeResourceLoaderLink() with a limited amount of information. As such, makeResourceLoaderLink() was unable to provide the client with the proper state information. Centralising it also allows it to better reduce duplication in HTML output and maintain a more accurate state. Problems fixed by centralising: 1. The 'user' module is special (due to per-user 'version' and 'user' params). It is manually requested via script-src. To avoid a separate (and wrong) request from something that requires it, we set state=loading directly. However, because the module is in the bottom, the old HTML formatter could only put state=loading in the bottom also. This sometimes caused a wrong request to be fired for modules=user if something in the top queue triggered a requirement for it. 2. Since a464d1d4 (T87871) we track states of page-style modules, with purpose of allowing dependencies on style modules without risking duplicate loading on pages where the styles are loaded already. This didn't work, because the state information about page-style modules is output near the stylesheet, which is after the script tag with mw.loader.load(). That runs first, and mw.loader would still make a duplicate request before it learns the state. Changes: * Document reasons for style/script tag order in getHeadHtml (per 09537e83). * Pass $type from getModuleStyles() to getAllowedModules(). This wasn't needed before since a duplicate check in makeResourceLoaderLink() verified the origin a second time. * Declare explicit position 'top' on 'user.options' and 'user.tokens' module. Previously, OutputPage hardcoded them in the top. The new formatter doesn't. * Remove getHeadScripts(). * Remove getInlineHeadScripts(). * Remove getExternalHeadScripts(). * Remove buildCssLinks(). * Remove getScriptsForBottomQueue(). * Change where Skin::setupSkinUserCss() is called. This methods lets the skin add modules to the queue. Previously it was called from buildCssLinks(), via headElement(), via prepareQuickTemplate(), via OutputPage::output(). It's now in OutputPage::output() directly (slightly earlier). This is needed because prepareQuickTemplate() calls bottomScripts() before headElement(). And bottomScript() would lazy-initialise the queue and lock it before setupSkinUserCss() is called from headElement(). This makes execution order more predictable instead of being dependent on the arbitrary order of data extraction in prepareQuickTemplate (which varies from one skin to another). * Compute isUserModulePreview() and isKnownEmpty() for the 'user' module early on so. This avoids wrongful loading and fixes problem 1. Effective changes in output: * mw.loader.state() is now before mw.loader.load(). This fixes problem 2. * mw.loader.state() now sets 'user.options' and 'user.tokens' to "loading". * mw.loader.state() now sets 'user' (as "loading" or "ready"). Fixes problem 1. * The <script async src> tag for 'startup' changed position (slightly). Previously it was after all inline scripts and stylesheets. It's still after all inline scripts and after most stylesheets, but before any user styles. Since the queue is now formatted outside OutputPage, it can't inject the meta-ResourceLoaderDynamicStyles tag and user-stylesheet hack in the middle of existing output. This shouldn't have any noticable impact. Bug: T87871 Change-Id: I605b8cd1e1fc009b4662a0edbc54d09dd65ee1df
2016-07-15 14:13:09 +00:00
$rlClient->setModules( $this->getModules( /*filter*/ true ) );
$rlClient->setModuleStyles( $moduleStyles );
$rlClient->setExemptStates( $exemptStates );
resourceloader: Move queue formatting out of OutputPage HTML formatting of the queue was distributed over several OutputPage methods. Each method demanding a snippet of HTML by calling makeResourceLoaderLink() with a limited amount of information. As such, makeResourceLoaderLink() was unable to provide the client with the proper state information. Centralising it also allows it to better reduce duplication in HTML output and maintain a more accurate state. Problems fixed by centralising: 1. The 'user' module is special (due to per-user 'version' and 'user' params). It is manually requested via script-src. To avoid a separate (and wrong) request from something that requires it, we set state=loading directly. However, because the module is in the bottom, the old HTML formatter could only put state=loading in the bottom also. This sometimes caused a wrong request to be fired for modules=user if something in the top queue triggered a requirement for it. 2. Since a464d1d4 (T87871) we track states of page-style modules, with purpose of allowing dependencies on style modules without risking duplicate loading on pages where the styles are loaded already. This didn't work, because the state information about page-style modules is output near the stylesheet, which is after the script tag with mw.loader.load(). That runs first, and mw.loader would still make a duplicate request before it learns the state. Changes: * Document reasons for style/script tag order in getHeadHtml (per 09537e83). * Pass $type from getModuleStyles() to getAllowedModules(). This wasn't needed before since a duplicate check in makeResourceLoaderLink() verified the origin a second time. * Declare explicit position 'top' on 'user.options' and 'user.tokens' module. Previously, OutputPage hardcoded them in the top. The new formatter doesn't. * Remove getHeadScripts(). * Remove getInlineHeadScripts(). * Remove getExternalHeadScripts(). * Remove buildCssLinks(). * Remove getScriptsForBottomQueue(). * Change where Skin::setupSkinUserCss() is called. This methods lets the skin add modules to the queue. Previously it was called from buildCssLinks(), via headElement(), via prepareQuickTemplate(), via OutputPage::output(). It's now in OutputPage::output() directly (slightly earlier). This is needed because prepareQuickTemplate() calls bottomScripts() before headElement(). And bottomScript() would lazy-initialise the queue and lock it before setupSkinUserCss() is called from headElement(). This makes execution order more predictable instead of being dependent on the arbitrary order of data extraction in prepareQuickTemplate (which varies from one skin to another). * Compute isUserModulePreview() and isKnownEmpty() for the 'user' module early on so. This avoids wrongful loading and fixes problem 1. Effective changes in output: * mw.loader.state() is now before mw.loader.load(). This fixes problem 2. * mw.loader.state() now sets 'user.options' and 'user.tokens' to "loading". * mw.loader.state() now sets 'user' (as "loading" or "ready"). Fixes problem 1. * The <script async src> tag for 'startup' changed position (slightly). Previously it was after all inline scripts and stylesheets. It's still after all inline scripts and after most stylesheets, but before any user styles. Since the queue is now formatted outside OutputPage, it can't inject the meta-ResourceLoaderDynamicStyles tag and user-stylesheet hack in the middle of existing output. This shouldn't have any noticable impact. Bug: T87871 Change-Id: I605b8cd1e1fc009b4662a0edbc54d09dd65ee1df
2016-07-15 14:13:09 +00:00
$this->rlClient = $rlClient;
}
return $this->rlClient;
}
/**
* @param Skin $sk The given Skin
* @param bool $includeStyle Unused
* @return string The doctype, opening "<html>", and head element.
*/
public function headElement( Skin $sk, $includeStyle = true ) {
OutputPage: Load html5shiv without indirection of load.php This library was introduced in 3a30e03645f, to make sure Grade C stylesheets that apply to HTML5 elements that older browsers might not know yet, work as expected in old IE. It originally committed a minified version and loaded it directly as an HTML script tag in a conditional comment. This had minimal impact on anything else, and was easy to maintain. In 68237fb1a74, this was changed to commit the unminified version instead because Debian maintainers don't like packaging software that contain minified files, despite being a simple file, unmodified from the original (upstream publishes it in minified form, with license header), published under a compatible free license, and embedded in a license-compliant manner. We then registered it as an unused ResourceLoader module, to be minified on-the-fly at run-time. Support for "server-registered client-unregistered" modules was removed last week in c554ee8e64e because nothing needed it anymore (except html5shiv apparently), which resulted in this module being registered client-side on all page views for all users (in latest master). This doesn't break anything, but it is a regression performance-wise. Restore this by (mostly) going to how it was before: A simple static file, committed to Git, served as-is. Not related to, served by, pulled through, nor registered with, ResourceLoader in any way. Only difference with the original approach is that it is no longer minified, which means a few more bytes transferred on old IE page views, which is considered an acceptable compromise. Bug: T201483 Change-Id: Ib0020b6bd015679b61f63eaa8109ed9b83d8ad15
2019-07-04 15:54:24 +00:00
$config = $this->getConfig();
$userdir = $this->getLanguage()->getDir();
$services = MediaWikiServices::getInstance();
$sitedir = $services->getContentLanguage()->getDir();
2003-04-14 23:10:40 +00:00
$pieces = [];
$htmlAttribs = Sanitizer::mergeAttributes( Sanitizer::mergeAttributes(
resourceloader: Move queue formatting out of OutputPage HTML formatting of the queue was distributed over several OutputPage methods. Each method demanding a snippet of HTML by calling makeResourceLoaderLink() with a limited amount of information. As such, makeResourceLoaderLink() was unable to provide the client with the proper state information. Centralising it also allows it to better reduce duplication in HTML output and maintain a more accurate state. Problems fixed by centralising: 1. The 'user' module is special (due to per-user 'version' and 'user' params). It is manually requested via script-src. To avoid a separate (and wrong) request from something that requires it, we set state=loading directly. However, because the module is in the bottom, the old HTML formatter could only put state=loading in the bottom also. This sometimes caused a wrong request to be fired for modules=user if something in the top queue triggered a requirement for it. 2. Since a464d1d4 (T87871) we track states of page-style modules, with purpose of allowing dependencies on style modules without risking duplicate loading on pages where the styles are loaded already. This didn't work, because the state information about page-style modules is output near the stylesheet, which is after the script tag with mw.loader.load(). That runs first, and mw.loader would still make a duplicate request before it learns the state. Changes: * Document reasons for style/script tag order in getHeadHtml (per 09537e83). * Pass $type from getModuleStyles() to getAllowedModules(). This wasn't needed before since a duplicate check in makeResourceLoaderLink() verified the origin a second time. * Declare explicit position 'top' on 'user.options' and 'user.tokens' module. Previously, OutputPage hardcoded them in the top. The new formatter doesn't. * Remove getHeadScripts(). * Remove getInlineHeadScripts(). * Remove getExternalHeadScripts(). * Remove buildCssLinks(). * Remove getScriptsForBottomQueue(). * Change where Skin::setupSkinUserCss() is called. This methods lets the skin add modules to the queue. Previously it was called from buildCssLinks(), via headElement(), via prepareQuickTemplate(), via OutputPage::output(). It's now in OutputPage::output() directly (slightly earlier). This is needed because prepareQuickTemplate() calls bottomScripts() before headElement(). And bottomScript() would lazy-initialise the queue and lock it before setupSkinUserCss() is called from headElement(). This makes execution order more predictable instead of being dependent on the arbitrary order of data extraction in prepareQuickTemplate (which varies from one skin to another). * Compute isUserModulePreview() and isKnownEmpty() for the 'user' module early on so. This avoids wrongful loading and fixes problem 1. Effective changes in output: * mw.loader.state() is now before mw.loader.load(). This fixes problem 2. * mw.loader.state() now sets 'user.options' and 'user.tokens' to "loading". * mw.loader.state() now sets 'user' (as "loading" or "ready"). Fixes problem 1. * The <script async src> tag for 'startup' changed position (slightly). Previously it was after all inline scripts and stylesheets. It's still after all inline scripts and after most stylesheets, but before any user styles. Since the queue is now formatted outside OutputPage, it can't inject the meta-ResourceLoaderDynamicStyles tag and user-stylesheet hack in the middle of existing output. This shouldn't have any noticable impact. Bug: T87871 Change-Id: I605b8cd1e1fc009b4662a0edbc54d09dd65ee1df
2016-07-15 14:13:09 +00:00
$this->getRlClient()->getDocumentAttributes(),
$sk->getHtmlElementAttributes()
), [ 'class' => implode( ' ', $this->mAdditionalHtmlClasses ) ] );
$pieces[] = Html::htmlHeader( $htmlAttribs );
resourceloader: Move queue formatting out of OutputPage HTML formatting of the queue was distributed over several OutputPage methods. Each method demanding a snippet of HTML by calling makeResourceLoaderLink() with a limited amount of information. As such, makeResourceLoaderLink() was unable to provide the client with the proper state information. Centralising it also allows it to better reduce duplication in HTML output and maintain a more accurate state. Problems fixed by centralising: 1. The 'user' module is special (due to per-user 'version' and 'user' params). It is manually requested via script-src. To avoid a separate (and wrong) request from something that requires it, we set state=loading directly. However, because the module is in the bottom, the old HTML formatter could only put state=loading in the bottom also. This sometimes caused a wrong request to be fired for modules=user if something in the top queue triggered a requirement for it. 2. Since a464d1d4 (T87871) we track states of page-style modules, with purpose of allowing dependencies on style modules without risking duplicate loading on pages where the styles are loaded already. This didn't work, because the state information about page-style modules is output near the stylesheet, which is after the script tag with mw.loader.load(). That runs first, and mw.loader would still make a duplicate request before it learns the state. Changes: * Document reasons for style/script tag order in getHeadHtml (per 09537e83). * Pass $type from getModuleStyles() to getAllowedModules(). This wasn't needed before since a duplicate check in makeResourceLoaderLink() verified the origin a second time. * Declare explicit position 'top' on 'user.options' and 'user.tokens' module. Previously, OutputPage hardcoded them in the top. The new formatter doesn't. * Remove getHeadScripts(). * Remove getInlineHeadScripts(). * Remove getExternalHeadScripts(). * Remove buildCssLinks(). * Remove getScriptsForBottomQueue(). * Change where Skin::setupSkinUserCss() is called. This methods lets the skin add modules to the queue. Previously it was called from buildCssLinks(), via headElement(), via prepareQuickTemplate(), via OutputPage::output(). It's now in OutputPage::output() directly (slightly earlier). This is needed because prepareQuickTemplate() calls bottomScripts() before headElement(). And bottomScript() would lazy-initialise the queue and lock it before setupSkinUserCss() is called from headElement(). This makes execution order more predictable instead of being dependent on the arbitrary order of data extraction in prepareQuickTemplate (which varies from one skin to another). * Compute isUserModulePreview() and isKnownEmpty() for the 'user' module early on so. This avoids wrongful loading and fixes problem 1. Effective changes in output: * mw.loader.state() is now before mw.loader.load(). This fixes problem 2. * mw.loader.state() now sets 'user.options' and 'user.tokens' to "loading". * mw.loader.state() now sets 'user' (as "loading" or "ready"). Fixes problem 1. * The <script async src> tag for 'startup' changed position (slightly). Previously it was after all inline scripts and stylesheets. It's still after all inline scripts and after most stylesheets, but before any user styles. Since the queue is now formatted outside OutputPage, it can't inject the meta-ResourceLoaderDynamicStyles tag and user-stylesheet hack in the middle of existing output. This shouldn't have any noticable impact. Bug: T87871 Change-Id: I605b8cd1e1fc009b4662a0edbc54d09dd65ee1df
2016-07-15 14:13:09 +00:00
$pieces[] = Html::openElement( 'head' );
if ( $this->getHTMLTitle() == '' ) {
$this->setHTMLTitle( $this->msg( 'pagetitle', $this->getPageTitle() )->inContentLanguage() );
2003-04-14 23:10:40 +00:00
}
if ( !Html::isXmlMimeType( $config->get( MainConfigNames::MimeType ) ) ) {
// Add <meta charset="UTF-8">
// This should be before <title> since it defines the charset used by
// text including the text inside <title>.
// The spec recommends defining XHTML5's charset using the XML declaration
// instead of meta.
// Our XML declaration is output by Html::htmlHeader.
