Commit graph

162 commits

Author SHA1 Message Date
Petr Pchelko
0d75fdb4f7 Use CsrfTokenSet as CSRF token source
Change-Id: I079d2c802d9b48d6abf7f37fa9ef7dafac631345
2021-07-12 14:19:15 -07:00
Umherirrender
4c2d078c2d api: Inject services into ApiQueryUsers
Bug: T259960
Change-Id: I3465ee0de34430bbd4969ef8a83baed959da5da6
2021-07-03 23:57:18 +02:00
Tim Starling
9c3c0b704b Use array_fill_keys() instead of array_flip() if that reflects the developer's intention
array_fill_keys() was introduced in PHP 5.2.0 and works like
array_flip() except that it does only one thing (copying keys) instead
of two things (copying keys and values). That makes it faster and more
obvious.

When array_flip() calls were paired, I left them as is, because that
pattern is too cute. I couldn't kill something so cute.

Sometimes it was hard to figure out whether the values in array_flip()
result were used. That's the point of this change. If you use
array_fill_keys(), the intention is obvious.

Change-Id: If8d340a8bc816a15afec37e64f00106ae45e10ed
2021-06-15 00:11:10 +00:00
Vlad.shapik
9763c48d17 Reapply "Hard Deprecate User ::getCanonicalName, ::isUsableName, ::isCreatableName""
This reverts commit ecf826a2ee.

Reason for revert: need to edit the patch and then it will be GTG in order to finish hard deprecating of User ::getCanonicalName, ::isUsableName, ::isCreatableName

Change-Id: I2f57f56728fcbeada96dc2228f07dc8bcaa5d4f6
2021-05-31 16:01:36 +03:00
Ppchelko
ecf826a2ee Revert "Hard Deprecate User ::getCanonicalName, ::isUsableName, ::isCreatableName"
This reverts commit b491279268.

Reason for revert: caused CentralAuth tests to fail.

Change-Id: Icb3ed094578df427622e0da2a7462645adcc3d6f
2021-05-05 02:14:47 +00:00
vladshapik
b491279268 Hard Deprecate User ::getCanonicalName, ::isUsableName, ::isCreatableName
Bug: T275030
Change-Id: I60689ee6519c2dbd6d000afa8ac05c3e6b7895d2
2021-05-04 21:20:50 +03:00
Umherirrender
8de3b7d324 Use static closures where safe to use
This is micro-optimization of closure code to avoid binding the closure
to $this where it is not needed.

Created by I25a17fb22b6b669e817317a0f45051ae9c608208

Change-Id: I0ffc6200f6c6693d78a3151cb8cea7dce7c21653
2021-02-11 00:13:52 +00:00
DannyS712
5f076458dd Remove uses of $wgUser in api token methods
Bug: T243708
Change-Id: I2f82af8c3413038fa321434759dc9e9a921e3118
2020-09-09 23:56:17 +00:00
DannyS712
a7d5f4055d Remove deprecated api token hooks
Hooks removed:
APIQueryInfoTokens
APIQueryRecentChangesTokens
APIQueryRevisionsTokens
APIQueryUsersTokens
ApiTokensGetTokenTypes

Bug: T248022
Change-Id: Ieae43b05e7ba4853a3b6c7e2b03197e85a8d3579
2020-09-08 17:08:21 +00:00
jenkins-bot
a4fd6ef060 Merge "Hard-deprecate UserGroupMembership methods replaced by manager" 2020-06-24 18:35:42 +00:00
jenkins-bot
daff5b8e5a Merge "API: Use MediaWikiServices::getAuthManager in various Api classes" 2020-06-20 23:23:07 +00:00
Umherirrender
3d45f17398 API: Use MediaWikiServices::getAuthManager in various Api classes
Change-Id: I0af2e5fe91097077eeaf83027494065a0c1a6c04
2020-06-20 23:04:17 +00:00
Petr Pchelko
62f2dc26ee Hard-deprecate UserGroupMembership methods replaced by manager
Bug: T234921
Change-Id: Id4a700f921d5453dcdd7e1d3b2370dada25328a6
2020-06-12 14:36:26 -07:00
Tim Starling
68c433bd23 Hooks::run() call site migration
Migrate all callers of Hooks::run() to use the new
HookContainer/HookRunner system.

