Commit graph

43 commits

Author SHA1 Message Date
Sean Colombo
bf1f91244a Additional register_globals vulnerability check. Merged in from big Wikia merge: http://www.mediawiki.org/wiki/Wikia_code 2011-09-16 20:31:37 +00:00
Alexandre Emsenhuber
e7eaf43077 Added some GPL headers 2011-06-28 18:21:59 +00:00
Tim Starling
26230b6fee * Restored the page shown when LocalSettings.php is missing to how it was before r85918. That template is a welcome page, not a "catastrophic error".
* Fixed attempted remote loading of the logo image in index.php's wfDie(). Use the distributed mediawiki.png instead, that's what it's there for.
2011-06-07 05:11:50 +00:00
Tim Starling
a0123d0549 * Made the profiler work in HipHop:
** Don't try to set a global variable in the same file as a class definition (Profiler.php). Set it in WebStart.php instead.
** In StartProfiler.sample, don't use require_once() to get ProfilerStub.

* Removed the setproctitle() stuff from ProfilerStub, the extension is not maintained and doesn't work with Apache 2.x
* Added an optimisation to wfProfileIn() and wfProfileOut() to reduce the overhead when profiling is not enabled
* Added the ability to configure in StartProfiler.php whether CPU time or wall-clock time is used, avoiding recompilation
2011-05-31 06:05:05 +00:00
Tim Starling
ff1dc8a175 HipHop improvements:
* Added the ability to compile extensions. The build process is bootstrapped by running MediaWiki in interpreted mode. Extension setup file inclusions are slightly modified in a way that makes them register themselves for compilation. Then the same LocalSettings.php uses the compiled extension setup file when the compiled binary runs.
* Tested with Cite and ParserFunctions. The code which lets you have an extensions directory in a place other than $IP/../extensions is untested.
* Simplified WebStart.php slightly by using a custom $_SERVER variable to mark compiled mode. It will break if you don't use the supplied server.conf, but that will break a lot of things so don't do that.
* Fixed the core web entry points to include WebStart.php in compiled mode instead of interpreted.
* Made the build directory configurable. This is mostly so that I can grep the source tree without seeing loads of generated C++.
* In server.conf, added a rewrite rule allowing a /wiki/$1 article path.
* Removed server.conf log file location "/dev/stdout", breaks when you switch user
* Disable static content cache, breaks horribly when you set SourceRoot to a directory containing 7GB of files.
* Rewrote the run-server script in PHP, mostly to support the configurable build directory feature.
* Added an option to the run-server script to allow running in interpreted (hphpi) mode.
2011-05-30 13:49:09 +00:00
Sam Reed
b15737fa83 And even more documentation, the last of this batch 2011-05-28 19:00:01 +00:00
Siebrand Mazeland
75c6696aa8 Use consistent notation for "@todo FIXME". Should update http://svn.wikimedia.org/doc/todo.html nicely. 2011-05-17 22:03:20 +00:00
Brion Vibber
d5b4ce16dc * (bug 15461) Make IE8 turn off content sniffing. Everbody else should ignore this
Adding X-Content-Type-Options: nosniff header in WebStart.php so that it's *always* set, even for alternate entry points and when $wgOut gets disabled or overridden.

Note that this of course doesn't apply to uploaded images and such loaded directly -- the usual caveats still apply.

Have not tested to confirm that this actually protects against sniffing errors -- please test on IE8 and IE9.
2011-05-13 15:52:46 +00:00
Chad Horohoe
5a6d1ee2d3 More profiler cleanup:
* Move autoloader up a little bit so the profiler classes can use it
* Make Profiler into a singleton so it's lazy-constructed, $wgProfiler is now a configuration array (used 'visible' in ProfilerSimpleText as an example of other globals we can move into this array). If $wgProfiler is set to an object, it'll use that for back-compat
* Maintenance: rather than setting up the profiler and then disabling it, just disable it from the start
* Kill $wgProfiling -> now that ProfilerStub overrides profileIn() and profileOut(), it's not needed
* dumpHTML needs some fixes still
2011-04-16 19:00:54 +00:00
Chad Horohoe
e376ee65f7 First step of reorganizing profiling files:
* Move them all to includes/profiling/* - If you're using StartProfiler, you'll need to update that
* Make ProfileStub subclass the Profiler rather than duplicating function definitions conditionally
* Removed unused params to wfGetProfilingOutput(), only used in the stub, and they didn't do anything with them
* TODO: Kill $wgProfiling, make $wgProfiler a config array and move the various options to that. Also make into a singleton, rather than global (not much calls it outside of core)
2011-04-16 02:19:40 +00:00
Happy-melon
938a8eb347 Improvements to handling of 'catastrophic' errors, like unsupported PHP versions, no MySQL functions, no LocalSettings, etc.