// https://html.spec.whatwg.org/multipage/semantics.html#attr-meta-http-equiv-content-type
// https://html.spec.whatwg.org/multipage/semantics.html#charset
$pieces[] = Html::element( 'meta', [ 'charset' => 'UTF-8' ] );
}
$pieces[] = Html::element( 'title', [], $this->getHTMLTitle() );
$pieces[] = $this->getRlClient()->getHeadHtml( $htmlAttribs['class'] ?? null );
resourceloader: Move queue formatting out of OutputPage HTML formatting of the queue was distributed over several OutputPage methods. Each method demanding a snippet of HTML by calling makeResourceLoaderLink() with a limited amount of information. As such, makeResourceLoaderLink() was unable to provide the client with the proper state information. Centralising it also allows it to better reduce duplication in HTML output and maintain a more accurate state. Problems fixed by centralising: 1. The 'user' module is special (due to per-user 'version' and 'user' params). It is manually requested via script-src. To avoid a separate (and wrong) request from something that requires it, we set state=loading directly. However, because the module is in the bottom, the old HTML formatter could only put state=loading in the bottom also. This sometimes caused a wrong request to be fired for modules=user if something in the top queue triggered a requirement for it. 2. Since a464d1d4 (T87871) we track states of page-style modules, with purpose of allowing dependencies on style modules without risking duplicate loading on pages where the styles are loaded already. This didn't work, because the state information about page-style modules is output near the stylesheet, which is after the script tag with mw.loader.load(). That runs first, and mw.loader would still make a duplicate request before it learns the state. Changes: * Document reasons for style/script tag order in getHeadHtml (per 09537e83). * Pass $type from getModuleStyles() to getAllowedModules(). This wasn't needed before since a duplicate check in makeResourceLoaderLink() verified the origin a second time. * Declare explicit position 'top' on 'user.options' and 'user.tokens' module. Previously, OutputPage hardcoded them in the top. The new formatter doesn't. * Remove getHeadScripts(). * Remove getInlineHeadScripts(). * Remove getExternalHeadScripts(). * Remove buildCssLinks(). * Remove getScriptsForBottomQueue(). * Change where Skin::setupSkinUserCss() is called. This methods lets the skin add modules to the queue. Previously it was called from buildCssLinks(), via headElement(), via prepareQuickTemplate(), via OutputPage::output(). It's now in OutputPage::output() directly (slightly earlier). This is needed because prepareQuickTemplate() calls bottomScripts() before headElement(). And bottomScript() would lazy-initialise the queue and lock it before setupSkinUserCss() is called from headElement(). This makes execution order more predictable instead of being dependent on the arbitrary order of data extraction in prepareQuickTemplate (which varies from one skin to another). * Compute isUserModulePreview() and isKnownEmpty() for the 'user' module early on so. This avoids wrongful loading and fixes problem 1. Effective changes in output: * mw.loader.state() is now before mw.loader.load(). This fixes problem 2. * mw.loader.state() now sets 'user.options' and 'user.tokens' to "loading". * mw.loader.state() now sets 'user' (as "loading" or "ready"). Fixes problem 1. * The <script async src> tag for 'startup' changed position (slightly). Previously it was after all inline scripts and stylesheets. It's still after all inline scripts and after most stylesheets, but before any user styles. Since the queue is now formatted outside OutputPage, it can't inject the meta-ResourceLoaderDynamicStyles tag and user-stylesheet hack in the middle of existing output. This shouldn't have any noticable impact. Bug: T87871 Change-Id: I605b8cd1e1fc009b4662a0edbc54d09dd65ee1df
2016-07-15 14:13:09 +00:00
$pieces[] = $this->buildExemptModules();
$pieces = array_merge( $pieces, array_values( $this->getHeadLinksArray() ) );
$pieces = array_merge( $pieces, array_values( $this->mHeadItems ) );
resourceloader: Move queue formatting out of OutputPage HTML formatting of the queue was distributed over several OutputPage methods. Each method demanding a snippet of HTML by calling makeResourceLoaderLink() with a limited amount of information. As such, makeResourceLoaderLink() was unable to provide the client with the proper state information. Centralising it also allows it to better reduce duplication in HTML output and maintain a more accurate state. Problems fixed by centralising: 1. The 'user' module is special (due to per-user 'version' and 'user' params). It is manually requested via script-src. To avoid a separate (and wrong) request from something that requires it, we set state=loading directly. However, because the module is in the bottom, the old HTML formatter could only put state=loading in the bottom also. This sometimes caused a wrong request to be fired for modules=user if something in the top queue triggered a requirement for it. 2. Since a464d1d4 (T87871) we track states of page-style modules, with purpose of allowing dependencies on style modules without risking duplicate loading on pages where the styles are loaded already. This didn't work, because the state information about page-style modules is output near the stylesheet, which is after the script tag with mw.loader.load(). That runs first, and mw.loader would still make a duplicate request before it learns the state. Changes: * Document reasons for style/script tag order in getHeadHtml (per 09537e83). * Pass $type from getModuleStyles() to getAllowedModules(). This wasn't needed before since a duplicate check in makeResourceLoaderLink() verified the origin a second time. * Declare explicit position 'top' on 'user.options' and 'user.tokens' module. Previously, OutputPage hardcoded them in the top. The new formatter doesn't. * Remove getHeadScripts(). * Remove getInlineHeadScripts(). * Remove getExternalHeadScripts(). * Remove buildCssLinks(). * Remove getScriptsForBottomQueue(). * Change where Skin::setupSkinUserCss() is called. This methods lets the skin add modules to the queue. Previously it was called from buildCssLinks(), via headElement(), via prepareQuickTemplate(), via OutputPage::output(). It's now in OutputPage::output() directly (slightly earlier). This is needed because prepareQuickTemplate() calls bottomScripts() before headElement(). And bottomScript() would lazy-initialise the queue and lock it before setupSkinUserCss() is called from headElement(). This makes execution order more predictable instead of being dependent on the arbitrary order of data extraction in prepareQuickTemplate (which varies from one skin to another). * Compute isUserModulePreview() and isKnownEmpty() for the 'user' module early on so. This avoids wrongful loading and fixes problem 1. Effective changes in output: * mw.loader.state() is now before mw.loader.load(). This fixes problem 2. * mw.loader.state() now sets 'user.options' and 'user.tokens' to "loading". * mw.loader.state() now sets 'user' (as "loading" or "ready"). Fixes problem 1. * The <script async src> tag for 'startup' changed position (slightly). Previously it was after all inline scripts and stylesheets. It's still after all inline scripts and after most stylesheets, but before any user styles. Since the queue is now formatted outside OutputPage, it can't inject the meta-ResourceLoaderDynamicStyles tag and user-stylesheet hack in the middle of existing output. This shouldn't have any noticable impact. Bug: T87871 Change-Id: I605b8cd1e1fc009b4662a0edbc54d09dd65ee1df
2016-07-15 14:13:09 +00:00
$pieces[] = Html::closeElement( 'head' );
$skinOptions = $sk->getOptions();
$bodyClasses = array_merge( $this->mAdditionalBodyClasses, $skinOptions['bodyClasses'] );
$bodyClasses[] = 'mediawiki';
# Classes for LTR/RTL directionality support
$bodyClasses[] = $userdir;
$bodyClasses[] = "sitedir-$sitedir";
$underline = $services->getUserOptionsLookup()->getOption( $this->getUser(), 'underline' );
if ( $underline < 2 ) {
// The following classes can be used here:
// * mw-underline-always
// * mw-underline-never
$bodyClasses[] = 'mw-underline-' . ( $underline ? 'always' : 'never' );
}
// Parser feature migration class
// The idea is that this will eventually be removed, after the wikitext
// which requires it is cleaned up.
$bodyClasses[] = 'mw-hide-empty-elt';
$bodyClasses[] = $sk->getPageClasses( $this->getTitle() );
$bodyClasses[] = 'skin-' . Sanitizer::escapeClass( $sk->getSkinName() );
$bodyClasses[] =
'action-' . Sanitizer::escapeClass( $this->getContext()->getActionName() );
if ( $sk->isResponsive() ) {
$bodyClasses[] = 'skin--responsive';
}
$bodyAttrs = [];
// While the implode() is not strictly needed, it's used for backwards compatibility
// (this used to be built as a string and hooks likely still expect that).
$bodyAttrs['class'] = implode( ' ', $bodyClasses );
// Allow skins and extensions to add body attributes they need
// Get ones from deprecated method
if ( method_exists( $sk, 'addToBodyAttributes' ) ) {
/** @phan-suppress-next-line PhanUndeclaredMethod */
$sk->addToBodyAttributes( $this, $bodyAttrs );
wfDeprecated( 'Skin::addToBodyAttributes method to add body attributes', '1.35' );
}
// Then run the hook, the recommended way of adding body attributes now
Hooks::run() call site migration Migrate all callers of Hooks::run() to use the new HookContainer/HookRunner system. General principles: * Use DI if it is already used. We're not changing the way state is managed in this patch. * HookContainer is always injected, not HookRunner. HookContainer is a service, it's a more generic interface, it is the only thing that provides isRegistered() which is needed in some cases, and a HookRunner can be efficiently constructed from it (confirmed by benchmark). Because HookContainer is needed for object construction, it is also needed by all factories. * "Ask your friendly local base class". Big hierarchies like SpecialPage and ApiBase have getHookContainer() and getHookRunner() methods in the base class, and classes that extend that base class are not expected to know or care where the base class gets its HookContainer from. * ProtectedHookAccessorTrait provides protected getHookContainer() and getHookRunner() methods, getting them from the global service container. The point of this is to ease migration to DI by ensuring that call sites ask their local friendly base class rather than getting a HookRunner from the service container directly. * Private $this->hookRunner. In some smaller classes where accessor methods did not seem warranted, there is a private HookRunner property which is accessed directly. Very rarely (two cases), there is a protected property, for consistency with code that conventionally assumes protected=private, but in cases where the class might actually be overridden, a protected accessor is preferred over a protected property. * The last resort: Hooks::runner(). Mostly for static, file-scope and global code. In a few cases it was used for objects with broken construction schemes, out of horror or laziness. Constructors with new required arguments: * AuthManager * BadFileLookup * BlockManager * ClassicInterwikiLookup * ContentHandlerFactory * ContentSecurityPolicy * DefaultOptionsManager * DerivedPageDataUpdater * FullSearchResultWidget * HtmlCacheUpdater * LanguageFactory * LanguageNameUtils * LinkRenderer * LinkRendererFactory * LocalisationCache * MagicWordFactory * MessageCache * NamespaceInfo * PageEditStash * PageHandlerFactory * PageUpdater * ParserFactory * PermissionManager * RevisionStore * RevisionStoreFactory * SearchEngineConfig * SearchEngineFactory * SearchFormWidget * SearchNearMatcher * SessionBackend * SpecialPageFactory * UserNameUtils * UserOptionsManager * WatchedItemQueryService * WatchedItemStore Constructors with new optional arguments: * DefaultPreferencesFactory * Language * LinkHolderArray * MovePage * Parser * ParserCache * PasswordReset * Router setHookContainer() now required after construction: * AuthenticationProvider * ResourceLoaderModule * SearchEngine Change-Id: Id442b0dbe43aba84bd5cf801d86dedc768b082c7
2020-03-19 02:42:09 +00:00
$this->getHookRunner()->onOutputPageBodyAttributes( $this, $sk, $bodyAttrs );
$pieces[] = Html::openElement( 'body', $bodyAttrs );
resourceloader: Move queue formatting out of OutputPage HTML formatting of the queue was distributed over several OutputPage methods. Each method demanding a snippet of HTML by calling makeResourceLoaderLink() with a limited amount of information. As such, makeResourceLoaderLink() was unable to provide the client with the proper state information. Centralising it also allows it to better reduce duplication in HTML output and maintain a more accurate state. Problems fixed by centralising: 1. The 'user' module is special (due to per-user 'version' and 'user' params). It is manually requested via script-src. To avoid a separate (and wrong) request from something that requires it, we set state=loading directly. However, because the module is in the bottom, the old HTML formatter could only put state=loading in the bottom also. This sometimes caused a wrong request to be fired for modules=user if something in the top queue triggered a requirement for it. 2. Since a464d1d4 (T87871) we track states of page-style modules, with purpose of allowing dependencies on style modules without risking duplicate loading on pages where the styles are loaded already. This didn't work, because the state information about page-style modules is output near the stylesheet, which is after the script tag with mw.loader.load(). That runs first, and mw.loader would still make a duplicate request before it learns the state. Changes: * Document reasons for style/script tag order in getHeadHtml (per 09537e83). * Pass $type from getModuleStyles() to getAllowedModules(). This wasn't needed before since a duplicate check in makeResourceLoaderLink() verified the origin a second time. * Declare explicit position 'top' on 'user.options' and 'user.tokens' module. Previously, OutputPage hardcoded them in the top. The new formatter doesn't. * Remove getHeadScripts(). * Remove getInlineHeadScripts(). * Remove getExternalHeadScripts(). * Remove buildCssLinks(). * Remove getScriptsForBottomQueue(). * Change where Skin::setupSkinUserCss() is called. This methods lets the skin add modules to the queue. Previously it was called from buildCssLinks(), via headElement(), via prepareQuickTemplate(), via OutputPage::output(). It's now in OutputPage::output() directly (slightly earlier). This is needed because prepareQuickTemplate() calls bottomScripts() before headElement(). And bottomScript() would lazy-initialise the queue and lock it before setupSkinUserCss() is called from headElement(). This makes execution order more predictable instead of being dependent on the arbitrary order of data extraction in prepareQuickTemplate (which varies from one skin to another). * Compute isUserModulePreview() and isKnownEmpty() for the 'user' module early on so. This avoids wrongful loading and fixes problem 1. Effective changes in output: * mw.loader.state() is now before mw.loader.load(). This fixes problem 2. * mw.loader.state() now sets 'user.options' and 'user.tokens' to "loading". * mw.loader.state() now sets 'user' (as "loading" or "ready"). Fixes problem 1. * The <script async src> tag for 'startup' changed position (slightly). Previously it was after all inline scripts and stylesheets. It's still after all inline scripts and after most stylesheets, but before any user styles. Since the queue is now formatted outside OutputPage, it can't inject the meta-ResourceLoaderDynamicStyles tag and user-stylesheet hack in the middle of existing output. This shouldn't have any noticable impact. Bug: T87871 Change-Id: I605b8cd1e1fc009b4662a0edbc54d09dd65ee1df
2016-07-15 14:13:09 +00:00
return self::combineWrappedStrings( $pieces );
}
2010-10-02 13:45:35 +00:00
* Made Resources.php return a pure-data array instead of an ugly mix of data and code. This allows the class code to be lazy-loaded with the autoloader, for a performance advantage especially on non-APC installs. And using the convention where if the class is omitted, ResourceLoaderFileModule is assumed, the registration code becomes shorter and simpler. * Modified ResourceLoader to lazy-initialise module objects, for a further performance advantage. * Deleted ResourceLoader::getModules(), provided getModuleNames() instead. Although the startup module needs this functionality, it's slow to generate, so to avoid misuse, it's better to provide a foolproof fast interface and let the startup module do the slow thing itself. * Modified ResourceLoader::register() to optionally accept an info array instead of an object. * Added $wgResourceModules, allowing extensions to efficiently define their own resource loader modules. The trouble with hooks is that they contain code, and code is slow. We've been through all this before with i18n. Hooks are useful as a performance tool only if you call them very rarely. * Moved ResourceLoader settings to their own section in DefaultSettings.php * Added options to ResourceLoaderFileModule equivalent to the $localBasePath and $remoteBasePath parameters, to allow it to be instantiated via the new array style. Also added remoteExtPath, which allows modules to be registered before $wgExtensionAssetsPath is known. * Added OutputPage::getResourceLoader(), mostly for debugging. * The time saving at the moment is about 5ms per request with no extensions, which is significant already with 6 load.php requests for a cold cache page view. This is a much more scalable interface; the relative saving will grow as more extensions are added which use this interface, especially for non-APC installs. Although the interface is backwards compatible, extension updates will follow in a subsequent commit.
2010-11-19 10:41:06 +00:00
/**
* Get a ResourceLoader object associated with this OutputPage
2011-02-21 17:12:33 +00:00
*
* @return ResourceLoader
* Made Resources.php return a pure-data array instead of an ugly mix of data and code. This allows the class code to be lazy-loaded with the autoloader, for a performance advantage especially on non-APC installs. And using the convention where if the class is omitted, ResourceLoaderFileModule is assumed, the registration code becomes shorter and simpler. * Modified ResourceLoader to lazy-initialise module objects, for a further performance advantage. * Deleted ResourceLoader::getModules(), provided getModuleNames() instead. Although the startup module needs this functionality, it's slow to generate, so to avoid misuse, it's better to provide a foolproof fast interface and let the startup module do the slow thing itself. * Modified ResourceLoader::register() to optionally accept an info array instead of an object. * Added $wgResourceModules, allowing extensions to efficiently define their own resource loader modules. The trouble with hooks is that they contain code, and code is slow. We've been through all this before with i18n. Hooks are useful as a performance tool only if you call them very rarely. * Moved ResourceLoader settings to their own section in DefaultSettings.php * Added options to ResourceLoaderFileModule equivalent to the $localBasePath and $remoteBasePath parameters, to allow it to be instantiated via the new array style. Also added remoteExtPath, which allows modules to be registered before $wgExtensionAssetsPath is known. * Added OutputPage::getResourceLoader(), mostly for debugging. * The time saving at the moment is about 5ms per request with no extensions, which is significant already with 6 load.php requests for a cold cache page view. This is a much more scalable interface; the relative saving will grow as more extensions are added which use this interface, especially for non-APC installs. Although the interface is backwards compatible, extension updates will follow in a subsequent commit.
2010-11-19 10:41:06 +00:00
*/
public function getResourceLoader() {
if ( $this->mResourceLoader === null ) {
// Lazy-initialise as needed
$this->mResourceLoader = MediaWikiServices::getInstance()->getResourceLoader();
* Made Resources.php return a pure-data array instead of an ugly mix of data and code. This allows the class code to be lazy-loaded with the autoloader, for a performance advantage especially on non-APC installs. And using the convention where if the class is omitted, ResourceLoaderFileModule is assumed, the registration code becomes shorter and simpler. * Modified ResourceLoader to lazy-initialise module objects, for a further performance advantage. * Deleted ResourceLoader::getModules(), provided getModuleNames() instead. Although the startup module needs this functionality, it's slow to generate, so to avoid misuse, it's better to provide a foolproof fast interface and let the startup module do the slow thing itself. * Modified ResourceLoader::register() to optionally accept an info array instead of an object. * Added $wgResourceModules, allowing extensions to efficiently define their own resource loader modules. The trouble with hooks is that they contain code, and code is slow. We've been through all this before with i18n. Hooks are useful as a performance tool only if you call them very rarely. * Moved ResourceLoader settings to their own section in DefaultSettings.php * Added options to ResourceLoaderFileModule equivalent to the $localBasePath and $remoteBasePath parameters, to allow it to be instantiated via the new array style. Also added remoteExtPath, which allows modules to be registered before $wgExtensionAssetsPath is known. * Added OutputPage::getResourceLoader(), mostly for debugging. * The time saving at the moment is about 5ms per request with no extensions, which is significant already with 6 load.php requests for a cold cache page view. This is a much more scalable interface; the relative saving will grow as more extensions are added which use this interface, especially for non-APC installs. Although the interface is backwards compatible, extension updates will follow in a subsequent commit.
