Thijs/wiki.techinc.nl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "ResourceLoader: Limit injection of valid skins to names only"

Browse source
This commit is contained in:
jenkins-bot 2024-07-24 11:05:17 +00:00 committed by Gerrit Code Review
commit facd472050
3 changed files with 18 additions and 18 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

21
includes/ResourceLoader/Context.php
View file

@ -102,12 +102,11 @@ class Context implements MessageLocalizer {
/**
* @param ResourceLoader $resourceLoader
* @param WebRequest $request
* @param array|null $installedSkins If a list of skins are supplied, perform
* validation with them. But if we don't have a list of skins to validate on
* and a skin is not supplied, also fallback to the default skin.
* @param string[]|null $validSkins List of valid skin names. If not passed,
* any skin name is considered valid. Invalid skins are replaced by the default.
*/
public function __construct(
ResourceLoader $resourceLoader, WebRequest $request, $installedSkins = null
ResourceLoader $resourceLoader, WebRequest $request, $validSkins = null
) {
$this->resourceLoader = $resourceLoader;
$this->request = $request;
@ -135,14 +134,12 @@ class Context implements MessageLocalizer {
$this->skin = $request->getRawVal( 'skin' );
if ( is_array( $installedSkins ) ) {
if ( !$this->skin || !isset( $installedSkins[$this->skin] ) ) {
// The 'skin' parameter is required. (Not yet enforced.)
// For requests without a known skin specified,
// use MediaWiki's 'fallback' skin for skin-specific decisions.
$this->skin = self::DEFAULT_SKIN;
}
} elseif ( !$this->skin ) {
if (
!$this->skin
|| ( is_array( $validSkins ) && !in_array( $this->skin, $validSkins ) )
) {
// For requests without a known skin specified,
// use MediaWiki's 'fallback' skin for any skin-specific decisions.
$this->skin = self::DEFAULT_SKIN;
}
}

2
includes/ResourceLoader/ResourceLoaderEntryPoint.php
View file

@ -47,7 +47,7 @@ class ResourceLoaderEntryPoint extends MediaWikiEntryPoint {
$context = new Context(
$resourceLoader,
$this->getRequest(),
$services->getSkinFactory()->getInstalledSkins()
array_keys( $services->getSkinFactory()->getInstalledSkins() )
);
// Respond to ResourceLoader request

13
tests/phpunit/includes/ResourceLoader/ContextTest.php
View file

@ -205,17 +205,20 @@ class ContextTest extends TestCase {
public static function skinsProvider(): Generator {
// expected skin, supplied skin, installed skins
yield 'keep validated' => [
'example', [ 'skin' => 'example' ],
[ 'example' => 'ExampleSkin', 'foo' => 'FooSkin', 'bar' => 'BarSkin' ]
'example',
[ 'skin' => 'example' ],
[ 'example', 'foo', 'bar' ]
];
yield 'fallback invalid' => [
'fallback', [ 'skin' => 'not-example' ],
[ 'example' => 'ExampleSkin', 'foo' => 'FooSkin', 'bar' => 'BarSkin' ]
'fallback',
[ 'skin' => 'not-example' ],
[ 'example', 'foo', 'bar' ]
];
yield 'keep anything without validation' => [
'not-example', [ 'skin' => 'not-example' ],
'not-example',
[ 'skin' => 'not-example' ],
null
];
}