* Fix parsing of the three major entry points (index.php, api.php, load.php) back to PHP 4.4.9.  We don't care what happens if you actually try to run these files on old versions, but the entry files need to parse correctly.
* consign /includes/templates/PHP4.php and /includes/templates/NoLocalSettings.php to the fiery pit of hell where they belong.
* Prevent loading of any other files for PHP < 5.  WebStart.php was rendered unparseable in PHP 4 by the introduction of try/catch blocks in r85327.
* Die outright with a pretty error message on PHP < 5.2.3 as well as PHP 4.  All versions of PHP below that throw parse errors of various sorts.
* Reimplement wfDie() to provide an entry-point-dependent die-with-readable-error-message function (for instance, we want a pretty human-readable page in index.php, something wrapped in CSS/JS /*...*/ comment block in load.php, etc).  
* Standardise the appearance of the catastrophic errors thrown at the top of the stack with the ones lower down (exception-within-exception, etc).  There isn't really a way to do this without duplication, AFAICT.
2011-04-12 20:38:16 +00:00
Tim Starling
7bb50c630a The beginnings of HipHop compiled mode support. It works now for parser cache hits.
* Work around HipHop issue 314 (volatile broken) and issue 308 (no compilation detection) by adding some large and ugly compilation detection code to WebStart.php and doMaintenance.php.
* Provide an MW_COMPILED constant which can be used to detect compiled mode throughout the codebase.
* Introduced wfIsHipHop(), which detects either compiled or interpreted mode. Used this to work around unusual eval() return value in eval.php.
* Work around lack of ini_get() in Maintenance.php, by duplicating wfIsHipHop(). 
* In Maintenance::shouldExecute(), accept "include" as an inclusion function name, since all kinds of inclusion give this string in HipHop.
* Introduced new class MWInit, which provides some static functions in the pre-autoloader environment.
* Introduced MWInit::compiledPath(), which provides a relative path for invoking a compiled file, and MWInit::interpretedPath(), which provides an absolute path for interpreting a PHP file. Used these new functions in the appropriate places.
* When we are running compiled code, don't include files which would generate duplicate class, function or constant definitions. Documented the new requirements on the contents of Defines.php and UtfNormalDefines.php.
* In HipHop compiled mode, it's not possible to have executable code in the same file as a class definition. 
  ** Moved MimeMagic initialisation to the constructor.
  ** Moved Namespace.php global variable initialisation to Setup.php.
  ** Moved MemcachedSessions.php initialisation to the caller in GlobalFunctions.php.
  ** Moved Sanitizer.php constants and global variables to static class members. Introduced an accessor function for the attribs regex, as a new place to put code formerly at file level. 
  ** Moved Language.php initialisation of $wgLanguageNames to Language::getLanguageNames(). Removed the global variable, marked "private" since forever.

* In two places: don't use error_log() with type=3 to append to a file, HipHop doesn't support it. Use file_put_contents() with FILE_APPEND instead.
* Work around the terrible breakage of class_exists() by using MWInit::classExists() instead in various places. In WebInstaller::getPageByName(), the class_exists() was marked with a fixme comment already, so I replaced it with an autoloader solution.
2011-04-04 12:59:55 +00:00
Mark A. Hershberger
289c1d7771 Fixes Bug #28214 - When page not found, sends malformed HTTP/1.x instead of HTTP/1.1 in header of respons
Note that there are a few places in the source where headers are sent
with HTTP/1.0 instead of HTTP/1.1 but this patch doesa not address those
2011-03-25 03:36:18 +00:00
Chad Horohoe
5b1985f117 Tweak comment, we don't create LS in the conf dir anymore, you have to upload it 2011-02-26 12:56:32 +00:00
Max Semenik
1fdaf8db17 (bug 1379) Installer directory conflicts with some hosts' configuration panel.