2010-11-19 10:41:06 +00:00
}
return $this->mResourceLoader;
2011-04-23 19:28:35 +00:00
}
* Made Resources.php return a pure-data array instead of an ugly mix of data and code. This allows the class code to be lazy-loaded with the autoloader, for a performance advantage especially on non-APC installs. And using the convention where if the class is omitted, ResourceLoaderFileModule is assumed, the registration code becomes shorter and simpler. * Modified ResourceLoader to lazy-initialise module objects, for a further performance advantage. * Deleted ResourceLoader::getModules(), provided getModuleNames() instead. Although the startup module needs this functionality, it's slow to generate, so to avoid misuse, it's better to provide a foolproof fast interface and let the startup module do the slow thing itself. * Modified ResourceLoader::register() to optionally accept an info array instead of an object. * Added $wgResourceModules, allowing extensions to efficiently define their own resource loader modules. The trouble with hooks is that they contain code, and code is slow. We've been through all this before with i18n. Hooks are useful as a performance tool only if you call them very rarely. * Moved ResourceLoader settings to their own section in DefaultSettings.php * Added options to ResourceLoaderFileModule equivalent to the $localBasePath and $remoteBasePath parameters, to allow it to be instantiated via the new array style. Also added remoteExtPath, which allows modules to be registered before $wgExtensionAssetsPath is known. * Added OutputPage::getResourceLoader(), mostly for debugging. * The time saving at the moment is about 5ms per request with no extensions, which is significant already with 6 load.php requests for a cold cache page view. This is a much more scalable interface; the relative saving will grow as more extensions are added which use this interface, especially for non-APC installs. Although the interface is backwards compatible, extension updates will follow in a subsequent commit.
2010-11-19 10:41:06 +00:00
/**
* Explicitly load or embed modules on a page.
resourceloader: Async all the way Page startup: * Due to the startup module and top queue being asynchronous now, move client-nojs/client-js class handling to OutputPage to ensure there is no flashes of wrongly styled or unstyled content. To preserve compatibility for unsupported browsers, undo the class swap at runtime after the isCompatible() check. ResourceLoader startup module: * Load the startup module with <script async>. * Use DOM methods instead of 'document.write' to create base module request (jquery|mediawiki). mw.loader: * Drop 'async' parameter from mw.loader.load(). * Remove the now-unused code paths for synchronous requests. OutputPage: * Drop '$loadCall' parameter from makeResourceLoaderLink(). Asynchronous is now the default and only way to load JavaScript. This means the 'user' module "conditional document-write scripts" are now a simple "mw.loader.load( url )" call. * Fix incorrect @return of makeResourceLoaderLink(). This returns an array not a string. * Improve documentation of makeResourceLoaderLink(). * Drop '$inHead' parameter from getScriptsForBottomQueue(). No longer used. Compatibility with the $wgResourceLoaderExperimentalAsyncLoading feature is maintained. It just no longer needs to change the way the queue works since it's always asynchronous. The feature flag now only controls whether the bottom queue starts at the bottom or starts at the top. * Remove jQuery.ready() optimisation. This was mostly there to avoid the setTimeout() loop jQuery does to detect dom-ready in IE6/IE7 (which we no longer serve JavaScript at all). And for a bug in Firefox with document.write (which is no longer used as of this commit). Bug: T107399 Change-Id: Icba6d7a87b239bf127a221bc6bc432cfa71a4a72
2015-07-28 02:46:00 +00:00
*
resourceloader: Refactor module links output Changes: * Removed hardcoded logic in OutputPage regarding modules being "enabled". Previously we would always output state=loading and use $wgAllowUserJs (and others) to decide whether to output state=ready or makeResourceLoaderLink. Now, we no longer unconditionally output state=loading and simply always call makeResourceLoaderLink. That method takes care of checking whether modules are enabled and non-empty and returns state=ready when that is the case. This cleans up cases where the duplicated and incomplete logic in OutputPage thought the module was non-empty but turned out to be empty and thus would output both state=loading and later state=ready for the same module. * Clean up documentation for makeResourceLoaderLink (inconsistent ordering of type hint and $var, and @return was missing the fact that the returned html can also contain <link>). * makeResourceLoaderLink now returns an array of html and module states. This allows the consumer of this method to combine the states in 1 larger script tag on top of multiple makeResourceLoaderLink calls (e.g. one state script followed by multiple <script src=load.php>). This isn't to reduce html output, but to make sure we inform mw.loader about modules before the <script src=load.php>. If we were to mix/alternate the state script and load.php requests (which are blocking in html), it is possible for those scripts to request other modules. We need to prevent duplicate loading of modules we already know are going to be requested by the HTML output futher down. * Removed spurious new line. Example of change in HTML output: * The output has been reduced from: - loader.state( site: loading, user: loading, user.groups: loading ) - loader.load( .. ) - <script src="load.php?modules=site .."> - loader.state( user: ready, user.groups: ready ) to: - loader.state( site: loading, user: ready, user.groups: ready ) - loader.load( .. ) - <script src="load.php?modules=site .."> Change-Id: I91754ce5fae3d05b4bfa7372372eba81ee2fc579
2013-11-14 16:54:19 +00:00
* @param array|string $modules One or more module names
* @param string $only RL\Module TYPE_ class constant
resourceloader: Async all the way Page startup: * Due to the startup module and top queue being asynchronous now, move client-nojs/client-js class handling to OutputPage to ensure there is no flashes of wrongly styled or unstyled content. To preserve compatibility for unsupported browsers, undo the class swap at runtime after the isCompatible() check. ResourceLoader startup module: * Load the startup module with <script async>. * Use DOM methods instead of 'document.write' to create base module request (jquery|mediawiki). mw.loader: * Drop 'async' parameter from mw.loader.load(). * Remove the now-unused code paths for synchronous requests. OutputPage: * Drop '$loadCall' parameter from makeResourceLoaderLink(). Asynchronous is now the default and only way to load JavaScript. This means the 'user' module "conditional document-write scripts" are now a simple "mw.loader.load( url )" call. * Fix incorrect @return of makeResourceLoaderLink(). This returns an array not a string. * Improve documentation of makeResourceLoaderLink(). * Drop '$inHead' parameter from getScriptsForBottomQueue(). No longer used. Compatibility with the $wgResourceLoaderExperimentalAsyncLoading feature is maintained. It just no longer needs to change the way the queue works since it's always asynchronous. The feature flag now only controls whether the bottom queue starts at the bottom or starts at the top. * Remove jQuery.ready() optimisation. This was mostly there to avoid the setTimeout() loop jQuery does to detect dom-ready in IE6/IE7 (which we no longer serve JavaScript at all). And for a bug in Firefox with document.write (which is no longer used as of this commit). Bug: T107399 Change-Id: Icba6d7a87b239bf127a221bc6bc432cfa71a4a72
2015-07-28 02:46:00 +00:00
* @param array $extraQuery [optional] Array with extra query parameters for the request
resourceloader: Move queue formatting out of OutputPage HTML formatting of the queue was distributed over several OutputPage methods. Each method demanding a snippet of HTML by calling makeResourceLoaderLink() with a limited amount of information. As such, makeResourceLoaderLink() was unable to provide the client with the proper state information. Centralising it also allows it to better reduce duplication in HTML output and maintain a more accurate state. Problems fixed by centralising: 1. The 'user' module is special (due to per-user 'version' and 'user' params). It is manually requested via script-src. To avoid a separate (and wrong) request from something that requires it, we set state=loading directly. However, because the module is in the bottom, the old HTML formatter could only put state=loading in the bottom also. This sometimes caused a wrong request to be fired for modules=user if something in the top queue triggered a requirement for it. 2. Since a464d1d4 (T87871) we track states of page-style modules, with purpose of allowing dependencies on style modules without risking duplicate loading on pages where the styles are loaded already. This didn't work, because the state information about page-style modules is output near the stylesheet, which is after the script tag with mw.loader.load(). That runs first, and mw.loader would still make a duplicate request before it learns the state. Changes: * Document reasons for style/script tag order in getHeadHtml (per 09537e83). * Pass $type from getModuleStyles() to getAllowedModules(). This wasn't needed before since a duplicate check in makeResourceLoaderLink() verified the origin a second time. * Declare explicit position 'top' on 'user.options' and 'user.tokens' module. Previously, OutputPage hardcoded them in the top. The new formatter doesn't. * Remove getHeadScripts(). * Remove getInlineHeadScripts(). * Remove getExternalHeadScripts(). * Remove buildCssLinks(). * Remove getScriptsForBottomQueue(). * Change where Skin::setupSkinUserCss() is called. This methods lets the skin add modules to the queue. Previously it was called from buildCssLinks(), via headElement(), via prepareQuickTemplate(), via OutputPage::output(). It's now in OutputPage::output() directly (slightly earlier). This is needed because prepareQuickTemplate() calls bottomScripts() before headElement(). And bottomScript() would lazy-initialise the queue and lock it before setupSkinUserCss() is called from headElement(). This makes execution order more predictable instead of being dependent on the arbitrary order of data extraction in prepareQuickTemplate (which varies from one skin to another). * Compute isUserModulePreview() and isKnownEmpty() for the 'user' module early on so. This avoids wrongful loading and fixes problem 1. Effective changes in output: * mw.loader.state() is now before mw.loader.load(). This fixes problem 2. * mw.loader.state() now sets 'user.options' and 'user.tokens' to "loading". * mw.loader.state() now sets 'user' (as "loading" or "ready"). Fixes problem 1. * The <script async src> tag for 'startup' changed position (slightly). Previously it was after all inline scripts and stylesheets. It's still after all inline scripts and after most stylesheets, but before any user styles. Since the queue is now formatted outside OutputPage, it can't inject the meta-ResourceLoaderDynamicStyles tag and user-stylesheet hack in the middle of existing output. This shouldn't have any noticable impact. Bug: T87871 Change-Id: I605b8cd1e1fc009b4662a0edbc54d09dd65ee1df
2016-07-15 14:13:09 +00:00
* @return string|WrappedStringList HTML
resourceloader: Async all the way Page startup: * Due to the startup module and top queue being asynchronous now, move client-nojs/client-js class handling to OutputPage to ensure there is no flashes of wrongly styled or unstyled content. To preserve compatibility for unsupported browsers, undo the class swap at runtime after the isCompatible() check. ResourceLoader startup module: * Load the startup module with <script async>. * Use DOM methods instead of 'document.write' to create base module request (jquery|mediawiki). mw.loader: * Drop 'async' parameter from mw.loader.load(). * Remove the now-unused code paths for synchronous requests. OutputPage: * Drop '$loadCall' parameter from makeResourceLoaderLink(). Asynchronous is now the default and only way to load JavaScript. This means the 'user' module "conditional document-write scripts" are now a simple "mw.loader.load( url )" call. * Fix incorrect @return of makeResourceLoaderLink(). This returns an array not a string. * Improve documentation of makeResourceLoaderLink(). * Drop '$inHead' parameter from getScriptsForBottomQueue(). No longer used. Compatibility with the $wgResourceLoaderExperimentalAsyncLoading feature is maintained. It just no longer needs to change the way the queue works since it's always asynchronous. The feature flag now only controls whether the bottom queue starts at the bottom or starts at the top. * Remove jQuery.ready() optimisation. This was mostly there to avoid the setTimeout() loop jQuery does to detect dom-ready in IE6/IE7 (which we no longer serve JavaScript at all). And for a bug in Firefox with document.write (which is no longer used as of this commit). Bug: T107399 Change-Id: Icba6d7a87b239bf127a221bc6bc432cfa71a4a72
2015-07-28 02:46:00 +00:00
*/
public function makeResourceLoaderLink( $modules, $only, array $extraQuery = [] ) {
// Apply 'target' and 'origin' filters
$modules = $this->filterModules( (array)$modules, null, $only );
return RL\ClientHtml::makeLoad(
resourceloader: Move queue formatting out of OutputPage HTML formatting of the queue was distributed over several OutputPage methods. Each method demanding a snippet of HTML by calling makeResourceLoaderLink() with a limited amount of information. As such, makeResourceLoaderLink() was unable to provide the client with the proper state information. Centralising it also allows it to better reduce duplication in HTML output and maintain a more accurate state. Problems fixed by centralising: 1. The 'user' module is special (due to per-user 'version' and 'user' params). It is manually requested via script-src. To avoid a separate (and wrong) request from something that requires it, we set state=loading directly. However, because the module is in the bottom, the old HTML formatter could only put state=loading in the bottom also. This sometimes caused a wrong request to be fired for modules=user if something in the top queue triggered a requirement for it. 2. Since a464d1d4 (T87871) we track states of page-style modules, with purpose of allowing dependencies on style modules without risking duplicate loading on pages where the styles are loaded already. This didn't work, because the state information about page-style modules is output near the stylesheet, which is after the script tag with mw.loader.load(). That runs first, and mw.loader would still make a duplicate request before it learns the state. Changes: * Document reasons for style/script tag order in getHeadHtml (per 09537e83). * Pass $type from getModuleStyles() to getAllowedModules(). This wasn't needed before since a duplicate check in makeResourceLoaderLink() verified the origin a second time. * Declare explicit position 'top' on 'user.options' and 'user.tokens' module. Previously, OutputPage hardcoded them in the top. The new formatter doesn't. * Remove getHeadScripts(). * Remove getInlineHeadScripts(). * Remove getExternalHeadScripts(). * Remove buildCssLinks(). * Remove getScriptsForBottomQueue(). * Change where Skin::setupSkinUserCss() is called. This methods lets the skin add modules to the queue. Previously it was called from buildCssLinks(), via headElement(), via prepareQuickTemplate(), via OutputPage::output(). It's now in OutputPage::output() directly (slightly earlier). This is needed because prepareQuickTemplate() calls bottomScripts() before headElement(). And bottomScript() would lazy-initialise the queue and lock it before setupSkinUserCss() is called from headElement(). This makes execution order more predictable instead of being dependent on the arbitrary order of data extraction in prepareQuickTemplate (which varies from one skin to another). * Compute isUserModulePreview() and isKnownEmpty() for the 'user' module early on so. This avoids wrongful loading and fixes problem 1. Effective changes in output: * mw.loader.state() is now before mw.loader.load(). This fixes problem 2. * mw.loader.state() now sets 'user.options' and 'user.tokens' to "loading". * mw.loader.state() now sets 'user' (as "loading" or "ready"). Fixes problem 1. * The <script async src> tag for 'startup' changed position (slightly). Previously it was after all inline scripts and stylesheets. It's still after all inline scripts and after most stylesheets, but before any user styles. Since the queue is now formatted outside OutputPage, it can't inject the meta-ResourceLoaderDynamicStyles tag and user-stylesheet hack in the middle of existing output. This shouldn't have any noticable impact. Bug: T87871 Change-Id: I605b8cd1e1fc009b4662a0edbc54d09dd65ee1df
2016-07-15 14:13:09 +00:00
$this->getRlClientContext(),
$modules,
resourceloader: Move queue formatting out of OutputPage HTML formatting of the queue was distributed over several OutputPage methods. Each method demanding a snippet of HTML by calling makeResourceLoaderLink() with a limited amount of information. As such, makeResourceLoaderLink() was unable to provide the client with the proper state information. Centralising it also allows it to better reduce duplication in HTML output and maintain a more accurate state. Problems fixed by centralising: 1. The 'user' module is special (due to per-user 'version' and 'user' params). It is manually requested via script-src. To avoid a separate (and wrong) request from something that requires it, we set state=loading directly. However, because the module is in the bottom, the old HTML formatter could only put state=loading in the bottom also. This sometimes caused a wrong request to be fired for modules=user if something in the top queue triggered a requirement for it. 2. Since a464d1d4 (T87871) we track states of page-style modules, with purpose of allowing dependencies on style modules without risking duplicate loading on pages where the styles are loaded already. This didn't work, because the state information about page-style modules is output near the stylesheet, which is after the script tag with mw.loader.load(). That runs first, and mw.loader would still make a duplicate request before it learns the state. Changes: * Document reasons for style/script tag order in getHeadHtml (per 09537e83). * Pass $type from getModuleStyles() to getAllowedModules(). This wasn't needed before since a duplicate check in makeResourceLoaderLink() verified the origin a second time. * Declare explicit position 'top' on 'user.options' and 'user.tokens' module. Previously, OutputPage hardcoded them in the top. The new formatter doesn't. * Remove getHeadScripts(). * Remove getInlineHeadScripts(). * Remove getExternalHeadScripts(). * Remove buildCssLinks(). * Remove getScriptsForBottomQueue(). * Change where Skin::setupSkinUserCss() is called. This methods lets the skin add modules to the queue. Previously it was called from buildCssLinks(), via headElement(), via prepareQuickTemplate(), via OutputPage::output(). It's now in OutputPage::output() directly (slightly earlier). This is needed because prepareQuickTemplate() calls bottomScripts() before headElement(). And bottomScript() would lazy-initialise the queue and lock it before setupSkinUserCss() is called from headElement(). This makes execution order more predictable instead of being dependent on the arbitrary order of data extraction in prepareQuickTemplate (which varies from one skin to another). * Compute isUserModulePreview() and isKnownEmpty() for the 'user' module early on so. This avoids wrongful loading and fixes problem 1. Effective changes in output: * mw.loader.state() is now before mw.loader.load(). This fixes problem 2. * mw.loader.state() now sets 'user.options' and 'user.tokens' to "loading". * mw.loader.state() now sets 'user' (as "loading" or "ready"). Fixes problem 1. * The <script async src> tag for 'startup' changed position (slightly). Previously it was after all inline scripts and stylesheets. It's still after all inline scripts and after most stylesheets, but before any user styles. Since the queue is now formatted outside OutputPage, it can't inject the meta-ResourceLoaderDynamicStyles tag and user-stylesheet hack in the middle of existing output. This shouldn't have any noticable impact. Bug: T87871 Change-Id: I605b8cd1e1fc009b4662a0edbc54d09dd65ee1df
2016-07-15 14:13:09 +00:00
$only,
Initial support for Content Security Policy, disabled by default The primary goal here is a defense in depth measure to stop an attacker who found a bug in the parser allowing them to insert malicious attributes. This wouldn't stop someone who could insert a full script tag (since at current it can't distinguish between malicious and legit user js). It also would not prevent DOM-based or reflected XSS for anons, as the nonce value is guessable for anons when receiving a response cached by varnish. However, the limited protection of just stopping stored XSS where the attacker only has control of attributes, is still a big win in my opinion. (But it wouldn't prevent someone who has that type of xss from abusing things like data-ooui attribute). This will likely break many gadgets. Its expected that any sort of rollout on Wikimedia will be done very slowly, with lots of testing and the report-only option to begin with. This is behind feature flags that are off by default, so merging this patch should not cause any change in default behaviour. This may break some extensions (The most obvious one is charinsert (See fe648d41005), but will probably need some testing in report-only mode to see if anything else breaks) This uses the unsafe-eval option of CSP, in order to support RL's local storage thingy. For better security, we may want to remove some of the sillier uses of eval (e.g. jquery.ui.datepicker.js). For more info, see spec: https://www.w3.org/TR/CSP2/ Additionally see: https://www.mediawiki.org/wiki/Requests_for_comment/Content-Security-Policy Bug: T135963 Change-Id: I80f6f469ba4c0b608385483457df96ccb7429ae5
