Commit graph

206 commits

Author SHA1 Message Date
DannyS712
c1db64b808 Make use of ??= in more places
New feature from PHP 7.4

Change-Id: Ifa7a9bc7b2ec415ad7ecb23f4c1776f51f58fd6b
2022-12-17 01:10:13 +00:00
jenkins-bot
af9efedb55 Merge "Remove references to Suhosin and its INI settings" 2022-11-10 08:36:01 +00:00
Krinkle
08286fdf91 Setup: Promote clearActionName log message to runtime warning (2)
This reverts dc3bd3d721 (I385dca1d95) and re-applies d4ce0f3255 (Ib9fc34ca64).

The CI failures have been addressed.

Bug: T314008
Change-Id: I35a4f656c31b67ebb662bf6f6366f4ee846ecbda
2022-11-08 23:29:25 +00:00
Kevin Israel
17ba1988c0 Remove references to Suhosin and its INI settings
The Suhosin extension is no longer being developed, and its developers
never made a proper release for PHP 7.[1]

The suggested replacement, Snuffleupagus, does not have a configuration
setting for limiting the length of a request value[2]. If one existed,
it would be in the extension's own config file[3], not in php.ini.

Snuffleupagus does have a session encryption feature, which is similar
to that of Suhosin.[4] Note, however, that with the introduction of the
SessionManager framework, such a feature is incompatible with more than
just RequestContext::importScopedSession(). Snuffleupagus fails to
decrypt the string returned by PHPSessionHandler, zend_bailout() is
called[5], and an empty response is sent (unless, of course,
$wgPHPSessionHandling is set to 'disable').

[1]: https://github.com/sektioneins/suhosin7
[2]: https://github.com/jvoisin/snuffleupagus/blob/v0.8.3/config/suhosin.rules#L239-L251
[3]: https://snuffleupagus.readthedocs.io/config.html
[4]: https://snuffleupagus.readthedocs.io/cookies.html#cookie-encryption
[5]: https://github.com/jvoisin/snuffleupagus/blob/v0.8.3/src/sp_session.c#L53-L56

Change-Id: I561729fe2e3b57523de78ce63870987ab91cfd37
2022-11-03 10:34:03 -04:00
Tim Starling
d47ca15928 Make RequestContext::sanitizeLangCode() accept null
I think it's within the meaning of the method to sanitize the type of
the input. Code review shows that it's almost always called with
technically nullable input, so it's convenient to deal with nulls at
this single place.

The linked bug is a PHP 8.1 deprecation warning due to a test which set
up a StaticUserOptionsLookup without a language option.
StaticUserOptionsLookup does not fall back to the site defaults, so the
language was null, causing an error from strtolower().

Bug: T322099
Change-Id: I6dc61476c6869a7648a67be79a4835a5ac24fa92
2022-11-02 13:05:47 +11:00
Amir Sarabadani
bbe704b5c1 Reorg: Move some of request related classes to MediaWiki/Request
Redoing I5ea70120d74 but without moving WebRequest that caused issues
with phan-taint-plugin.

Moving:
 - DerivativeRequest
 - FauxRequest
 - FauxRequestUpload
 - PathRouter
 - WebRequestUpload

Bug: T321882
Change-Id: I832b133aaf61ee9f6190b0227d2f3de99bd1717b
2022-10-28 10:15:31 +00:00
Zabe
f6b9381d7f Revert "Reorg: Move some of request related classes to MediaWiki/Request"
This reverts commit 2bdc0b2b72.

Reason for revert: T166010#8349431

Bug: T166010
Change-Id: Idcd3025647aec99532f5d69b9c1718c531761283
2022-10-27 13:14:16 +00:00
Amir Sarabadani
2bdc0b2b72 Reorg: Move some of request related classes to MediaWiki/Request
Moving:
 - DerivativeRequest
 - FauxRequest
 - FauxRequestUpload
 - PathRouter
 - WebRequest
 - WebRequestUpload

Bug: T166010
Change-Id: I5ea70120d745f2876ae31d039f3f8a51e49e9ad8
2022-10-26 16:49:10 +02:00
Amir Sarabadani
0fff5089ba Reorg: Move StubObject classes in includes to its own directory
Bug: T166010
Change-Id: Idcf0e9dc6e0841e4f132207bce0f96774dad898c
2022-10-25 16:04:48 -04:00
Umherirrender
56adfea4d3 context: Remove deprecated IContextSource::getStats() implementations
Hard-deprecated since a6fe660.

Change-Id: Id26aabcb6cbcedfe45224af161a998bda3aff451
2022-09-30 19:52:40 +00:00
Timo Tijhof
ee5ad165e6 pager: Clean up file headers and @ingroup
Follows similar commits to the objectcache, rdbms, filerepo,
jobqueue components and other areas [1].

* Remove duplicate descriptions from file blocks in favour of class
  doc blocks. This reduces needless duplication and was often
  incorrect or outdated, and helps (ironically) to make the file header
  more consistently visually ignorable.