General principles:
* Use DI if it is already used. We're not changing the way state is
  managed in this patch.
* HookContainer is always injected, not HookRunner. HookContainer
  is a service, it's a more generic interface, it is the only
  thing that provides isRegistered() which is needed in some cases,
  and a HookRunner can be efficiently constructed from it
  (confirmed by benchmark). Because HookContainer is needed
  for object construction, it is also needed by all factories.
* "Ask your friendly local base class". Big hierarchies like
  SpecialPage and ApiBase have getHookContainer() and getHookRunner()
  methods in the base class, and classes that extend that base class
  are not expected to know or care where the base class gets its
  HookContainer from.
* ProtectedHookAccessorTrait provides protected getHookContainer() and
  getHookRunner() methods, getting them from the global service
  container. The point of this is to ease migration to DI by ensuring
  that call sites ask their local friendly base class rather than
  getting a HookRunner from the service container directly.
* Private $this->hookRunner. In some smaller classes where accessor
  methods did not seem warranted, there is a private HookRunner property
  which is accessed directly. Very rarely (two cases), there is a
  protected property, for consistency with code that conventionally
  assumes protected=private, but in cases where the class might actually
  be overridden, a protected accessor is preferred over a protected
  property.
* The last resort: Hooks::runner(). Mostly for static, file-scope and
  global code. In a few cases it was used for objects with broken
  construction schemes, out of horror or laziness.

Constructors with new required arguments:
* AuthManager
* BadFileLookup
* BlockManager
* ClassicInterwikiLookup
* ContentHandlerFactory
* ContentSecurityPolicy
* DefaultOptionsManager
* DerivedPageDataUpdater
* FullSearchResultWidget
* HtmlCacheUpdater
* LanguageFactory
* LanguageNameUtils
* LinkRenderer
* LinkRendererFactory
* LocalisationCache
* MagicWordFactory
* MessageCache
* NamespaceInfo
* PageEditStash
* PageHandlerFactory
* PageUpdater
* ParserFactory
* PermissionManager
* RevisionStore
* RevisionStoreFactory
* SearchEngineConfig
* SearchEngineFactory
* SearchFormWidget
* SearchNearMatcher
* SessionBackend
* SpecialPageFactory
* UserNameUtils
* UserOptionsManager
* WatchedItemQueryService
* WatchedItemStore

Constructors with new optional arguments:
* DefaultPreferencesFactory
* Language
* LinkHolderArray
* MovePage
* Parser
* ParserCache
* PasswordReset
* Router

setHookContainer() now required after construction:
* AuthenticationProvider
* ResourceLoaderModule
* SearchEngine

Change-Id: Id442b0dbe43aba84bd5cf801d86dedc768b082c7
2020-05-30 14:23:28 +00:00
DannyS712
e9b012f3b1 Hard-deprecate api hooks for getting tokens
Soft deprecated in 1.24
The following hooks were hard deprecated:
* APIQueryInfoTokens
* APIQueryRecentChangesTokens
* APIQueryRevisionsTokens
* APIQueryUsersTokens
* ApiTokensGetTokenTypes

Bug: T232869
Bug: T232870
Bug: T232871
Bug: T232872
Bug: T232873
Bug: T245329
Change-Id: Ia14eae17b676ee0356eaf0679d8ac3af0b24b86a
2020-03-14 20:35:04 +00:00
Tim Starling
a06e3d06b1 Fix some PHPStorm inspection warnings in includes/api
Notably:
* In ApiManageTags, I used a switch instead of a dynamic function name,
  so that the call graph will be correct.
* In ApiImageRotate, checkTitleUserPermissions() has always returned
  void, this was an error introduced in 4e6810e4a2

Change-Id: Iea22616b8e7e2e0cc804619a54f8690898b2cb82
2020-02-18 14:17:37 -05:00
James D. Forrester
0958a0bce4 Coding style: Auto-fix MediaWiki.Usage.IsNull.IsNull
Change-Id: I90cfe8366c0245c9c67e598d17800684897a4e27
2020-01-10 14:17:13 -08:00
Daimona Eaytoy
598c4d7fcb build: Upgrade phan to 0.9.0
Scalar casts are still allowed (for now), because there's a huge amount
of false positives. Ditto for invalid array offsets.