2016-02-29 04:13:10 +00:00
$extraQuery,
$this->CSP->getNonce()
resourceloader: Move queue formatting out of OutputPage HTML formatting of the queue was distributed over several OutputPage methods. Each method demanding a snippet of HTML by calling makeResourceLoaderLink() with a limited amount of information. As such, makeResourceLoaderLink() was unable to provide the client with the proper state information. Centralising it also allows it to better reduce duplication in HTML output and maintain a more accurate state. Problems fixed by centralising: 1. The 'user' module is special (due to per-user 'version' and 'user' params). It is manually requested via script-src. To avoid a separate (and wrong) request from something that requires it, we set state=loading directly. However, because the module is in the bottom, the old HTML formatter could only put state=loading in the bottom also. This sometimes caused a wrong request to be fired for modules=user if something in the top queue triggered a requirement for it. 2. Since a464d1d4 (T87871) we track states of page-style modules, with purpose of allowing dependencies on style modules without risking duplicate loading on pages where the styles are loaded already. This didn't work, because the state information about page-style modules is output near the stylesheet, which is after the script tag with mw.loader.load(). That runs first, and mw.loader would still make a duplicate request before it learns the state. Changes: * Document reasons for style/script tag order in getHeadHtml (per 09537e83). * Pass $type from getModuleStyles() to getAllowedModules(). This wasn't needed before since a duplicate check in makeResourceLoaderLink() verified the origin a second time. * Declare explicit position 'top' on 'user.options' and 'user.tokens' module. Previously, OutputPage hardcoded them in the top. The new formatter doesn't. * Remove getHeadScripts(). * Remove getInlineHeadScripts(). * Remove getExternalHeadScripts(). * Remove buildCssLinks(). * Remove getScriptsForBottomQueue(). * Change where Skin::setupSkinUserCss() is called. This methods lets the skin add modules to the queue. Previously it was called from buildCssLinks(), via headElement(), via prepareQuickTemplate(), via OutputPage::output(). It's now in OutputPage::output() directly (slightly earlier). This is needed because prepareQuickTemplate() calls bottomScripts() before headElement(). And bottomScript() would lazy-initialise the queue and lock it before setupSkinUserCss() is called from headElement(). This makes execution order more predictable instead of being dependent on the arbitrary order of data extraction in prepareQuickTemplate (which varies from one skin to another). * Compute isUserModulePreview() and isKnownEmpty() for the 'user' module early on so. This avoids wrongful loading and fixes problem 1. Effective changes in output: * mw.loader.state() is now before mw.loader.load(). This fixes problem 2. * mw.loader.state() now sets 'user.options' and 'user.tokens' to "loading". * mw.loader.state() now sets 'user' (as "loading" or "ready"). Fixes problem 1. * The <script async src> tag for 'startup' changed position (slightly). Previously it was after all inline scripts and stylesheets. It's still after all inline scripts and after most stylesheets, but before any user styles. Since the queue is now formatted outside OutputPage, it can't inject the meta-ResourceLoaderDynamicStyles tag and user-stylesheet hack in the middle of existing output. This shouldn't have any noticable impact. Bug: T87871 Change-Id: I605b8cd1e1fc009b4662a0edbc54d09dd65ee1df
2016-07-15 14:13:09 +00:00
);
}
2010-10-02 13:45:35 +00:00
resourceloader: Refactor module links output Changes: * Removed hardcoded logic in OutputPage regarding modules being "enabled". Previously we would always output state=loading and use $wgAllowUserJs (and others) to decide whether to output state=ready or makeResourceLoaderLink. Now, we no longer unconditionally output state=loading and simply always call makeResourceLoaderLink. That method takes care of checking whether modules are enabled and non-empty and returns state=ready when that is the case. This cleans up cases where the duplicated and incomplete logic in OutputPage thought the module was non-empty but turned out to be empty and thus would output both state=loading and later state=ready for the same module. * Clean up documentation for makeResourceLoaderLink (inconsistent ordering of type hint and $var, and @return was missing the fact that the returned html can also contain <link>). * makeResourceLoaderLink now returns an array of html and module states. This allows the consumer of this method to combine the states in 1 larger script tag on top of multiple makeResourceLoaderLink calls (e.g. one state script followed by multiple <script src=load.php>). This isn't to reduce html output, but to make sure we inform mw.loader about modules before the <script src=load.php>. If we were to mix/alternate the state script and load.php requests (which are blocking in html), it is possible for those scripts to request other modules. We need to prevent duplicate loading of modules we already know are going to be requested by the HTML output futher down. * Removed spurious new line. Example of change in HTML output: * The output has been reduced from: - loader.state( site: loading, user: loading, user.groups: loading ) - loader.load( .. ) - <script src="load.php?modules=site .."> - loader.state( user: ready, user.groups: ready ) to: - loader.state( site: loading, user: ready, user.groups: ready ) - loader.load( .. ) - <script src="load.php?modules=site .."> Change-Id: I91754ce5fae3d05b4bfa7372372eba81ee2fc579
2013-11-14 16:54:19 +00:00
/**
resourceloader: Move queue formatting out of OutputPage HTML formatting of the queue was distributed over several OutputPage methods. Each method demanding a snippet of HTML by calling makeResourceLoaderLink() with a limited amount of information. As such, makeResourceLoaderLink() was unable to provide the client with the proper state information. Centralising it also allows it to better reduce duplication in HTML output and maintain a more accurate state. Problems fixed by centralising: 1. The 'user' module is special (due to per-user 'version' and 'user' params). It is manually requested via script-src. To avoid a separate (and wrong) request from something that requires it, we set state=loading directly. However, because the module is in the bottom, the old HTML formatter could only put state=loading in the bottom also. This sometimes caused a wrong request to be fired for modules=user if something in the top queue triggered a requirement for it. 2. Since a464d1d4 (T87871) we track states of page-style modules, with purpose of allowing dependencies on style modules without risking duplicate loading on pages where the styles are loaded already. This didn't work, because the state information about page-style modules is output near the stylesheet, which is after the script tag with mw.loader.load(). That runs first, and mw.loader would still make a duplicate request before it learns the state. Changes: * Document reasons for style/script tag order in getHeadHtml (per 09537e83). * Pass $type from getModuleStyles() to getAllowedModules(). This wasn't needed before since a duplicate check in makeResourceLoaderLink() verified the origin a second time. * Declare explicit position 'top' on 'user.options' and 'user.tokens' module. Previously, OutputPage hardcoded them in the top. The new formatter doesn't. * Remove getHeadScripts(). * Remove getInlineHeadScripts(). * Remove getExternalHeadScripts(). * Remove buildCssLinks(). * Remove getScriptsForBottomQueue(). * Change where Skin::setupSkinUserCss() is called. This methods lets the skin add modules to the queue. Previously it was called from buildCssLinks(), via headElement(), via prepareQuickTemplate(), via OutputPage::output(). It's now in OutputPage::output() directly (slightly earlier). This is needed because prepareQuickTemplate() calls bottomScripts() before headElement(). And bottomScript() would lazy-initialise the queue and lock it before setupSkinUserCss() is called from headElement(). This makes execution order more predictable instead of being dependent on the arbitrary order of data extraction in prepareQuickTemplate (which varies from one skin to another). * Compute isUserModulePreview() and isKnownEmpty() for the 'user' module early on so. This avoids wrongful loading and fixes problem 1. Effective changes in output: * mw.loader.state() is now before mw.loader.load(). This fixes problem 2. * mw.loader.state() now sets 'user.options' and 'user.tokens' to "loading". * mw.loader.state() now sets 'user' (as "loading" or "ready"). Fixes problem 1. * The <script async src> tag for 'startup' changed position (slightly). Previously it was after all inline scripts and stylesheets. It's still after all inline scripts and after most stylesheets, but before any user styles. Since the queue is now formatted outside OutputPage, it can't inject the meta-ResourceLoaderDynamicStyles tag and user-stylesheet hack in the middle of existing output. This shouldn't have any noticable impact. Bug: T87871 Change-Id: I605b8cd1e1fc009b4662a0edbc54d09dd65ee1df
2016-07-15 14:13:09 +00:00
* Combine WrappedString chunks and filter out empty ones
*
* @param array $chunks
* @return string|WrappedStringList HTML
resourceloader: Refactor module links output Changes: * Removed hardcoded logic in OutputPage regarding modules being "enabled". Previously we would always output state=loading and use $wgAllowUserJs (and others) to decide whether to output state=ready or makeResourceLoaderLink. Now, we no longer unconditionally output state=loading and simply always call makeResourceLoaderLink. That method takes care of checking whether modules are enabled and non-empty and returns state=ready when that is the case. This cleans up cases where the duplicated and incomplete logic in OutputPage thought the module was non-empty but turned out to be empty and thus would output both state=loading and later state=ready for the same module. * Clean up documentation for makeResourceLoaderLink (inconsistent ordering of type hint and $var, and @return was missing the fact that the returned html can also contain <link>). * makeResourceLoaderLink now returns an array of html and module states. This allows the consumer of this method to combine the states in 1 larger script tag on top of multiple makeResourceLoaderLink calls (e.g. one state script followed by multiple <script src=load.php>). This isn't to reduce html output, but to make sure we inform mw.loader about modules before the <script src=load.php>. If we were to mix/alternate the state script and load.php requests (which are blocking in html), it is possible for those scripts to request other modules. We need to prevent duplicate loading of modules we already know are going to be requested by the HTML output futher down. * Removed spurious new line. Example of change in HTML output: * The output has been reduced from: - loader.state( site: loading, user: loading, user.groups: loading ) - loader.load( .. ) - <script src="load.php?modules=site .."> - loader.state( user: ready, user.groups: ready ) to: - loader.state( site: loading, user: ready, user.groups: ready ) - loader.load( .. ) - <script src="load.php?modules=site .."> Change-Id: I91754ce5fae3d05b4bfa7372372eba81ee2fc579
2013-11-14 16:54:19 +00:00
*/
resourceloader: Move queue formatting out of OutputPage HTML formatting of the queue was distributed over several OutputPage methods. Each method demanding a snippet of HTML by calling makeResourceLoaderLink() with a limited amount of information. As such, makeResourceLoaderLink() was unable to provide the client with the proper state information. Centralising it also allows it to better reduce duplication in HTML output and maintain a more accurate state. Problems fixed by centralising: 1. The 'user' module is special (due to per-user 'version' and 'user' params). It is manually requested via script-src. To avoid a separate (and wrong) request from something that requires it, we set state=loading directly. However, because the module is in the bottom, the old HTML formatter could only put state=loading in the bottom also. This sometimes caused a wrong request to be fired for modules=user if something in the top queue triggered a requirement for it. 2. Since a464d1d4 (T87871) we track states of page-style modules, with purpose of allowing dependencies on style modules without risking duplicate loading on pages where the styles are loaded already. This didn't work, because the state information about page-style modules is output near the stylesheet, which is after the script tag with mw.loader.load(). That runs first, and mw.loader would still make a duplicate request before it learns the state. Changes: * Document reasons for style/script tag order in getHeadHtml (per 09537e83). * Pass $type from getModuleStyles() to getAllowedModules(). This wasn't needed before since a duplicate check in makeResourceLoaderLink() verified the origin a second time. * Declare explicit position 'top' on 'user.options' and 'user.tokens' module. Previously, OutputPage hardcoded them in the top. The new formatter doesn't. * Remove getHeadScripts(). * Remove getInlineHeadScripts(). * Remove getExternalHeadScripts(). * Remove buildCssLinks(). * Remove getScriptsForBottomQueue(). * Change where Skin::setupSkinUserCss() is called. This methods lets the skin add modules to the queue. Previously it was called from buildCssLinks(), via headElement(), via prepareQuickTemplate(), via OutputPage::output(). It's now in OutputPage::output() directly (slightly earlier). This is needed because prepareQuickTemplate() calls bottomScripts() before headElement(). And bottomScript() would lazy-initialise the queue and lock it before setupSkinUserCss() is called from headElement(). This makes execution order more predictable instead of being dependent on the arbitrary order of data extraction in prepareQuickTemplate (which varies from one skin to another). * Compute isUserModulePreview() and isKnownEmpty() for the 'user' module early on so. This avoids wrongful loading and fixes problem 1. Effective changes in output: * mw.loader.state() is now before mw.loader.load(). This fixes problem 2. * mw.loader.state() now sets 'user.options' and 'user.tokens' to "loading". * mw.loader.state() now sets 'user' (as "loading" or "ready"). Fixes problem 1. * The <script async src> tag for 'startup' changed position (slightly). Previously it was after all inline scripts and stylesheets. It's still after all inline scripts and after most stylesheets, but before any user styles. Since the queue is now formatted outside OutputPage, it can't inject the meta-ResourceLoaderDynamicStyles tag and user-stylesheet hack in the middle of existing output. This shouldn't have any noticable impact. Bug: T87871 Change-Id: I605b8cd1e1fc009b4662a0edbc54d09dd65ee1df
2016-07-15 14:13:09 +00:00
protected static function combineWrappedStrings( array $chunks ) {
// Filter out empty values
resourceloader: Move queue formatting out of OutputPage HTML formatting of the queue was distributed over several OutputPage methods. Each method demanding a snippet of HTML by calling makeResourceLoaderLink() with a limited amount of information. As such, makeResourceLoaderLink() was unable to provide the client with the proper state information. Centralising it also allows it to better reduce duplication in HTML output and maintain a more accurate state. Problems fixed by centralising: 1. The 'user' module is special (due to per-user 'version' and 'user' params). It is manually requested via script-src. To avoid a separate (and wrong) request from something that requires it, we set state=loading directly. However, because the module is in the bottom, the old HTML formatter could only put state=loading in the bottom also. This sometimes caused a wrong request to be fired for modules=user if something in the top queue triggered a requirement for it. 2. Since a464d1d4 (T87871) we track states of page-style modules, with purpose of allowing dependencies on style modules without risking duplicate loading on pages where the styles are loaded already. This didn't work, because the state information about page-style modules is output near the stylesheet, which is after the script tag with mw.loader.load(). That runs first, and mw.loader would still make a duplicate request before it learns the state. Changes: * Document reasons for style/script tag order in getHeadHtml (per 09537e83). * Pass $type from getModuleStyles() to getAllowedModules(). This wasn't needed before since a duplicate check in makeResourceLoaderLink() verified the origin a second time. * Declare explicit position 'top' on 'user.options' and 'user.tokens' module. Previously, OutputPage hardcoded them in the top. The new formatter doesn't. * Remove getHeadScripts(). * Remove getInlineHeadScripts(). * Remove getExternalHeadScripts(). * Remove buildCssLinks(). * Remove getScriptsForBottomQueue(). * Change where Skin::setupSkinUserCss() is called. This methods lets the skin add modules to the queue. Previously it was called from buildCssLinks(), via headElement(), via prepareQuickTemplate(), via OutputPage::output(). It's now in OutputPage::output() directly (slightly earlier). This is needed because prepareQuickTemplate() calls bottomScripts() before headElement(). And bottomScript() would lazy-initialise the queue and lock it before setupSkinUserCss() is called from headElement(). This makes execution order more predictable instead of being dependent on the arbitrary order of data extraction in prepareQuickTemplate (which varies from one skin to another). * Compute isUserModulePreview() and isKnownEmpty() for the 'user' module early on so. This avoids wrongful loading and fixes problem 1. Effective changes in output: * mw.loader.state() is now before mw.loader.load(). This fixes problem 2. * mw.loader.state() now sets 'user.options' and 'user.tokens' to "loading". * mw.loader.state() now sets 'user' (as "loading" or "ready"). Fixes problem 1. * The <script async src> tag for 'startup' changed position (slightly). Previously it was after all inline scripts and stylesheets. It's still after all inline scripts and after most stylesheets, but before any user styles. Since the queue is now formatted outside OutputPage, it can't inject the meta-ResourceLoaderDynamicStyles tag and user-stylesheet hack in the middle of existing output. This shouldn't have any noticable impact. Bug: T87871 Change-Id: I605b8cd1e1fc009b4662a0edbc54d09dd65ee1df
2016-07-15 14:13:09 +00:00
$chunks = array_filter( $chunks, 'strlen' );
return WrappedString::join( "\n", $chunks );
resourceloader: Refactor module links output Changes: * Removed hardcoded logic in OutputPage regarding modules being "enabled". Previously we would always output state=loading and use $wgAllowUserJs (and others) to decide whether to output state=ready or makeResourceLoaderLink. Now, we no longer unconditionally output state=loading and simply always call makeResourceLoaderLink. That method takes care of checking whether modules are enabled and non-empty and returns state=ready when that is the case. This cleans up cases where the duplicated and incomplete logic in OutputPage thought the module was non-empty but turned out to be empty and thus would output both state=loading and later state=ready for the same module. * Clean up documentation for makeResourceLoaderLink (inconsistent ordering of type hint and $var, and @return was missing the fact that the returned html can also contain <link>). * makeResourceLoaderLink now returns an array of html and module states. This allows the consumer of this method to combine the states in 1 larger script tag on top of multiple makeResourceLoaderLink calls (e.g. one state script followed by multiple <script src=load.php>). This isn't to reduce html output, but to make sure we inform mw.loader about modules before the <script src=load.php>. If we were to mix/alternate the state script and load.php requests (which are blocking in html), it is possible for those scripts to request other modules. We need to prevent duplicate loading of modules we already know are going to be requested by the HTML output futher down. * Removed spurious new line. Example of change in HTML output: * The output has been reduced from: - loader.state( site: loading, user: loading, user.groups: loading ) - loader.load( .. ) - <script src="load.php?modules=site .."> - loader.state( user: ready, user.groups: ready ) to: - loader.state( site: loading, user: ready, user.groups: ready ) - loader.load( .. ) - <script src="load.php?modules=site .."> Change-Id: I91754ce5fae3d05b4bfa7372372eba81ee2fc579
2013-11-14 16:54:19 +00:00
}
/**
* JS stuff to put at the bottom of the `<body>`.