* Remove `ingroup` from file blocks in class files as otherwise
  the file is indexed twice (e.g. in Doxygen) which makes navigation
  more messy.

* Fix non-standard `@unstable for implementation` annotations
  in favour of `@stable to type` as per T257789 and
  <https://www.mediawiki.org/wiki/Stable_interface_policy>.

  While at it, fix the only other outstanding uses of `@stable for`
  in core as well in a handful of context/, logging/ and search/
  files.

[1] https://gerrit.wikimedia.org/r/q/message:ingroup+owner:Krinkle

Bug: T257789
Change-Id: Ided3c5ab69e1b587b1b76a3c97a7cdb88f21e130
2022-09-29 21:05:08 +01:00
Timo Tijhof
4ac588c634 Setup: Adopt RequestContext::getActionName for most early callers
Most accesses to this value (other than technically incorrect use
via WebRequest::getVal), such as in various extensions,
call Action::getActionName($ctx) rather than MediaWiki::getAction
or the new RequestContext::getActionName.

Related changes recently:
* Introduced in 3fdfef96e4 (I1e259b54dca4).
* Primary caller optimised in d7beb0e4ec (I72ffc9f36613bf9).
* Warning for misuse added in Ib9fc34ca64b7c0e89.

This fixes a bug in DerivativeContext, which got exposed by the
ActionTest test cases, which happen to use DerivativeContext and
inheriting from the global RequestContext. That's not ideal for
the test to do, but did luckily help find this bug.

The issue is that when changing the title or wikipage, the action
cache be cleared and re-computed the next time it is accessed.
The RequestContext class (which is also a mutable context) does
the same and that is already covered by tests.

Bug: T314008
Depends-On: I8434442a61449c16981b19935f2dbdf18e4b4e50
Change-Id: I7d40e7ca4878d43fd7d7614d9c8cf8d29a8c7c4b
2022-09-20 00:05:31 +00:00
jenkins-bot
2f5ca86fac Merge "DerivativeContext: Create WikiPage from derivated title" 2022-08-06 22:05:06 +00:00
Awight
dc3bd3d721 Revert "Setup: Promote clearActionName log message to runtime warning"
This reverts commit d4ce0f3255.

Reason for revert: Causes unrelated test failures, ideally usages are made safe before the patch is merged.

Bug: T312838
Change-Id: I385dca1d95033961d3844e888521750443e49c95
2022-07-12 10:17:59 +00:00
Timo Tijhof
d4ce0f3255 Setup: Promote clearActionName log message to runtime warning
Introduced in 3fdfef96e4 (I1e259b54dca4), and as of d7beb0e4ec
(I72ffc9f36613bf9) the debug message is no longer triggered in a
typical local install, nor in production.

Also:
* Improve detection and attribution by removing the last bit of cache
  duplication in MediaWiki.php and defer to RequestContext.php.

Change-Id: Ib9fc34ca64b7c0e89a774bee9a36fa3882eb4ec3
2022-07-12 15:26:04 +10:00
Matěj Suchánek
a6fe660504 Hard deprecate IContextSource::getStats() implementations
They have been deprecated since 1.27.

Depends-On: I82abb695f30a8c3869dfa620483a9168dbf49fa1
Depends-On: I3da32e6620f2213b50e0e366884c47188208acc1
Change-Id: I49d95873b18261954b0c50ff551f4b1ea9a5fbdf
2022-07-08 09:00:09 +02:00
Umherirrender
3f47934034 DerivativeContext: Create WikiPage from derivated title
DerivateContext::canUseWikiPage checks the derivated title before
calling the underlying request.
Let getWikiPage also use the derivated title first, before calling the
underlying request to be in sync

This avoids "MWException: RequestContext::getWikiPage called without
Title object set" when the derivated request has a title, but the
underlying request does not.

Bug: T297688
Change-Id: I72f5650986b5a6585dc4909b8fe49e39f60f6a14
2022-07-03 15:53:28 +02:00
Umherirrender
7949418333 tests: Expand DerivativeContextTest
Add test for the setter/getter of
Authority, Title, WikiPage and ActionName

Move the inital set into the test function, because some setter
resetting other properties and at test time the state is undefinded.

Also move the unconditional call of UserFactory::newFromAuthority into
::getUser to avoid calling MediaWikiServices from the unit tests

Change-Id: Ibf5eca24f056b2ee5388fa121674366424869f11
2022-07-02 14:43:55 +02:00
jenkins-bot
40abc7d834 Merge "Use User::isRegistered for readability instead of ::getId falsy check" 2022-05-23 04:06:10 +00:00
Umherirrender
03e66106d0 context: Replace deprecated User::getOption
Bug: T296083
Change-Id: I90f129d469163a5e277664f452547cf840a38b58
2022-04-29 21:46:30 +02:00
Umherirrender
49ad716948 Use User::isRegistered for readability instead of ::getId falsy check
Change-Id: I42aab149559e3e899cde6c77af76c66936ed0ef0
2022-04-29 21:15:57 +02:00
Aryeh Gregor
666ca1bdf3 Use MainConfigNames instead of string literals, #2
This covers all occurrences of /onfig->.*get( '/ in includes/.
Undoubtedly there are still plenty more to go.