Thoughts about the rest: luckily, many false positives with array offsets
have gone. Moreover, since *Internal issues are suppressed in the base
config, we can remove inline suppressions.

Unfortunately, there are a couple of new issues about array additions
with only false positives, because apparently they don't take
branches into account.

Change-Id: I5a3913c6e762f77bfdae55051a395fae95d1f841
2019-12-07 20:16:19 +00:00
Brad Jorsch
02d6dc2e4f API: Use ApiBlockInfoTrait in ApiQueryUsers and AllUsers
For efficient bulk querying, this means that
ApiQueryBase::showHiddenUsersAddBlockInfo() needs to return everything
needed by DatabaseBlock::newFromRow().

Since we're rewriting it anyway, we may as well also move
ApiQueryBase::showHiddenUsersAddBlockInfo() out into a trait of its own.

Bug: T232021
Change-Id: I9c5b17a232ecbfbffefc7e40608cf5684ce8a644
2019-09-18 19:44:01 +00:00
Daimona Eaytoy
e70b5b3309 Unsuppress other phan issues (part 4)
Bug: T231636
Depends-On: I58e67c2b38389df874438deada4239510d21654f
Change-Id: I6e5fba7bd273219b1206559420b5bdb78734aa84
2019-08-31 17:13:39 +00:00
Petr Pchelko
5bebae7f96 Remove usages of deprecated User::getRights.
Bug: T220191
Change-Id: Ia7472cf61765fe5fee9ae72cfa9b7060565dbe87
2019-08-20 19:43:54 -07:00
Aaron Schulz
cb15755e92 Normalize use of "INNER JOIN" to "JOIN" in database queries
The ANSI SQL default join type is INNER and this might save
some line breaks here and there.

Change-Id: Ibd39976f46ca3f9b71190d3b60b76ca085787a00
2019-03-06 09:17:30 -08:00
addshore
e5879da149 Pass $key into CommentStore methods and use MediawikiServices
This allows CommentStore to be added to MediaWikiServices
without the need of an aditional Factory.

This change includes a compatability layer to allow the behaviour
from 1.30 to continue to be used while deprecated.

CommentStore::newKey has been deprecated.
Keys are now passed into the public methods of CommentStore
where needed.
The following CommentStore methods have had their signatures changed
to introduced a $key parameter, but when used in conjunction with
CommentStore::newKey behaviour will remain unchanged:
  * CommentStore::getFields
  * CommentStore::getJoin
  * CommentStore::getComment
  * CommentStore::getCommentLegacy
  * CommentStore::insert
  * CommentStore::insertWithTemplate

Change-Id: I3abb62a5cfb0dcd456da9f4eb35583476ae41cfb
2018-02-05 15:34:12 +00:00
Umherirrender
3124a990a2 Use ::class to resolve class names in includes files
This helps to find renamed or misspelled classes earlier.
Phan will check the class names

Change-Id: I07a925c2a9404b0865e8a8703864ded9d14aa769
2018-01-27 20:34:29 +01:00
Umherirrender
c9d303d39e Remove "Created on" from file header comments
It is the job of git and svn to provide this information/metadata.
The form was different, some with short, some with long month name
some with leading zero at the day, some without.
The year is also present in the Copyright clause

Change-Id: If006907b82b9e45f13cfa2e45d41107a95570e1a
2018-01-26 23:12:40 +00:00
Brad Jorsch
3488f49532 Replace selectFields() methods with getQueryInfo()
Several classes have a "selectFields()" static method to tell callers
which fields to select from the database. With the recent comment table
change and the upcoming actor table change, this pattern has become too
simplistic as a SELECT will need to join several tables to be able to
retrieve all the needed fields.

Thus, we deprecate the selectFields() methods in favor of getQueryInfo()
methods that return tables and join conditions in addition to the
fields.

Change-Id: Idcfd15568489d9f03a7ba4460e96610d33bc4089
2017-10-30 22:57:33 +00:00
Brad Jorsch
11cf01dd9a Add comment table and code to start using it
A subsequent patch will remove the old columns.