* These are legacy scripts ($this->mScripts), and user JS.
*
* @param string $extraHtml (only for use by this->tailElement(); will be removed in future)
* @return string|WrappedStringList HTML
*/
public function getBottomScripts( $extraHtml = '' ) {
resourceloader: Move queue formatting out of OutputPage HTML formatting of the queue was distributed over several OutputPage methods. Each method demanding a snippet of HTML by calling makeResourceLoaderLink() with a limited amount of information. As such, makeResourceLoaderLink() was unable to provide the client with the proper state information. Centralising it also allows it to better reduce duplication in HTML output and maintain a more accurate state. Problems fixed by centralising: 1. The 'user' module is special (due to per-user 'version' and 'user' params). It is manually requested via script-src. To avoid a separate (and wrong) request from something that requires it, we set state=loading directly. However, because the module is in the bottom, the old HTML formatter could only put state=loading in the bottom also. This sometimes caused a wrong request to be fired for modules=user if something in the top queue triggered a requirement for it. 2. Since a464d1d4 (T87871) we track states of page-style modules, with purpose of allowing dependencies on style modules without risking duplicate loading on pages where the styles are loaded already. This didn't work, because the state information about page-style modules is output near the stylesheet, which is after the script tag with mw.loader.load(). That runs first, and mw.loader would still make a duplicate request before it learns the state. Changes: * Document reasons for style/script tag order in getHeadHtml (per 09537e83). * Pass $type from getModuleStyles() to getAllowedModules(). This wasn't needed before since a duplicate check in makeResourceLoaderLink() verified the origin a second time. * Declare explicit position 'top' on 'user.options' and 'user.tokens' module. Previously, OutputPage hardcoded them in the top. The new formatter doesn't. * Remove getHeadScripts(). * Remove getInlineHeadScripts(). * Remove getExternalHeadScripts(). * Remove buildCssLinks(). * Remove getScriptsForBottomQueue(). * Change where Skin::setupSkinUserCss() is called. This methods lets the skin add modules to the queue. Previously it was called from buildCssLinks(), via headElement(), via prepareQuickTemplate(), via OutputPage::output(). It's now in OutputPage::output() directly (slightly earlier). This is needed because prepareQuickTemplate() calls bottomScripts() before headElement(). And bottomScript() would lazy-initialise the queue and lock it before setupSkinUserCss() is called from headElement(). This makes execution order more predictable instead of being dependent on the arbitrary order of data extraction in prepareQuickTemplate (which varies from one skin to another). * Compute isUserModulePreview() and isKnownEmpty() for the 'user' module early on so. This avoids wrongful loading and fixes problem 1. Effective changes in output: * mw.loader.state() is now before mw.loader.load(). This fixes problem 2. * mw.loader.state() now sets 'user.options' and 'user.tokens' to "loading". * mw.loader.state() now sets 'user' (as "loading" or "ready"). Fixes problem 1. * The <script async src> tag for 'startup' changed position (slightly). Previously it was after all inline scripts and stylesheets. It's still after all inline scripts and after most stylesheets, but before any user styles. Since the queue is now formatted outside OutputPage, it can't inject the meta-ResourceLoaderDynamicStyles tag and user-stylesheet hack in the middle of existing output. This shouldn't have any noticable impact. Bug: T87871 Change-Id: I605b8cd1e1fc009b4662a0edbc54d09dd65ee1df
2016-07-15 14:13:09 +00:00
$chunks = [];
$chunks[] = $this->getRlClient()->getBodyHtml();
// Legacy non-ResourceLoader scripts
$chunks[] = $this->mScripts;
$vars = $this->getJSVars( self::JS_VAR_LATE );
if ( $this->limitReportJSData ) {
$vars['wgPageParseReport'] = $this->limitReportJSData;
}
if ( $vars ) {
$rlContext = $this->getRlClientContext();
$chunks[] = ResourceLoader::makeInlineScript(
'mw.config.set(' . $rlContext->encodeJson( $vars ) . ');',
$this->CSP->getNonce()
);
}
// Keep the hook appendage separate to preserve WrappedString objects.
// This enables BaseTemplate::getTrail() to merge them where possible.
$this->getHookRunner()->onSkinAfterBottomScripts( $this->getSkin(), $extraHtml );
$chunks = [ self::combineWrappedStrings( $chunks ) ];
if ( $extraHtml !== '' ) {
$chunks[] = $extraHtml;
}
return WrappedString::join( "\n", $chunks );
2012-01-05 23:32:41 +00:00
}
/**
* Get the javascript config vars to include on this page
*
* @return array Array of javascript config vars
* @since 1.23
*/
public function getJsConfigVars() {
return $this->mJsConfigVars;
}
/**
* Add one or more variables to be set in mw.config in JavaScript
2011-04-23 19:28:35 +00:00
*
* @param string|array $keys Key or array of key/value pairs
* @param mixed|null $value [optional] Value of the configuration variable
*/
public function addJsConfigVars( $keys, $value = null ) {
if ( is_array( $keys ) ) {
foreach ( $keys as $key => $value ) {
$this->mJsConfigVars[$key] = $value;
}
return;
}
$this->mJsConfigVars[$keys] = $value;
}
/**
* Get an array containing the variables to be set in mw.config in JavaScript.
*
* Do not add things here which can be evaluated in RL\StartUpModule,
* in other words, page-independent/site-wide variables (without state).
* These would add a blocking HTML cost to page rendering time, and require waiting for
* HTTP caches to expire before configuration changes take effect everywhere.
*
* By default, these are loaded in the HTML head and block page rendering.
* Config variable names can be set in CORE_LATE_JS_CONFIG_VAR_NAMES, or
* for extensions via the 'LateJSConfigVarNames' attribute, to opt-in to
* being sent from the end of the HTML body instead, to improve page load time.
* In JavaScript, late variables should be accessed via mw.hook('wikipage.content').
*
* @param int|null $flag Return only the specified kind of variables: self::JS_VAR_EARLY or self::JS_VAR_LATE.
* For internal use only.
2011-11-29 21:04:20 +00:00
* @return array
*/
public function getJSVars( ?int $flag = null ) {
$curRevisionId = 0;
$articleId = 0;
$canonicalSpecialPageName = false; # T23115
$services = MediaWikiServices::getInstance();
$title = $this->getTitle();
$ns = $title->getNamespace();
$nsInfo = $services->getNamespaceInfo();
$canonicalNamespace = $nsInfo->exists( $ns )
? $nsInfo->getCanonicalName( $ns )
: $title->getNsText();
$sk = $this->getSkin();
2012-03-13 17:57:54 +00:00
// Get the relevant title so that AJAX features can use the correct page name
// when making API requests from certain special pages (T36972).
$relevantTitle = $sk->getRelevantTitle();
2012-03-13 17:57:54 +00:00
if ( $ns === NS_SPECIAL ) {
[ $canonicalSpecialPageName, /*...*/ ] =
$services->getSpecialPageFactory()->
resolveAlias( $title->getDBkey() );
} elseif ( $this->canUseWikiPage() ) {
$wikiPage = $this->getWikiPage();
$curRevisionId = $wikiPage->getLatest();
$articleId = $wikiPage->getId();
}
$lang = $title->getPageViewLanguage();
// Pre-process information
$separatorTransTable = $lang->separatorTransformTable();
$separatorTransTable = $separatorTransTable ?: [];
$compactSeparatorTransTable = [
implode( "\t", array_keys( $separatorTransTable ) ),
implode( "\t", $separatorTransTable ),
];
$digitTransTable = $lang->digitTransformTable();
$digitTransTable = $digitTransTable ?: [];
$compactDigitTransTable = [
implode( "\t", array_keys( $digitTransTable ) ),
implode( "\t", $digitTransTable ),
];
$user = $this->getUser();
// Internal variables for MediaWiki core
$vars = [
// @internal For mediawiki.page.ready
'wgBreakFrames' => $this->getFrameOptions() == 'DENY',
// @internal For jquery.tablesorter
'wgSeparatorTransformTable' => $compactSeparatorTransTable,
'wgDigitTransformTable' => $compactDigitTransTable,
'wgDefaultDateFormat' => $lang->getDefaultDateFormat(),
'wgMonthNames' => $lang->getMonthNamesArray(),
// @internal For debugging purposes
'wgRequestId' => WebRequest::getRequestId(),
// @internal For mw.loader
'wgCSPNonce' => $this->CSP->getNonce(),
];
// Start of supported and stable config vars (for use by extensions/gadgets).
$vars += [
'wgCanonicalNamespace' => $canonicalNamespace,
'wgCanonicalSpecialPageName' => $canonicalSpecialPageName,
'wgNamespaceNumber' => $title->getNamespace(),
'wgPageName' => $title->getPrefixedDBkey(),
'wgTitle' => $title->getText(),
'wgCurRevisionId' => $curRevisionId,
'wgRevisionId' => (int)$this->getRevisionId(),
'wgArticleId' => $articleId,
'wgIsArticle' => $this->isArticle(),
'wgIsRedirect' => $title->isRedirect(),
'wgAction' => $this->getContext()->getActionName(),
'wgUserName' => $user->isAnon() ? null : $user->getName(),
'wgUserGroups' => $services->getUserGroupManager()->getUserEffectiveGroups( $user ),
'wgCategories' => $this->getCategories(),
'wgPageContentLanguage' => $lang->getCode(),
'wgPageContentModel' => $title->getContentModel(),
'wgRelevantPageName' => $relevantTitle->getPrefixedDBkey(),
'wgRelevantArticleId' => $relevantTitle->getArticleID(),
];
if ( $user->isRegistered() ) {
$vars['wgUserId'] = $user->getId();
$vars['wgUserIsTemp'] = $user->isTemp();
$vars['wgUserEditCount'] = $user->getEditCount();
$userReg = $user->getRegistration();
$vars['wgUserRegistration'] = $userReg ? (int)wfTimestamp( TS_UNIX, $userReg ) * 1000 : null;
// Get the revision ID of the oldest new message on the user's talk
// page. This can be used for constructing new message alerts on
// the client side.
$userNewMsgRevId = $this->getLastSeenUserTalkRevId();
// Only occupy precious space in the <head> when it is non-null (T53640)
// mw.config.get returns null by default.
if ( $userNewMsgRevId ) {
$vars['wgUserNewMsgRevisionId'] = $userNewMsgRevId;
}
}
$languageConverter = $services->getLanguageConverterFactory()
->getLanguageConverter( $title->getPageLanguage() );
if ( $languageConverter->hasVariants() ) {
$vars['wgUserVariant'] = $languageConverter->getPreferredVariant();
}
// Same test as SkinTemplate
$vars['wgIsProbablyEditable'] = $this->getAuthority()->probablyCan( 'edit', $title );
$vars['wgRelevantPageIsProbablyEditable'] = $relevantTitle &&
$this->getAuthority()->probablyCan( 'edit', $relevantTitle );
$restrictionStore = $services->getRestrictionStore();
foreach ( $restrictionStore->listApplicableRestrictionTypes( $title ) as $type ) {
// Following keys are set in $vars:
// wgRestrictionCreate, wgRestrictionEdit, wgRestrictionMove, wgRestrictionUpload
$vars['wgRestriction' . ucfirst( $type )] = $restrictionStore->getRestrictions( $title, $type );
}
if ( $title->isMainPage() ) {
$vars['wgIsMainPage'] = true;
}
$relevantUser = $sk->getRelevantUser();
if ( $relevantUser ) {
$vars['wgRelevantUserName'] = $relevantUser->getName();
}
// End of stable config vars
$titleFormatter = $services->getTitleFormatter();
if ( $this->mRedirectedFrom ) {
// @internal For skin JS
$vars['wgRedirectedFrom'] = $titleFormatter->getPrefixedDBkey( $this->mRedirectedFrom );
}
// Allow extensions to add their custom variables to the mw.config map.
// Use the 'ResourceLoaderGetConfigVars' hook if the variable is not
// page-dependent but site-wide (without state).
// Alternatively, you may want to use OutputPage->addJsConfigVars() instead.
Hooks::run() call site migration Migrate all callers of Hooks::run() to use the new HookContainer/HookRunner system. General principles: * Use DI if it is already used. We're not changing the way state is managed in this patch. * HookContainer is always injected, not HookRunner. HookContainer is a service, it's a more generic interface, it is the only thing that provides isRegistered() which is needed in some cases, and a HookRunner can be efficiently constructed from it (confirmed by benchmark). Because HookContainer is needed for object construction, it is also needed by all factories. * "Ask your friendly local base class". Big hierarchies like SpecialPage and ApiBase have getHookContainer() and getHookRunner() methods in the base class, and classes that extend that base class are not expected to know or care where the base class gets its HookContainer from. * ProtectedHookAccessorTrait provides protected getHookContainer() and getHookRunner() methods, getting them from the global service container. The point of this is to ease migration to DI by ensuring that call sites ask their local friendly base class rather than getting a HookRunner from the service container directly. * Private $this->hookRunner. In some smaller classes where accessor methods did not seem warranted, there is a private HookRunner property which is accessed directly. Very rarely (two cases), there is a protected property, for consistency with code that conventionally assumes protected=private, but in cases where the class might actually be overridden, a protected accessor is preferred over a protected property. * The last resort: Hooks::runner(). Mostly for static, file-scope and global code. In a few cases it was used for objects with broken construction schemes, out of horror or laziness. Constructors with new required arguments: * AuthManager * BadFileLookup * BlockManager * ClassicInterwikiLookup * ContentHandlerFactory * ContentSecurityPolicy * DefaultOptionsManager * DerivedPageDataUpdater * FullSearchResultWidget * HtmlCacheUpdater * LanguageFactory * LanguageNameUtils * LinkRenderer * LinkRendererFactory * LocalisationCache * MagicWordFactory * MessageCache * NamespaceInfo * PageEditStash * PageHandlerFactory * PageUpdater * ParserFactory * PermissionManager * RevisionStore * RevisionStoreFactory * SearchEngineConfig * SearchEngineFactory * SearchFormWidget * SearchNearMatcher * SessionBackend * SpecialPageFactory * UserNameUtils * UserOptionsManager * WatchedItemQueryService * WatchedItemStore Constructors with new optional arguments: * DefaultPreferencesFactory * Language * LinkHolderArray * MovePage * Parser * ParserCache * PasswordReset * Router setHookContainer() now required after construction: * AuthenticationProvider * ResourceLoaderModule * SearchEngine Change-Id: Id442b0dbe43aba84bd5cf801d86dedc768b082c7
2020-03-19 02:42:09 +00:00
$this->getHookRunner()->onMakeGlobalVariablesScript( $vars, $this );
2011-04-23 19:28:35 +00:00
// Merge in variables from addJsConfigVars last
$vars = array_merge( $vars, $this->getJsConfigVars() );
// Return only early or late vars if requested
if ( $flag !== null ) {
$lateVarNames =
array_fill_keys( self::CORE_LATE_JS_CONFIG_VAR_NAMES, true ) +
array_fill_keys( ExtensionRegistry::getInstance()->getAttribute( 'LateJSConfigVarNames' ), true );
foreach ( array_keys( $vars ) as $name ) {
// If the variable's late flag doesn't match the requested late flag, unset it
if ( isset( $lateVarNames[ $name ] ) !== ( $flag === self::JS_VAR_LATE ) ) {
unset( $vars[ $name ] );
}
}
}
return $vars;
}
/**
* Get the revision ID for the last user talk page revision viewed by the talk page owner.