Renamed config/ to mw-config/, however left aliases for b/c.
2011-02-26 12:35:23 +00:00
X!
3589532db4 Per my comment on r68760: Make MWfunction class, complete with call_user_func helper functions that automatically
make the callback PHP 5.1 compatible with the Class::Method syntax. Add Unit tests to supplement it.
2011-01-02 06:48:07 +00:00
Roan Kattouw
195217ba89 (bug 26130) Revert changes to WebStart.php in r72349, which turn out to have been misguided. This should fix double-gzip issues 2010-12-06 20:57:42 +00:00
Tim Starling
07bb8ce5b5 Remove some of the rubbish that has been accumulating in the default LocalSettings.php for years, especially code as opposed to configuration data:
* Don't set $IP. The entry point already sets it, so there's no point. Users can still set it if they can figure out a way to do it without breaking things.
* Don't include DefaultSettings.php. Doing that is code, not configuration, and it can easily be done in WebStart/Maintenance. Some non-standard entry points in extensions may be broken by this. That's their fault for being non-standard. Backwards compatibility is preserved thanks to require_once().
* Introduce $wgInvalidateCacheOnLocalSettingsChange, which when set, causes $wgCacheEpoch to be updated in the way that it previously was in the default LocalSettings.php.
* Don't set $wgLocalInterwiki to some nonsense value (possibly including spaces and punctuation in the new installer). It should be only for actual interwiki prefixes. Since most wikis don't have them, I set this to false by default and adjusted the referring code to accept this. 
* Removed the guard for web invocation with $wgCommandLineMode set. This ancient code is redundant with modern protections in doMaintenance.php. 
* In DefaultSettings.php, fixed fold terminator placement near $wgLoadScript
* Add a web entry point guard. That's one piece of code which really is necessary.
2010-12-06 15:00:56 +00:00
Daniel Friesen
ad787f1574 Add MW_CONFIG_FILE support to load a separate config file instead of LocalSettings.php, similar functionality to MW_CONFIG_CALLBACK but works in some cases that it doesn't. 2010-12-05 06:43:15 +00:00
Chad Horohoe
0138b0952b Followup r68760: add comment 2010-10-18 22:37:44 +00:00
Priyanka Dhanda
cb57d56d8b * WebStart.php and SeleniumWebSettings.php allow include files and global config variables to be set based on the testsuite being run. See discussion in http://www.mediawiki.org/wiki/SeleniumFramework#Test_Wiki_configuration
* Let test suites run without logging in.
2010-10-14 16:38:40 +00:00
Siebrand Mazeland
d088f079e3 Remove some references to no longer supported PHP version.
Also add a FIXME for a check in DefaultSettings.php and fix indentation in install-utils.inc.
2010-10-02 22:22:12 +00:00
Roan Kattouw
32377424b9 Merging resourceloader branch into trunk. Full documentation is at http://www.mediawiki.org/wiki/ResourceLoader and a general overview has been posted on wikitech-li <http://lists.wikimedia.org/pipermail/wikitech-l/2010-September/049253.html>. One important change is that all JS is now loaded at the bottom, so any scripts assuming things from wikibits or whatever are present will fail. 2010-09-04 04:00:09 +00:00
Alexandre Emsenhuber
7b79d94515 * Standardised file description headers
* Added some descriptions
* Added @file where needed
2010-08-14 17:42:40 +00:00
Tim Starling
b40efbc094 Fix URL for $GLOBALS overwrite vulnerability. 2010-07-20 02:17:18 +00:00
Mark A. Hershberger
46d9887336 r68756 - Make the use of MW_CONFIG_CALLBACK compatible with PHP 5.1 2010-06-30 04:25:23 +00:00
Aaron Schulz
248c17383d Removed StartProfiler.php from SVN control and added StartProfiler.sample file. The sample file can be moved to the former name to set profiling. MW will fall back to ProfilerStub.php as usual if there is no StartProfiler.php. 2009-05-07 18:30:26 +00:00
Chad Horohoe
893b41431c Remove last of ini_set() for allow_url_fopen. This hasn't worked since PHP 4.3.4, when it became a PHP_INI_SYSTEM setting. 2009-04-21 16:02:45 +00:00
Tim Starling
8b46714f66 Check for PHP 5.0.x bug *after* checking for PHP 4, so that we don't claim that the user needs to upgrade from 5.0 to 5.1 when in fact they're running PHP 4. 2008-11-07 16:38:01 +00:00
Tim Starling
0d322a394e * Allow $wgDiff3=false
* Don't call quickUserCan('edit') unless section edit is enabled
* In DatabasePostgres and DatabaseSqlite: throw an exception on connection error
* In DatabasePostgres: don't send an invalid connection string whenever one of the fields is empty. Use quoting.