Bug: T166732
Change-Id: Ic3a434c061ed6e443ea072bc62dda09acbeeed7f
2017-08-30 15:05:00 +10:00
Umherirrender
b5cddfb27b Remove empty lines at begin of function, if, foreach, switch
Organize phpcs.xml a bit

Change-Id: Ifb767729b481b4b686e6d6444cf48b1f580cc478
2017-07-01 11:34:16 +00:00
Umherirrender
be42e09aa8 build: Prepare for mediawiki/mediawiki-codesniffer to 0.9.0
The used phpcs has a bug, so the version 0.9.0 could not be enforced at the moment.
Will be fixed in next version, see T167168

Changed:
- Remove duplicate newline at end of file
- Add space between function and ( for closures
- and -> &&, or -> ||

Change-Id: I4172fb08861729bccd55aecbd07e029e2638d311
2017-06-26 17:14:31 +00:00
This, that and the other
f8008a7cb8 Remove $wgDisableUserGroupExpiry feature flag
This feature flag was added to comply with WMF's schema change policy.
It is no longer needed now that the feature is enabled on WMF sites.
External MW installations will run update.php or manually do DB updates
as required before upgrading MW.

Bug: T162517
Change-Id: I5b532d79fd1e8b178490cf2617499ae62967de2c
2017-05-06 20:50:42 +10:00
Baha
036b9c4167 Make API documentation links language aware
Links generated by the API are now aware of the user's preferred
language and will show documents in that language if available.

To test, log in to mediawiki.org and set your language preference to 'es',
then on an MediaWiki installation with this patch view the generated
expanded API help at `api.php?action=help&recursivesubmodules=1&modules=main`.
Each link to documentation on mediawiki.org should take you to its
translated /es subpage, if one exists.

Bug: T104518
Change-Id: I339a1f3ae1bce9d759cf251899d57c32b1def91e
2017-04-05 11:08:25 -04:00
This, that and the other
1e49fa5d7a Make user_groups queries honor $wgDisableUserGroupExpiry
Follow-up to Icf78cce3f3e362677d10897b8d1103b3df91fa08.

Change-Id: I94102ceb00398940965280d8742a2747631dcc87
2017-01-31 01:21:47 +11:00
This, that and the other
ac8f144c04 Disregard expired user_group rows in special page and API DB queries
An essential follow-up to I93c955dc7a970f78e32aa503c01c67da30971d1a.

Bug: T12493
Change-Id: Icf78cce3f3e362677d10897b8d1103b3df91fa08
2017-01-27 17:05:31 +00:00
This, that and the other
73224f4f8b User group memberships that expire
This patch adds an ug_expiry column to the user_groups table, a timestamp
giving a date when the user group expires. A new UserGroupMembership class,
based on the Block class, manages entries in this table.

When the expiry date passes, the row in user_groups is ignored, and will
eventually be purged from the DB when UserGroupMembership::insert is next
called. Old, expired user group memberships are not kept; instead, the log
entries are available to find the history of these memberships, similar
to the way it has always worked for blocks and protections.

Anyone getting user group info through the User object will get correct
information. However, code that reads the user_groups table directly will
now need to skip over rows with ug_expiry < wfTimestampNow(). See
UsersPager for an example of how to do this.

NULL is used to represent infinite (no) expiry, rather than a string
'infinity' or similar (except in the API). This allows existing user group
assignments and log entries, which are all infinite in duration, to be
treated the same as new, infinite-length memberships, without special
casing everything.

The whole thing is behind the temporary feature flag
$wgDisableUserGroupExpiry, in accordance with the WMF schema change policy.

The opportunity has been taken to refactor some static user-group-related
functions out of User into UserGroupMembership, and also to add a primary
key (ug_user, ug_group) to the user_groups table.

There are a few breaking changes:
- UserRightsProxy-like objects are now required to have a
  getGroupMemberships() function.
- $user->mGroups (on a User object) is no longer present.
- Some protected functions in UsersPager are altered or removed.
- The UsersPagerDoBatchLookups hook (unused in any Wikimedia Git-hosted
  extension) has a change of parameter.

Bug: T12493
Depends-On: Ia9616e1e35184fed9058d2d39afbe1038f56d7fa
Depends-On: I86eb1d5619347ce54a5f33a591417742ebe5d6f8
Change-Id: I93c955dc7a970f78e32aa503c01c67da30971d1a
2017-01-27 09:24:20 +00:00
rlot
ac609b45be ApiQueryUsers: Add ability to search by user ID
Added new 'userids' parameter to ApiQueryUsers.php. It accepts user ID numbers.