*
* @return int|null
*/
private function getLastSeenUserTalkRevId() {
$services = MediaWikiServices::getInstance();
$user = $this->getUser();
$userHasNewMessages = $services
->getTalkPageNotificationManager()
->userHasNewMessages( $user );
if ( !$userHasNewMessages ) {
return null;
}
$timestamp = $services
->getTalkPageNotificationManager()
->getLatestSeenMessageTimestamp( $user );
if ( !$timestamp ) {
return null;
}
$revRecord = $services->getRevisionLookup()->getRevisionByTimestamp(
$user->getTalkPage(),
$timestamp
);
return $revRecord ? $revRecord->getId() : null;
}
/**
* To make it harder for someone to slip a user a fake
* JavaScript or CSS preview, a random token
* is associated with the login session. If it's not
* passed back with the preview request, we won't render
* the code.
*
* @return bool
*/
public function userCanPreview() {
$request = $this->getRequest();
if (
$request->getRawVal( 'action' ) !== 'submit' ||
!$request->wasPosted()
) {
return false;
}
$user = $this->getUser();
if ( !$user->isRegistered() ) {
// Anons have predictable edit tokens
return false;
}
if ( !$user->matchEditToken( $request->getVal( 'wpEditToken' ) ) ) {
return false;
}
$title = $this->getTitle();
if ( !$this->getAuthority()->probablyCan( 'edit', $title ) ) {
return false;
}
return true;
}
/**
* @return array Array in format "link name or number => 'link html'".
*/
public function getHeadLinksArray() {
$tags = [];
$config = $this->getConfig();
$tags['meta-generator'] = Html::element( 'meta', [
'name' => 'generator',
'content' => 'MediaWiki ' . MW_VERSION,
] );
here it is ... the upload-api, script-server, js2 (javascript phase2) branch merge 1st attempt. Here is a short overview of changes and associated default configuration variables (most everything is off by default) also see ~soon to be updated~: http://www.mediawiki.org/wiki/Media_Projects_Overview = Upload Improvements = ==Upload API == * Based on the early work of Bryan Tong and others it adds the upload option to the api. * We rewrite Special:Upload page to include use the new refactoring * Added in token checks in both the SpecialUpload.php page so avoids DOS / xss copy-by-url JavaScript based cross site POST file submissions == Copy by URL== $wgAllowCopyUploads = false; * http class rewrite includes a new http background download see: includes/HttpFunctions.php * spins off a php process that calls: maintenance/http_session_download.php * pushes updates to the session and gives the user a progress bar on http copy uploads from other server progress (using js2 upload interface) (if not using the js2 upload interface it does the request in-place but the download is limited to the php ini timeout time) == Firefogg == * Firefogg enables resumable upload by chunks * progress indicators and conditional invokation (js2 system) * and of-course client side transcoding. = Script Server = $wgEnableScriptLoader = false; * off by default if $wgEnableScriptLoader is turned on script files are grouped, gziped, cached etc. for more info see: http://www.mediawiki.org/wiki/Extension:ScriptLoader * Includes some early skin js include fixes (skin/script system still lots of love) * Includes a "javascript class autoloader" this is packaged into mwEmbed so that the mwEmbed library can work in stand alone mode (while retaining localization and script serving) (one such application is the make page for firefogg.org : http://www.firefogg.org/make/index.html ) * The file that contains the autojavascript loading classes is: js2/php/jsAutoloadLocalClasses.php * One can use this auto class loading dependency system with extensions and add-ons but I need to better document that. = js2 system / mwEmbed= $wgEnableJS2system = false * includes initial rewrite towards more jquery based javascript code * especially for the Special:Upload page. * Also the edit page include support for the "add-media-wizard" * includes dependency loader for javascript that optionally takes advantage of the script-loader * remote embedding of javascript interfaces (like embedding video, or commons media searching) * $wgDebugJavaScript = false; .. .this variable lets you always get "always fresh javascript". When used with the script-loader it does not minify the script-loader output. = mwEmbed = * Will commit a separate patch to oggHandler that conditionally outputs <video tag> to use the new javascript video player. ** mv_embed player includes: play-head, volume control, remote embedding, oggz-chop support across plugins. * add-media-wizard adds easy inserts of media to pages (with import) == jQuery== * we include a base install of jQuery, jQuery ui and some plugins. * all the javascript classes are in the scriptloader so its easy to load any set of jquery ui components that you may need using the script-server. You get a callback so you can then execute js with dependencies loaded. == other stuff == there is a bit more code in js2 that pertains to sequence editing, timed text display and basic image editing. We include a base import of pixastic-lib & pixastic-editor... will work with the pixastic developer to try and ensure upstream compatibility on our usage of the library for in-browser photo and sequence manipulation.
2009-07-14 23:52:14 +00:00
if ( $config->get( MainConfigNames::ReferrerPolicy ) !== false ) {
// Per https://w3c.github.io/webappsec-referrer-policy/#unknown-policy-values
// fallbacks should come before the primary value so we need to reverse the array.
foreach ( array_reverse( (array)$config->get( MainConfigNames::ReferrerPolicy ) ) as $i => $policy ) {
$tags["meta-referrer-$i"] = Html::element( 'meta', [
'name' => 'referrer',
'content' => $policy,
] );
}
}
$p = $this->getRobotsContent();
if ( $p ) {
// http://www.robotstxt.org/wc/meta-user.html
// Only show if it's different from the default robots policy
$tags['meta-robots'] = Html::element( 'meta', [
'name' => 'robots',
'content' => $p,
] );
}
# Browser based phonenumber detection
if ( $config->get( MainConfigNames::BrowserFormatDetection ) !== false ) {
$tags['meta-format-detection'] = Html::element( 'meta', [
'name' => 'format-detection',
'content' => $config->get( MainConfigNames::BrowserFormatDetection ),
] );
}
2003-04-14 23:10:40 +00:00
foreach ( $this->mMetatags as $tag ) {
if ( strncasecmp( $tag[0], 'http:', 5 ) === 0 ) {
$a = 'http-equiv';
$tag[0] = substr( $tag[0], 5 );
} elseif ( strncasecmp( $tag[0], 'og:', 3 ) === 0 ) {
$a = 'property';
} else {
$a = 'name';
2003-04-14 23:10:40 +00:00
}
$tagName = "meta-{$tag[0]}";
if ( isset( $tags[$tagName] ) ) {
$tagName .= $tag[1];
}
$tags[$tagName] = Html::element( 'meta',
[
$a => $tag[0],
'content' => $tag[1]
]
);
2003-04-14 23:10:40 +00:00
}
2003-04-14 23:10:40 +00:00
foreach ( $this->mLinktags as $tag ) {
2009-09-18 20:10:25 +00:00
$tags[] = Html::element( 'link', $tag );
2003-04-14 23:10:40 +00:00
}
if ( $config->get( MainConfigNames::UniversalEditButton ) && $this->isArticleRelated() ) {
if ( $this->getAuthority()->probablyCan( 'edit', $this->getTitle() ) ) {
$msg = $this->msg( 'edit' )->text();
// Use mime type per https://phabricator.wikimedia.org/T21165#6946526
$tags['universal-edit-button'] = Html::element( 'link', [
'rel' => 'alternate',
'type' => 'application/x-wiki',
'title' => $msg,
'href' => $this->getTitle()->getEditURL(),
] );
}
}
# Generally the order of the favicon and apple-touch-icon links
# should not matter, but Konqueror (3.5.9 at least) incorrectly
# uses whichever one appears later in the HTML source. Make sure
# apple-touch-icon is specified first to avoid this.
if ( $config->get( MainConfigNames::AppleTouchIcon ) !== false ) {
$tags['apple-touch-icon'] = Html::element( 'link', [
'rel' => 'apple-touch-icon',
'href' => $config->get( MainConfigNames::AppleTouchIcon )
] );
}
if ( $config->get( MainConfigNames::Favicon ) !== false ) {
$tags['favicon'] = Html::element( 'link', [
'rel' => 'icon',
'href' => $config->get( MainConfigNames::Favicon )
] );
}
# OpenSearch description link
$tags['opensearch'] = Html::element( 'link', [
'rel' => 'search',
'type' => 'application/opensearchdescription+xml',
'href' => wfScript( 'opensearch_desc' ),
'title' => $this->msg( 'opensearch-desc' )->inContentLanguage()->text(),
] );
# Real Simple Discovery link, provides auto-discovery information
# for the MediaWiki API (and potentially additional custom API
# support such as WordPress or Twitter-compatible APIs for a
# blogging extension, etc)
$tags['rsd'] = Html::element( 'link', [
'rel' => 'EditURI',
'type' => 'application/rsd+xml',
// Output a protocol-relative URL here if $wgServer is protocol-relative.
// Whether RSD accepts relative or protocol-relative URLs is completely
// undocumented, though.
'href' => wfExpandUrl( wfAppendQuery(
wfScript( 'api' ),
[ 'action' => 'rsd' ] ),
PROTO_RELATIVE
),
] );
$tags = array_merge(
$tags,
$this->getHeadLinksCanonicalURLArray( $config ),
$this->getHeadLinksAlternateURLsArray(),
$this->getHeadLinksCopyrightArray( $config ),
$this->getHeadLinksSyndicationArray( $config ),
);
// Allow extensions to add, remove and/or otherwise manipulate these links
// If you want only to *add* <head> links, please use the addHeadItem()
// (or addHeadItems() for multiple items) method instead.
// This hook is provided as a last resort for extensions to modify these
// links before the output is sent to client.
$this->getHookRunner()->onOutputPageAfterGetHeadLinksArray( $tags, $this );
return $tags;
}
/**
* Canonical URL and alternate URLs
*
* isCanonicalUrlAction affects all requests where "setArticleRelated" is true.
* This is typically all requests that show content (query title, curid, oldid, diff),
* and all wikipage actions (edit, delete, purge, info, history etc.).
* It does not apply to file pages and special pages.
* 'history' and 'info' actions address page metadata rather than the page
* content itself, so they may not be canonicalized to the view page url.
* TODO: this logic should be owned by Action subclasses.
* See T67402
*/
/**
* Get head links relating to the canonical URL
* Note: There should only be one canonical URL.
* @param Config $config
* @return array
*/
private function getHeadLinksCanonicalURLArray( Config $config ) {
$tags = [];
$canonicalUrl = $this->mCanonicalUrl;
if ( $config->get( MainConfigNames::EnableCanonicalServerLink ) ) {
$query = [];
$action = $this->getContext()->getActionName();
$isCanonicalUrlAction = in_array( $action, [ 'history', 'info' ] );
$services = MediaWikiServices::getInstance();
$languageConverterFactory = $services->getLanguageConverterFactory();
$isLangConversionDisabled = $languageConverterFactory->isConversionDisabled();
$pageLang = $this->getTitle()->getPageLanguage();
$pageLanguageConverter = $languageConverterFactory->getLanguageConverter( $pageLang );
$urlVariant = $pageLanguageConverter->getURLVariant();
if ( $canonicalUrl !== false ) {
$canonicalUrl = wfExpandUrl( $canonicalUrl, PROTO_CANONICAL );
} elseif ( $this->isArticleRelated() ) {
if ( $isCanonicalUrlAction ) {
$query['action'] = $action;
} elseif ( !$isLangConversionDisabled && $urlVariant ) {
# T54429, T108443: Making canonical URL language-variant-aware.
$query['variant'] = $urlVariant;
}
$canonicalUrl = $this->getTitle()->getCanonicalURL( $query );
} else {
$reqUrl = $this->getRequest()->getRequestURL();
$canonicalUrl = wfExpandUrl( $reqUrl, PROTO_CANONICAL );
}
}
if ( $canonicalUrl !== false ) {
$tags['link-canonical'] = Html::element( 'link', [
'rel' => 'canonical',
'href' => $canonicalUrl
] );
}
return $tags;
}
/**
* Get head links relating to alternate URL(s) in languages including language variants
* Output fully-qualified URL since meta alternate URLs must be fully-qualified
* Per https://developers.google.com/search/docs/advanced/crawling/localized-versions
* See T294716
*
* @return array
*/
private function getHeadLinksAlternateURLsArray() {
$tags = [];
$languageUrls = [];
$action = $this->getContext()->getActionName();
$isCanonicalUrlAction = in_array( $action, [ 'history', 'info' ] );
$services = MediaWikiServices::getInstance();
$languageConverterFactory = $services->getLanguageConverterFactory();
$isLangConversionDisabled = $languageConverterFactory->isConversionDisabled();
$pageLang = $this->getTitle()->getPageLanguage();
$pageLanguageConverter = $languageConverterFactory->getLanguageConverter( $pageLang );
# Language variants
if (
$this->isArticleRelated() &&
!$isCanonicalUrlAction &&
$pageLanguageConverter->hasVariants() &&
!$isLangConversionDisabled
) {
$variants = $pageLanguageConverter->getVariants();
foreach ( $variants as $variant ) {
$bcp47 = LanguageCode::bcp47( $variant );
$languageUrls[$bcp47] = $this->getTitle()
->getFullURL( [ 'variant' => $variant ], false, PROTO_CURRENT );
}
}
# TODO: Interlanguage links
if ( $languageUrls ) {
# Force the alternate URL of page language code to be self.
# T123901, T305540, T108443: Override mixed-variant variant link in language variant links.
$currentUrl = $this->getTitle()->getFullURL( [], false, PROTO_CURRENT );
$pageLangCodeBcp47 = LanguageCode::bcp47( $pageLang->getCode() );
$languageUrls[$pageLangCodeBcp47] = $currentUrl;
ksort( $languageUrls );
# Also add x-default link per https://support.google.com/webmasters/answer/189077?hl=en
$languageUrls['x-default'] = $currentUrl;
# Process all of language variants and interlanguage links
foreach ( $languageUrls as $bcp47 => $languageUrl ) {
$bcp47lowercase = strtolower( $bcp47 );
$tags['link-alternate-language-' . $bcp47lowercase] = Html::element( 'link', [
'rel' => 'alternate',
'hreflang' => $bcp47,
'href' => $languageUrl,
] );
}
}
return $tags;
}
/**
* Get head links relating to copyright
*
* @param Config $config
* @return array
*/
private function getHeadLinksCopyrightArray( Config $config ) {
$tags = [];
if ( $this->copyrightUrl !== null ) {
$copyright = $this->copyrightUrl;
} else {
$copyright = '';
if ( $config->get( MainConfigNames::RightsPage ) ) {
$copy = Title::newFromText( $config->get( MainConfigNames::RightsPage ) );
if ( $copy ) {
$copyright = $copy->getLocalURL();
}
}
if ( !$copyright && $config->get( MainConfigNames::RightsUrl ) ) {
$copyright = $config->get( MainConfigNames::RightsUrl );
}
}
if ( $copyright ) {
$tags['copyright'] = Html::element( 'link', [
'rel' => 'license',
'href' => $copyright
] );
}
return $tags;
}
/**
* Get head links relating to syndication feeds.
*
* @param Config $config
* @return array
*/
private function getHeadLinksSyndicationArray( Config $config ) {
if ( !$config->get( MainConfigNames::Feed ) ) {
return [];
}
$tags = [];
$feedLinks = [];
foreach ( $this->getSyndicationLinks() as $format => $link ) {
# Use the page name for the title. In principle, this could
# lead to issues with having the same name for different feeds
# corresponding to the same page, but we can't avoid that at
# this low a level.
$feedLinks[] = $this->feedLink(
$format,
$link,
# Used messages: 'page-rss-feed' and 'page-atom-feed' (for an easier grep)
$this->msg(
"page-{$format}-feed", $this->getTitle()->getPrefixedText()
)->text()
);
}
# Recent changes feed should appear on every page (except recentchanges,
# that would be redundant). Put it after the per-page feed to avoid
# changing existing behavior. It's still available, probably via a
# menu in your browser. Some sites might have a different feed they'd
# like to promote instead of the RC feed (maybe like a "Recent New Articles"
# or "Breaking news" one). For this, we see if $wgOverrideSiteFeed is defined.
# If so, use it instead.
$sitename = $config->get( MainConfigNames::Sitename );
$overrideSiteFeed = $config->get( MainConfigNames::OverrideSiteFeed );
if ( $overrideSiteFeed ) {
foreach ( $overrideSiteFeed as $type => $feedUrl ) {
// Note, this->feedLink escapes the url.