* In Database: make the captured PHP error prettier
* Display a descriptive error message when the user navigates to index.php with PHP 4, not a parse error. Check to see if the *.php5 extension works, using file_get_contents().
* The default port number for PostgreSQL is 5432, not blank.
* Better default for $wgDBname
2008-10-06 00:45:18 +00:00
Tim Starling
c6b902f180 * Reorganised the includes directory, creating subdirectories db, parser and specials
* Wrote a tool to check the integrity of the autoloader class list, fixed some issues that came up.
* Start the autoloader before LocalSettings.php, so that when an extension writer thinks an inefficient one-file special page extension is the way to go, they don't have to use explicit includes to make the class inheritance work. Should continue to work with $IP set in LocalSettings.php as long as $IP is set before extensions are included.
2008-06-16 20:21:26 +00:00
Niklas Laxström
a2d0800d6b * Full path for script includes, this time should work with installations using symlinks
* Some documentation
2008-05-16 17:53:29 +00:00
Daniel Friesen
b1585c7942 Revert 34558/34588. Use of an absolute path specified by __FILE__ breaks anyone using the symlink style of installation and relies on the assumption that the MediaWiki code is always located a directory above the LocalSettings.php file (Even Wikia doesn't follow this) 2008-05-14 11:17:54 +00:00
Rotem Liss
2968d3969a For compatibility (DefaultSettings.php currently crashes when LocalSettings.php doesn't exist). 2008-05-10 16:29:19 +00:00
Niklas Laxström
d10e6a4298 * Use full path 2008-05-10 09:34:27 +00:00
Siebrand Mazeland
79d5225c0e * remove end of line whitespace
* remove empty lines at end of file
* remove "?>" where still present
2008-04-14 07:45:50 +00:00
Aryeh Gregor
a15c419b3d Remove ?>'s from files. They're pointless, and just asking for people to mess with the files and add trailing whitespace. (Yes, I looked over every one and reverted those that were bogus. Slash-enter a million times in less worked well enough, although it was a bit mind-numbing.) 2007-06-29 01:19:14 +00:00
Tim Starling
50eb8b5da4 profiling 2007-04-15 00:20:24 +00:00
Tim Starling
28dc3ec888 * Moved the main ob_start() from the default LocalSettings.php to WebStart.php.
The ob_start() section should preferably be removed from older 
  LocalSettings.php files.
* Give Content-Length header for HTTP/1.0 clients.
* Partial support for Flash cross-domain-policy filtering. Text entry points should be protected, but uploads are not.
2007-02-19 23:03:37 +00:00
Ilmari Karonen
305522e4e6 Detect PHP 5.0.x 64-bit bug and abort in WebStart.php; too many things break
mysteriously otherwise (detection code copied from install-utils.inc)
2006-12-17 13:40:28 +00:00
Brion Vibber
a898dff34e * Improved register_globals paranoia checks 2006-10-11 18:14:27 +00:00
Tim Starling
558487ceac Active protection against register_globals vulnerabilities. Unset all globals which have been set by $_REQUEST, in WebStart.php. All entry points must assume that a user can unset any arbitrary global set before WebStart.php is invoked. This is not usually a problem since most entry points do not set globals before WebStart.php, Yuri's APIs apparently being the only exceptions. 2006-10-11 03:44:49 +00:00
Tim Starling
3ea576aa25 Consolidated web initialisation code into includes/WebStart.php. Moved profiling setup to a hook file "StartProfiler.php", following Brion's suggestion to merge Wikimedia's early profiling patch into subversion. Renamed Profiling.php and logProfilingData(), removed unnecessary wfProfileClose() calls. 2006-07-14 05:35:31 +00:00