Bug: T34494
Change-Id: I8021bc8660f19e90f0f7d43ea0e82d5258c586ab
2016-12-08 19:23:42 +00:00
Brad Jorsch
4e6810e4a2 API: i18n for warnings and errors
API warnings and error messages are currently hard-coded English
strings. This patch changes that.

With a few exceptions, this patch should be compatible with non-updated
extensions:
* The change to ApiBase::$messageMap will blow up anything trying to
  mess with it.
* The changes to the 'ApiCheckCanExecute' hook will cause a wrong
  (probably unparsed) error message to be emitted for extensions not
  already using an ApiMessage. Unless they're currently broken like
  Wikibase.

Bug: T37074
Bug: T47843
Depends-On: Ia2b66b57cd4eaddc30b3ffdd7b97d6ca3e02d898
Depends-On: I2e1bb975bb0045476c03ebe6cdec00259bae22ec
Depends-On: I53987bf87c48f6c00deec17a8e957d24fcc3eaa6
Depends-On: Ibf93a459eb62d30f7c70d20e91ec9faeb80d10ed
Depends-On: I3cf889811f44a15935e454dd42f081164d4a098c
Depends-On: Ieae527de86735ddcba34724730e8730fb277b99b
Depends-On: I535344c29d51521147c2a26c341dae38cec3e931
Change-Id: Iae0e2ce3bd42dd4776a9779664086119ac188412
2016-12-06 10:20:48 -05:00
Brad Jorsch
71c4454be9 API: Don't require 'users' parameter to contain all valid usernames
Instead, go back to validating the individual values so one invalid name
doesn't cause the whole module to error out. The code for that was all
still there, just unused since Ic67fb540.

Bug: T142895
Change-Id: Ia5eae51d69185580ac2c772afc198a92813e407a
2016-08-22 14:22:12 -04:00
Gergő Tisza
854a462dc0 Remove $wgDisableAuthManager
Change-Id: I2b2c9693a275fcc026916bd97f303e7a5c8df341
2016-08-09 23:00:27 +00:00
Gergő Tisza
43f4a05ec3 Return error message in users API cancreate field
That API field exposes AuthManager::canCreateAccount, where the error
message is important.

Change-Id: Idef441b311b94ff0cb6c4deaed1ac93959ee7ee8
2016-05-30 20:16:07 +02:00
Brad Jorsch
54d58ef506 API changes for AuthManager
Changes here are:
* action=login is deprecated for use other than bot passwords
* list=users will indicate if a missing user name is creatable.
* Added action=query&meta=authmanagerinfo
* Added action=clientlogin is to be used to log into the main account
* action=createaccount is changed in a non-BC manner
* Added action=linkaccount
* Added action=unlinkaccount
* Added action=changeauthenticationdata
* Added action=removeauthenticationdata
* Added action=resetpassword

Bug: T110276
Bug: T110747
Bug: T110751
Bug: T32788
Bug: T67857
Bug: T28597
Bug: T76103
Change-Id: I244fa9b1e0623247d6d9fa30990411c6df94a496
2016-05-16 15:12:52 +00:00
Kunal Mehta
6e9b4f0e9c Convert all array() syntax to []
Per wikitech-l consensus:
 https://lists.wikimedia.org/pipermail/wikitech-l/2016-February/084821.html

Notes:
* Disabled CallTimePassByReference due to false positives (T127163)

Change-Id: I2c8ce713ce6600a0bb7bf67537c87044c7a45c4b
2016-02-17 01:33:00 -08:00
Brad Jorsch
381a6ce691 API: Flag "user" parameters in various modules as type 'user'
The API 'user' type accepts both user names and IP addresses, and
applies normalization but not canonicalization. We should be using this
on basically every user parameter to ensure that e.g. IPv6 usernames get
uppercased.

Bug: T122803
Change-Id: Ic67fb54061ac311e54f325b2a1a4658f43b8fef4
2016-01-09 22:16:06 +00:00
Brad Jorsch
72152a7ffc API: Allow querying central user info
meta=siteinfo gets a list of all configured central ID lookup providers
and which one is being used as the default, while meta=userinfo,
list=users, and list=allusers get the ability to return the IDs and
attachment status.