$feedLinks[] = $this->feedLink(
$type,
$feedUrl,
$this->msg( "site-{$type}-feed", $sitename )->text()
);
}
} elseif ( !$this->getTitle()->isSpecial( 'Recentchanges' ) ) {
$rctitle = SpecialPage::getTitleFor( 'Recentchanges' );
foreach ( $this->getAdvertisedFeedTypes() as $format ) {
$feedLinks[] = $this->feedLink(
$format,
$rctitle->getLocalURL( [ 'feed' => $format ] ),
# For grep: 'site-rss-feed', 'site-atom-feed'
$this->msg( "site-{$format}-feed", $sitename )->text()
);
}
}
# Allow extensions to change the list pf feeds. This hook is primarily for changing,
# manipulating or removing existing feed tags. If you want to add new feeds, you should
# use OutputPage::addFeedLink() instead.
$this->getHookRunner()->onAfterBuildFeedLinks( $feedLinks );
$tags += $feedLinks;
return $tags;
}
/**
* Generate a "<link rel/>" for a feed.
*
* @param string $type Feed type
* @param string $url URL to the feed
* @param string $text Value of the "title" attribute
* @return string HTML fragment
*/
private function feedLink( $type, $url, $text ) {
return Html::element( 'link', [
'rel' => 'alternate',
'type' => "application/$type+xml",
'title' => $text,
'href' => $url ]
);
}
/**
* Add a local or specified stylesheet, with the given media options.
* Internal use only. Use OutputPage::addModuleStyles() if possible.
*
* @param string $style URL to the file
* @param string $media To specify a media type, 'screen', 'printable', 'handheld' or any.
* @param string $condition For IE conditional comments, specifying an IE version
* @param string $dir Set to 'rtl' or 'ltr' for direction-specific sheets
*/
public function addStyle( $style, $media = '', $condition = '', $dir = '' ) {
$options = [];
if ( $media ) {
$options['media'] = $media;
}
if ( $condition ) {
$options['condition'] = $condition;
}
if ( $dir ) {
$options['dir'] = $dir;
}
$this->styles[$style] = $options;
}
/**
* Adds inline CSS styles
* Internal use only. Use OutputPage::addModuleStyles() if possible.
*
* @param mixed $style_css Inline CSS
* @param string $flip Set to 'flip' to flip the CSS if needed
*/
public function addInlineStyle( $style_css, $flip = 'noflip' ) {
if ( $flip === 'flip' && $this->getLanguage()->isRTL() ) {
# If wanted, and the interface is right-to-left, flip the CSS
$style_css = CSSJanus::transform( $style_css, true, false );
}
$this->mInlineStyles .= Html::inlineStyle( $style_css );
here it is ... the upload-api, script-server, js2 (javascript phase2) branch merge 1st attempt. Here is a short overview of changes and associated default configuration variables (most everything is off by default) also see ~soon to be updated~: http://www.mediawiki.org/wiki/Media_Projects_Overview = Upload Improvements = ==Upload API == * Based on the early work of Bryan Tong and others it adds the upload option to the api. * We rewrite Special:Upload page to include use the new refactoring * Added in token checks in both the SpecialUpload.php page so avoids DOS / xss copy-by-url JavaScript based cross site POST file submissions == Copy by URL== $wgAllowCopyUploads = false; * http class rewrite includes a new http background download see: includes/HttpFunctions.php * spins off a php process that calls: maintenance/http_session_download.php * pushes updates to the session and gives the user a progress bar on http copy uploads from other server progress (using js2 upload interface) (if not using the js2 upload interface it does the request in-place but the download is limited to the php ini timeout time) == Firefogg == * Firefogg enables resumable upload by chunks * progress indicators and conditional invokation (js2 system) * and of-course client side transcoding. = Script Server = $wgEnableScriptLoader = false; * off by default if $wgEnableScriptLoader is turned on script files are grouped, gziped, cached etc. for more info see: http://www.mediawiki.org/wiki/Extension:ScriptLoader * Includes some early skin js include fixes (skin/script system still lots of love) * Includes a "javascript class autoloader" this is packaged into mwEmbed so that the mwEmbed library can work in stand alone mode (while retaining localization and script serving) (one such application is the make page for firefogg.org : http://www.firefogg.org/make/index.html ) * The file that contains the autojavascript loading classes is: js2/php/jsAutoloadLocalClasses.php * One can use this auto class loading dependency system with extensions and add-ons but I need to better document that. = js2 system / mwEmbed= $wgEnableJS2system = false * includes initial rewrite towards more jquery based javascript code * especially for the Special:Upload page. * Also the edit page include support for the "add-media-wizard" * includes dependency loader for javascript that optionally takes advantage of the script-loader * remote embedding of javascript interfaces (like embedding video, or commons media searching) * $wgDebugJavaScript = false; .. .this variable lets you always get "always fresh javascript". When used with the script-loader it does not minify the script-loader output. = mwEmbed = * Will commit a separate patch to oggHandler that conditionally outputs <video tag> to use the new javascript video player. ** mv_embed player includes: play-head, volume control, remote embedding, oggz-chop support across plugins. * add-media-wizard adds easy inserts of media to pages (with import) == jQuery== * we include a base install of jQuery, jQuery ui and some plugins. * all the javascript classes are in the scriptloader so its easy to load any set of jquery ui components that you may need using the script-server. You get a callback so you can then execute js with dependencies loaded. == other stuff == there is a bit more code in js2 that pertains to sequence editing, timed text display and basic image editing. We include a base import of pixastic-lib & pixastic-editor... will work with the pixastic developer to try and ensure upstream compatibility on our usage of the library for in-browser photo and sequence manipulation.
2009-07-14 23:52:14 +00:00
}
/**
resourceloader: Move queue formatting out of OutputPage HTML formatting of the queue was distributed over several OutputPage methods. Each method demanding a snippet of HTML by calling makeResourceLoaderLink() with a limited amount of information. As such, makeResourceLoaderLink() was unable to provide the client with the proper state information. Centralising it also allows it to better reduce duplication in HTML output and maintain a more accurate state. Problems fixed by centralising: 1. The 'user' module is special (due to per-user 'version' and 'user' params). It is manually requested via script-src. To avoid a separate (and wrong) request from something that requires it, we set state=loading directly. However, because the module is in the bottom, the old HTML formatter could only put state=loading in the bottom also. This sometimes caused a wrong request to be fired for modules=user if something in the top queue triggered a requirement for it. 2. Since a464d1d4 (T87871) we track states of page-style modules, with purpose of allowing dependencies on style modules without risking duplicate loading on pages where the styles are loaded already. This didn't work, because the state information about page-style modules is output near the stylesheet, which is after the script tag with mw.loader.load(). That runs first, and mw.loader would still make a duplicate request before it learns the state. Changes: * Document reasons for style/script tag order in getHeadHtml (per 09537e83). * Pass $type from getModuleStyles() to getAllowedModules(). This wasn't needed before since a duplicate check in makeResourceLoaderLink() verified the origin a second time. * Declare explicit position 'top' on 'user.options' and 'user.tokens' module. Previously, OutputPage hardcoded them in the top. The new formatter doesn't. * Remove getHeadScripts(). * Remove getInlineHeadScripts(). * Remove getExternalHeadScripts(). * Remove buildCssLinks(). * Remove getScriptsForBottomQueue(). * Change where Skin::setupSkinUserCss() is called. This methods lets the skin add modules to the queue. Previously it was called from buildCssLinks(), via headElement(), via prepareQuickTemplate(), via OutputPage::output(). It's now in OutputPage::output() directly (slightly earlier). This is needed because prepareQuickTemplate() calls bottomScripts() before headElement(). And bottomScript() would lazy-initialise the queue and lock it before setupSkinUserCss() is called from headElement(). This makes execution order more predictable instead of being dependent on the arbitrary order of data extraction in prepareQuickTemplate (which varies from one skin to another). * Compute isUserModulePreview() and isKnownEmpty() for the 'user' module early on so. This avoids wrongful loading and fixes problem 1. Effective changes in output: * mw.loader.state() is now before mw.loader.load(). This fixes problem 2. * mw.loader.state() now sets 'user.options' and 'user.tokens' to "loading". * mw.loader.state() now sets 'user' (as "loading" or "ready"). Fixes problem 1. * The <script async src> tag for 'startup' changed position (slightly). Previously it was after all inline scripts and stylesheets. It's still after all inline scripts and after most stylesheets, but before any user styles. Since the queue is now formatted outside OutputPage, it can't inject the meta-ResourceLoaderDynamicStyles tag and user-stylesheet hack in the middle of existing output. This shouldn't have any noticable impact. Bug: T87871 Change-Id: I605b8cd1e1fc009b4662a0edbc54d09dd65ee1df
2016-07-15 14:13:09 +00:00
* Build exempt modules and legacy non-ResourceLoader styles.
*
* @return string|WrappedStringList HTML
*/
resourceloader: Move queue formatting out of OutputPage HTML formatting of the queue was distributed over several OutputPage methods. Each method demanding a snippet of HTML by calling makeResourceLoaderLink() with a limited amount of information. As such, makeResourceLoaderLink() was unable to provide the client with the proper state information. Centralising it also allows it to better reduce duplication in HTML output and maintain a more accurate state. Problems fixed by centralising: 1. The 'user' module is special (due to per-user 'version' and 'user' params). It is manually requested via script-src. To avoid a separate (and wrong) request from something that requires it, we set state=loading directly. However, because the module is in the bottom, the old HTML formatter could only put state=loading in the bottom also. This sometimes caused a wrong request to be fired for modules=user if something in the top queue triggered a requirement for it. 2. Since a464d1d4 (T87871) we track states of page-style modules, with purpose of allowing dependencies on style modules without risking duplicate loading on pages where the styles are loaded already. This didn't work, because the state information about page-style modules is output near the stylesheet, which is after the script tag with mw.loader.load(). That runs first, and mw.loader would still make a duplicate request before it learns the state. Changes: * Document reasons for style/script tag order in getHeadHtml (per 09537e83). * Pass $type from getModuleStyles() to getAllowedModules(). This wasn't needed before since a duplicate check in makeResourceLoaderLink() verified the origin a second time. * Declare explicit position 'top' on 'user.options' and 'user.tokens' module. Previously, OutputPage hardcoded them in the top. The new formatter doesn't. * Remove getHeadScripts(). * Remove getInlineHeadScripts(). * Remove getExternalHeadScripts(). * Remove buildCssLinks(). * Remove getScriptsForBottomQueue(). * Change where Skin::setupSkinUserCss() is called. This methods lets the skin add modules to the queue. Previously it was called from buildCssLinks(), via headElement(), via prepareQuickTemplate(), via OutputPage::output(). It's now in OutputPage::output() directly (slightly earlier). This is needed because prepareQuickTemplate() calls bottomScripts() before headElement(). And bottomScript() would lazy-initialise the queue and lock it before setupSkinUserCss() is called from headElement(). This makes execution order more predictable instead of being dependent on the arbitrary order of data extraction in prepareQuickTemplate (which varies from one skin to another). * Compute isUserModulePreview() and isKnownEmpty() for the 'user' module early on so. This avoids wrongful loading and fixes problem 1. Effective changes in output: * mw.loader.state() is now before mw.loader.load(). This fixes problem 2. * mw.loader.state() now sets 'user.options' and 'user.tokens' to "loading". * mw.loader.state() now sets 'user' (as "loading" or "ready"). Fixes problem 1. * The <script async src> tag for 'startup' changed position (slightly). Previously it was after all inline scripts and stylesheets. It's still after all inline scripts and after most stylesheets, but before any user styles. Since the queue is now formatted outside OutputPage, it can't inject the meta-ResourceLoaderDynamicStyles tag and user-stylesheet hack in the middle of existing output. This shouldn't have any noticable impact. Bug: T87871 Change-Id: I605b8cd1e1fc009b4662a0edbc54d09dd65ee1df
2016-07-15 14:13:09 +00:00
protected function buildExemptModules() {
$chunks = [];
// Requirements:
// - Within modules provided by the software (core, skin, extensions),
// styles from skin stylesheets should be overridden by styles
// from modules dynamically loaded with JavaScript.
// - Styles from site-specific, private, and user modules should override
// both of the above.
//
// The effective order for stylesheets must thus be:
// 1. Page style modules, formatted server-side by RL\ClientHtml.
// 2. Dynamically-loaded styles, inserted client-side by mw.loader.
// 3. Styles that are site-specific, private or from the user, formatted
// server-side by this function.
//
// The 'ResourceLoaderDynamicStyles' marker helps JavaScript know where
// point #2 is.
resourceloader: Move queue formatting out of OutputPage HTML formatting of the queue was distributed over several OutputPage methods. Each method demanding a snippet of HTML by calling makeResourceLoaderLink() with a limited amount of information. As such, makeResourceLoaderLink() was unable to provide the client with the proper state information. Centralising it also allows it to better reduce duplication in HTML output and maintain a more accurate state. Problems fixed by centralising: 1. The 'user' module is special (due to per-user 'version' and 'user' params). It is manually requested via script-src. To avoid a separate (and wrong) request from something that requires it, we set state=loading directly. However, because the module is in the bottom, the old HTML formatter could only put state=loading in the bottom also. This sometimes caused a wrong request to be fired for modules=user if something in the top queue triggered a requirement for it. 2. Since a464d1d4 (T87871) we track states of page-style modules, with purpose of allowing dependencies on style modules without risking duplicate loading on pages where the styles are loaded already. This didn't work, because the state information about page-style modules is output near the stylesheet, which is after the script tag with mw.loader.load(). That runs first, and mw.loader would still make a duplicate request before it learns the state. Changes: * Document reasons for style/script tag order in getHeadHtml (per 09537e83). * Pass $type from getModuleStyles() to getAllowedModules(). This wasn't needed before since a duplicate check in makeResourceLoaderLink() verified the origin a second time. * Declare explicit position 'top' on 'user.options' and 'user.tokens' module. Previously, OutputPage hardcoded them in the top. The new formatter doesn't. * Remove getHeadScripts(). * Remove getInlineHeadScripts(). * Remove getExternalHeadScripts(). * Remove buildCssLinks(). * Remove getScriptsForBottomQueue(). * Change where Skin::setupSkinUserCss() is called. This methods lets the skin add modules to the queue. Previously it was called from buildCssLinks(), via headElement(), via prepareQuickTemplate(), via OutputPage::output(). It's now in OutputPage::output() directly (slightly earlier). This is needed because prepareQuickTemplate() calls bottomScripts() before headElement(). And bottomScript() would lazy-initialise the queue and lock it before setupSkinUserCss() is called from headElement(). This makes execution order more predictable instead of being dependent on the arbitrary order of data extraction in prepareQuickTemplate (which varies from one skin to another). * Compute isUserModulePreview() and isKnownEmpty() for the 'user' module early on so. This avoids wrongful loading and fixes problem 1. Effective changes in output: * mw.loader.state() is now before mw.loader.load(). This fixes problem 2. * mw.loader.state() now sets 'user.options' and 'user.tokens' to "loading". * mw.loader.state() now sets 'user' (as "loading" or "ready"). Fixes problem 1. * The <script async src> tag for 'startup' changed position (slightly). Previously it was after all inline scripts and stylesheets. It's still after all inline scripts and after most stylesheets, but before any user styles. Since the queue is now formatted outside OutputPage, it can't inject the meta-ResourceLoaderDynamicStyles tag and user-stylesheet hack in the middle of existing output. This shouldn't have any noticable impact. Bug: T87871 Change-Id: I605b8cd1e1fc009b4662a0edbc54d09dd65ee1df
2016-07-15 14:13:09 +00:00
// Add legacy styles added through addStyle()/addInlineStyle() here
$chunks[] = implode( '', $this->buildCssLinksArray() ) . $this->mInlineStyles;
// Things that go after the ResourceLoaderDynamicStyles marker
$append = [];
$separateReq = [ 'site.styles', 'user.styles' ];
foreach ( $this->rlExemptStyleModules as $moduleNames ) {
if ( $moduleNames ) {
$append[] = $this->makeResourceLoaderLink(
array_diff( $moduleNames, $separateReq ),
RL\Module::TYPE_STYLES
);
foreach ( array_intersect( $moduleNames, $separateReq ) as $name ) {
// These require their own dedicated request in order to support "@import"
// syntax, which is incompatible with concatenation. (T147667, T37562)
$append[] = $this->makeResourceLoaderLink( $name,
RL\Module::TYPE_STYLES
);
}
}
}
if ( $append ) {
$chunks[] = Html::element(
'meta',
[ 'name' => 'ResourceLoaderDynamicStyles', 'content' => '' ]
);
$chunks = array_merge( $chunks, $append );
}
return self::combineWrappedStrings( $chunks );
}
/**
* @return array
*/
public function buildCssLinksArray() {
$links = [];
foreach ( $this->styles as $file => $options ) {
$link = $this->styleLink( $file, $options );
if ( $link ) {
$links[$file] = $link;
}
}
return $links;
}
/**
* Generate \<link\> tags for stylesheets
*
* @param string $style URL to the file
* @param array $options Option, can contain 'condition', 'dir', 'media' keys
* @return string HTML fragment
*/
protected function styleLink( $style, array $options ) {
if ( isset( $options['dir'] ) && $this->getLanguage()->getDir() != $options['dir'] ) {
return '';
}
if ( isset( $options['media'] ) ) {
$media = self::transformCssMedia( $options['media'] );
if ( $media === null ) {
return '';
}
} else {
$media = 'all';
}
if ( substr( $style, 0, 1 ) == '/' ||
substr( $style, 0, 5 ) == 'http:' ||
substr( $style, 0, 6 ) == 'https:' ) {
$url = $style;
} else {
$config = $this->getConfig();
// Append file hash as query parameter
$url = self::transformResourcePath(
$config,
$config->get( MainConfigNames::StylePath ) . '/' . $style
);
}
$link = Html::linkedStyle( $url, $media );
if ( isset( $options['condition'] ) ) {
$condition = htmlspecialchars( $options['condition'] );
$link = "<!--[if $condition]>$link<![endif]-->";
}
return $link;
}
/**
* Transform path to web-accessible static resource.