Change-Id: Iea15b6c22baac79b3f8ca6df0e20a6a4299507d2
2015-12-02 22:32:34 +00:00
Thiemo Mättig
3ecd418501 ApiBase::PARAM_DFLT => null is the default anyway
Change-Id: Ic3deeb6b3d7cacbdb85da9ba3cb19051c1182b8f
2015-10-05 10:56:32 +02:00
umherirrender
361e8f6609 API: Use message-per-value for apihelp-query+users-param-prop
Use message-per-value for message
apihelp-query+users-param-prop to allow smaller strings
for translation.
Each prop in a message also will show up a new parameter on the help
page without the adjust of the translation (but than in english instead
of fully skip it).

Change-Id: Ic467e2edc130018c61a30c61864f1f0de89540ff
2015-08-06 10:22:47 +02:00
Brad Jorsch
a90cbb48f8 Cast various things that are supposed to be ints
Mysqli is returning SELECTed ints as strings rather than as ints, I'm
guessing to avoid problems with 64-bit int types on 32-bit systems. PHP
mostly doesn't care, but it causes API JSON output to have strings
instead of ints all over the place.

This also fixes ForeignAPIFile::getUser( 'id' ) returning the user
*name*.

Bug: T98276
Change-Id: Ie6591d72b3ac40172f8176a8ca8b6fad8e9275a5
2015-05-06 11:40:41 -04:00
Brad Jorsch
beab6b009e Change API result data structure to be cleaner in new formats
Nothing in this patch should result in changed output for format=json or
format=php except as noted in RELEASE-NOTES-1.25, and changed output for
format=xml should be similar or cosmetic. However, other code accessing
the result data directly may need to be updated.

Bug: T87053
Bug: T12887
Change-Id: I3500708965cb8869b5aed1543381aad208dadd13
2015-04-20 17:49:37 -04:00
Brad Jorsch
1c57794e37 API: Overhaul ApiResult, make format=xml not throw, and add json formatversion
ApiResult was a mess: some methods could only be used with an array
reference instead of manipulating the stored data, methods that had both
array-ref and internal-data versions had names that didn't at all
correspond, some methods that worked on an array reference were
annoyingly non-static, and then the whole mess with setIndexedTagName.

ApiFormatXml is also entirely annoying to deal with, as it liked to
throw exceptions if certain metadata wasn't provided that no other
formatter required. Its legacy also means we have this silly convention
of using empty-string rather than boolean true, annoying restrictions on
keys (leading to things that should be hashes being arrays of key-value
object instead), '*' used as a key all over the place, and so on.

So, changes here:
* ApiResult is no longer an ApiBase or a ContextSource.
* Wherever sensible, ApiResult provides a static method working on an
  arrayref and a non-static method working on internal data.
* Metadata is now always added to ApiResult's internal data structure.
  Formatters are responsible for stripping it if necessary. "raw mode"
  is deprecated.
* New metadata to replace the '*' key, solve the array() => '[]' vs '{}'
  question, and so on.
* New class for formatting warnings and errors using i18n messages, and
  support for multiple errors and a more machine-readable format for
  warnings. For the moment, though, the actual output will not be changing
  yet (see T47843 for future plans).
* New formatversion parameter for format=json and format=php, to select
  between BC mode and the modern output.
* In BC mode, booleans will be converted to empty-string presence style;
  modules currently returning booleans will need to use
  ApiResult::META_BC_BOOLS to preserve their current output.

Actual changes to the API modules' output (e.g. actually returning
booleans for the new formatversion) beyond the use of
ApiResult::setContentValue() are left for a future change.

Bug: T76728
Bug: T57371
Bug: T33629
Change-Id: I7b37295e8862b188d1f3b0cd07f66ac34629678f
2015-04-10 16:57:15 -04:00
Ricordisamoa
693ec8b76a New convenience method ApiBase::lacksSameOriginSecurity()
For consistent handling of API requests with the 'callback' argument.

Change-Id: Ic6e3483f5e8819498c693650a11728efc1bafcc0
2015-02-27 09:48:37 -05:00
Aaron Schulz
e369f66d00 Replace wfRunHooks calls with direct Hooks::run calls
* This avoids the overhead of an extra function call

Change-Id: I8ee996f237fd111873ab51965bded3d91e61e4dd
2014-12-10 12:26:59 -08:00