*
* This is used to add a validation hash as query string.
* This aids various behaviors:
*
* - Put long Cache-Control max-age headers on responses for improved
* cache performance.
* - Get the correct version of a file as expected by the current page.
* - Instantly get the updated version of a file after deployment.
*
* Avoid using this for urls included in HTML as otherwise clients may get different
* versions of a resource when navigating the site depending on when the page was cached.
* If changes to the url propagate, this is not a problem (e.g. if the url is in
* an external stylesheet).
*
* @since 1.27
* @param Config $config
* @param string $path Path-absolute URL to file (from document root, must start with "/")
* @return string URL
*/
public static function transformResourcePath( Config $config, $path ) {
$localDir = $config->get( MainConfigNames::BaseDirectory );
$remotePathPrefix = $config->get( MainConfigNames::ResourceBasePath );
if ( $remotePathPrefix === '' ) {
// The configured base path is required to be empty string for
// wikis in the domain root
$remotePath = '/';
} else {
$remotePath = $remotePathPrefix;
}
if ( strpos( $path, $remotePath ) !== 0 || substr( $path, 0, 2 ) === '//' ) {
// - Path is outside wgResourceBasePath, ignore.
// - Path is protocol-relative. Fixes T155310. Not supported by RelPath lib.
return $path;
}
// For files in resources, extensions/ or skins/, ResourceBasePath is preferred here.
// For other misc files in $IP, we'll fallback to that as well. There is, however, a fourth
// supported dir/path pair in the configuration (wgUploadDirectory, wgUploadPath)
// which is not expected to be in wgResourceBasePath on CDNs. (T155146)
$uploadPath = $config->get( MainConfigNames::UploadPath );
if ( strpos( $path, $uploadPath ) === 0 ) {
$localDir = $config->get( MainConfigNames::UploadDirectory );
$remotePathPrefix = $remotePath = $uploadPath;
}
$path = RelPath::getRelativePath( $path, $remotePath );
return self::transformFilePath( $remotePathPrefix, $localDir, $path );
}
/**
* Utility method for transformResourceFilePath().
*
* Caller is responsible for ensuring the file exists. Emits a PHP warning otherwise.
*
* @since 1.27
* @param string $remotePathPrefix URL path prefix that points to $localPath
* @param string $localPath File directory exposed at $remotePath
* @param string $file Path to target file relative to $localPath
* @return string URL
*/
public static function transformFilePath( $remotePathPrefix, $localPath, $file ) {
resourceloader: Remove wfExpandUrl() coupling from CSSMin There are three cases in CSSMin::remap where performs path resolution. 1. Absolute local path URLs to full URL. Example: url(/static/foo.png), url(/w/index.php?…), etc. These previously used wfExpandUrl(), which got the server name and protocol directly from $wgServer. We will now use the $remote parameter to get this information instead, which is generally set to something like https://wiki/w/resources/foo, and thus naturally contains the server name and protocol. The resolution is powered by the Net_URL2 library, allowing this to work outside Mediawiki as well. Some tests needed to change because they were calling CSSMin::remap with an incomplete $remote dummy values like "/" or "/w, because the test author (past me) was trying to be clever by not supplying it, knowing MW would ignore it. Now that it is consistently used, like normal calls from ResourceLoader would, the expected values will always be based on http://localhost/w, instead of sometimes the competing $wgServer value of `https://expand.example`. 2. Relative local path to full URL Example: url(foo.png), url(../foo.png), url(bar/foo.png) These were already using $remote. The only change is that they now use Net_URL2 library instead of blind string concatenation. One of the benefits of this is that we will no longer need to call wfRemoveDotSegments() to get rid of things like double slashes or redundant "../" sequences. Previously, thing like "foo//bar" or "foo/../bar" were cleaned up only due to wfRemoveDotSegments(). This is now naturally handled by Net_URL2. 3. Remote URLs Example: url(http://example.org/bar.png), url(//example.org/bar.png) This is generally not used in source code, but gadgets may use this, e.g. for upload.wikimedia.org or cross-wiki imports. Other changes: * One test case used spaces within the URL string in CSS, which the net_url2 library represents with percent-encoding instead. Same thing either way. Bug: T88914 Change-Id: Ibef70cc934c0ee8260a244c51bca9fb88c1c0d88
2020-09-11 21:35:37 +00:00
// This MUST match the equivalent logic in CSSMin::remapOne()
$localFile = "$localPath/$file";
$url = "$remotePathPrefix/$file";
if ( is_file( $localFile ) ) {
$hash = md5_file( $localFile );
if ( $hash === false ) {
wfLogWarning( __METHOD__ . ": Failed to hash $localFile" );
$hash = '';
}
$url .= '?' . substr( $hash, 0, 5 );
}
return $url;
}
/**
* Transform "media" attribute based on request parameters
*
* @param string $media Current value of the "media" attribute
* @return string|null Modified value of the "media" attribute, or null to disable
* this stylesheet
*/
public static function transformCssMedia( $media ) {
global $wgRequest;
if ( $wgRequest->getBool( 'printable' ) ) {
// When browsing with printable=yes, apply "print" media styles
// as if they are screen styles (no media, media="").
if ( $media === 'print' ) {
return '';
}
// https://www.w3.org/TR/css3-mediaqueries/#syntax
//
// This regex will not attempt to understand a comma-separated media_query_list
// Example supported values for $media:
//
// 'screen', 'only screen', 'screen and (min-width: 982px)' ),
//
// Example NOT supported value for $media:
//
// '3d-glasses, screen, print and resolution > 90dpi'
//
// If it's a "printable" request, we disable all screen stylesheets.
$screenMediaQueryRegex = '/^(?:only\s+)?screen\b/i';
if ( preg_match( $screenMediaQueryRegex, $media ) === 1 ) {
return null;
}
}
return $media;
}
/**
* Add a wikitext-formatted message to the output.
* This is equivalent to:
*
* $wgOut->addWikiText( wfMessage( ... )->plain() )
*
* @param mixed ...$args
*/
public function addWikiMsg( ...$args ) {
$name = array_shift( $args );
$this->addWikiMsgArray( $name, $args );
}
/**
* Add a wikitext-formatted message to the output.
* Like addWikiMsg() except the parameters are taken as an array
* instead of a variable argument list.
*
* @param string $name
* @param array $args
*/
public function addWikiMsgArray( $name, $args ) {
$this->addHTML( $this->msg( $name, $args )->parseAsBlock() );
}
/**
* This function takes a number of message/argument specifications, wraps them in
* some overall structure, and then parses the result and adds it to the output.
*
* In the $wrap, $1 is replaced with the first message, $2 with the second,
* and so on. The subsequent arguments may be either
* 1) strings, in which case they are message names, or
* 2) arrays, in which case, within each array, the first element is the message
* name, and subsequent elements are the parameters to that message.
*
* Don't use this for messages that are not in the user's interface language.
*
* For example:
*
* $wgOut->wrapWikiMsg( "<div class='customclass'>\n$1\n</div>", 'some-msg-key' );
*
* Is equivalent to:
*
* $wgOut->addWikiTextAsInterface( "<div class='customclass'>\n"
* . wfMessage( 'some-msg-key' )->plain() . "\n</div>" );
*
* The newline after the opening div is needed in some wikitext. See T21226.
*
* @param string $wrap
* @param mixed ...$msgSpecs
*/
public function wrapWikiMsg( $wrap, ...$msgSpecs ) {
$s = $wrap;
foreach ( $msgSpecs as $n => $spec ) {
if ( is_array( $spec ) ) {
$args = $spec;
$name = array_shift( $args );
} else {
$args = [];
$name = $spec;
}
$s = str_replace( '$' . ( $n + 1 ), $this->msg( $name, $args )->plain(), $s );
}
$this->addWikiTextAsInterface( $s );
}
/**
* Whether the output has a table of contents
* @return bool
* @since 1.22
*/
public function isTOCEnabled() {
return $this->mEnableTOC;
}
/**
* Helper function to setup the PHP implementation of OOUI to use in this request.
*
* @since 1.26
* @param string $skinName The Skin name to determine the correct OOUI theme
* @param string $dir Language direction
*/
public static function setupOOUI( $skinName = 'default', $dir = 'ltr' ) {
$themes = RL\OOUIFileModule::getSkinThemeMap();
$theme = $themes[$skinName] ?? $themes['default'];
// For example, 'OOUI\WikimediaUITheme'.
$themeClass = "OOUI\\{$theme}Theme";
OOUI\Theme::setSingleton( new $themeClass() );
OOUI\Element::setDefaultDir( $dir );
}
/**
* Add ResourceLoader module styles for OOUI and set up the PHP implementation of it for use with
* MediaWiki and this OutputPage instance.
*
* @since 1.25
*/
public function enableOOUI() {
self::setupOOUI(
strtolower( $this->getSkin()->getSkinName() ),
$this->getLanguage()->getDir()
);
$this->addModuleStyles( [
'oojs-ui-core.styles',
'oojs-ui.styles.indicators',
'mediawiki.widgets.styles',
'oojs-ui-core.icons',
] );
}
Initial support for Content Security Policy, disabled by default The primary goal here is a defense in depth measure to stop an attacker who found a bug in the parser allowing them to insert malicious attributes. This wouldn't stop someone who could insert a full script tag (since at current it can't distinguish between malicious and legit user js). It also would not prevent DOM-based or reflected XSS for anons, as the nonce value is guessable for anons when receiving a response cached by varnish. However, the limited protection of just stopping stored XSS where the attacker only has control of attributes, is still a big win in my opinion. (But it wouldn't prevent someone who has that type of xss from abusing things like data-ooui attribute). This will likely break many gadgets. Its expected that any sort of rollout on Wikimedia will be done very slowly, with lots of testing and the report-only option to begin with. This is behind feature flags that are off by default, so merging this patch should not cause any change in default behaviour. This may break some extensions (The most obvious one is charinsert (See fe648d41005), but will probably need some testing in report-only mode to see if anything else breaks) This uses the unsafe-eval option of CSP, in order to support RL's local storage thingy. For better security, we may want to remove some of the sillier uses of eval (e.g. jquery.ui.datepicker.js). For more info, see spec: https://www.w3.org/TR/CSP2/ Additionally see: https://www.mediawiki.org/wiki/Requests_for_comment/Content-Security-Policy Bug: T135963 Change-Id: I80f6f469ba4c0b608385483457df96ccb7429ae5
2016-02-29 04:13:10 +00:00
/**
* Get (and set if not yet set) the CSP nonce.
*
* This value needs to be included in any <script> tags on the
* page.
*
* @return string|false Nonce or false to mean don't output nonce
Initial support for Content Security Policy, disabled by default The primary goal here is a defense in depth measure to stop an attacker who found a bug in the parser allowing them to insert malicious attributes. This wouldn't stop someone who could insert a full script tag (since at current it can't distinguish between malicious and legit user js). It also would not prevent DOM-based or reflected XSS for anons, as the nonce value is guessable for anons when receiving a response cached by varnish. However, the limited protection of just stopping stored XSS where the attacker only has control of attributes, is still a big win in my opinion. (But it wouldn't prevent someone who has that type of xss from abusing things like data-ooui attribute). This will likely break many gadgets. Its expected that any sort of rollout on Wikimedia will be done very slowly, with lots of testing and the report-only option to begin with. This is behind feature flags that are off by default, so merging this patch should not cause any change in default behaviour. This may break some extensions (The most obvious one is charinsert (See fe648d41005), but will probably need some testing in report-only mode to see if anything else breaks) This uses the unsafe-eval option of CSP, in order to support RL's local storage thingy. For better security, we may want to remove some of the sillier uses of eval (e.g. jquery.ui.datepicker.js). For more info, see spec: https://www.w3.org/TR/CSP2/ Additionally see: https://www.mediawiki.org/wiki/Requests_for_comment/Content-Security-Policy Bug: T135963 Change-Id: I80f6f469ba4c0b608385483457df96ccb7429ae5
2016-02-29 04:13:10 +00:00
* @since 1.32
* @deprecated Since 1.35 use getCSP()->getNonce() instead
Initial support for Content Security Policy, disabled by default The primary goal here is a defense in depth measure to stop an attacker who found a bug in the parser allowing them to insert malicious attributes. This wouldn't stop someone who could insert a full script tag (since at current it can't distinguish between malicious and legit user js). It also would not prevent DOM-based or reflected XSS for anons, as the nonce value is guessable for anons when receiving a response cached by varnish. However, the limited protection of just stopping stored XSS where the attacker only has control of attributes, is still a big win in my opinion. (But it wouldn't prevent someone who has that type of xss from abusing things like data-ooui attribute). This will likely break many gadgets. Its expected that any sort of rollout on Wikimedia will be done very slowly, with lots of testing and the report-only option to begin with. This is behind feature flags that are off by default, so merging this patch should not cause any change in default behaviour. This may break some extensions (The most obvious one is charinsert (See fe648d41005), but will probably need some testing in report-only mode to see if anything else breaks) This uses the unsafe-eval option of CSP, in order to support RL's local storage thingy. For better security, we may want to remove some of the sillier uses of eval (e.g. jquery.ui.datepicker.js). For more info, see spec: https://www.w3.org/TR/CSP2/ Additionally see: https://www.mediawiki.org/wiki/Requests_for_comment/Content-Security-Policy Bug: T135963 Change-Id: I80f6f469ba4c0b608385483457df96ccb7429ae5
2016-02-29 04:13:10 +00:00
*/
public function getCSPNonce() {
return $this->CSP->getNonce();
Initial support for Content Security Policy, disabled by default The primary goal here is a defense in depth measure to stop an attacker who found a bug in the parser allowing them to insert malicious attributes. This wouldn't stop someone who could insert a full script tag (since at current it can't distinguish between malicious and legit user js). It also would not prevent DOM-based or reflected XSS for anons, as the nonce value is guessable for anons when receiving a response cached by varnish. However, the limited protection of just stopping stored XSS where the attacker only has control of attributes, is still a big win in my opinion. (But it wouldn't prevent someone who has that type of xss from abusing things like data-ooui attribute). This will likely break many gadgets. Its expected that any sort of rollout on Wikimedia will be done very slowly, with lots of testing and the report-only option to begin with. This is behind feature flags that are off by default, so merging this patch should not cause any change in default behaviour. This may break some extensions (The most obvious one is charinsert (See fe648d41005), but will probably need some testing in report-only mode to see if anything else breaks) This uses the unsafe-eval option of CSP, in order to support RL's local storage thingy. For better security, we may want to remove some of the sillier uses of eval (e.g. jquery.ui.datepicker.js). For more info, see spec: https://www.w3.org/TR/CSP2/ Additionally see: https://www.mediawiki.org/wiki/Requests_for_comment/Content-Security-Policy Bug: T135963 Change-Id: I80f6f469ba4c0b608385483457df96ccb7429ae5
2016-02-29 04:13:10 +00:00
}
/**
* Get the ContentSecurityPolicy object
*
* @since 1.35
* @return ContentSecurityPolicy
*/
public function getCSP() {
return $this->CSP;
}
/**
* The final bits that go to the bottom of a page
* HTML document including the closing tags
*
* @internal
* @since 1.37
* @param Skin $skin
* @return string
*/
public function tailElement( $skin ) {
// T257704: Temporarily run skin hook here pending
// creation dedicated outputpage hook for this
$extraHtml = '';
$this->getHookRunner()->onSkinAfterBottomScripts( $skin, $extraHtml );
$tail = [
MWDebug::getDebugHTML( $skin ),
$this->getBottomScripts( $extraHtml ),
wfReportTime( $this->getCSP()->getNonce() ),
MWDebug::getHTMLDebugLog(),
Html::closeElement( 'body' ),
Html::closeElement( 'html' ),
];
return WrappedStringList::join( "\n", $tail );
}
}