Change-Id: I33196c4153437778496f40436bcde399638ac361
2022-04-13 18:55:46 +03:00
Timo Tijhof
3fdfef96e4 context: Add a cached RequestContext::getActionName method
This method is dependent on, and inherently must depend on, all of
Title, WikiPage, and WebRequest. And, like Title and WikiPage,
which also have getters in RequestContext, Action is also derived
from a query parameter that is widely recognised in almost all
web requests to index.php.

The status quo in core and extensions, is to obtain this value
via Action::getActionName(), which as a static method that bypasses
dependency injection and also has the problem of not being cached.
Caching it within ActionFactory seems hard and awkward, due to
varying by context.

In change I61d66211bd (22f9a32853) a cached wrapper method was added
internally to the Skin class. In change I8cbc4bba4d248d9 (235820d631)
another cached wrapper was added in the Gadgets extension.

This change takes this approach further by making it a stable public
method on RequestContext.

To facilitate testing and to offer basic confidence in this working
correctly, this commit also adopts the new method in two place that
are considered "safe" (Skin, and OutputPage). Both of these are
called relatively late in the PHP proccess and well after any Setup
code and overrides (such as in MediaWiki.php), during which it is
more complex to call this. I'll audit and update those in a subsequent
change.

Change-Id: I1e259b54dca48a32be5a8c6cbb8eb69aec2da115
2022-03-25 12:12:48 +00:00
Umherirrender
b126dbe3f2 Fix various documentation related to null types
The functions returning null or the class property is set explict null

Found by phan strict checks

Change-Id: I4a271093fb6526564d8083a08249c64cb21f2453
2022-02-26 10:31:24 +01:00
Reedy
2a2bb1e9bd Remove or replace usages of "sane"
Bug: T254646
Change-Id: I096b2cf738a1395a14f1d47bcbed0c2c686c2581
2021-11-22 13:35:17 +00:00
Reedy
7bf779524a Remove or replace usages of "sanity"
Bug: T254646
Change-Id: I2b120f0b9c9e1dc1a6c216bfefa3f2463efe1001
2021-11-19 23:19:42 +00:00
Umherirrender
769bdbf091 docs: Fix nullable documentation for class properties
Change-Id: I6d0577124d852103f485ffdc819876a13f6641c3
2021-09-24 00:54:53 +00:00
DannyS712
a2b20b63d7 Emit deprecation warnings reading from $wgUser
With this patch deprecation warnings will be emitted
if $wgUser is accessed or written into. The only pattern
of usage still allowed is

$oldUser = $wgUser;
$wgUser = $newUser;
// Do something
$wgUser = $oldUser;

Once there is no deprecation warnings, we know that nothing
legitimately depends on $wgUser being set, so we can safely
remove the code that's still allowed as well.

Bug: T267861
Change-Id: Ia1c42b3a32acd0e2bb9b0e93f1dc3c82640dcb22
2021-09-15 20:17:04 -07:00
Kunal Mehta
a85f569dd1 Revert "Use CsrfTokenSet as CSRF token source"
This reverts commit 0d75fdb4f7.

Bug: T287542
Change-Id: Iedd3461869f973f8d621a39e6ad4674cbb577551
2021-08-05 15:48:26 -07:00
libraryupgrader
5357695270 build: Updating dependencies
composer:
* mediawiki/mediawiki-codesniffer: 36.0.0 → 37.0.0
  The following sniffs now pass and were enabled:
  * Generic.ControlStructures.InlineControlStructure
  * MediaWiki.PHPUnit.AssertCount.NotUsed

npm:
* svgo: 2.3.0 → 2.3.1
  * https://npmjs.com/advisories/1754 (CVE-2021-33587)

Change-Id: I2a9bbee2fecbf7259876d335f565ece4b3622426
2021-07-22 03:36:05 +00:00
Petr Pchelko
0d75fdb4f7 Use CsrfTokenSet as CSRF token source
Change-Id: I079d2c802d9b48d6abf7f37fa9ef7dafac631345
2021-07-12 14:19:15 -07:00
Petr Pchelko
6260074a8c Move CRSF token generation to CsrfTokenSet
Change-Id: Idf68f1cc63fb2e01e004ff353fcda026fa4ec10f
2021-06-18 12:24:19 -07:00
Universal Omega
bed2c33c7b RequestContext: add @param documentation to setAuthority()
Change-Id: I78caeb1d76aebcf3e8c6ba48128078a0bbec520c
2021-05-09 23:18:48 +00:00
daniel
ae78073f54 Remove unstable marker from Authority interface
NOTE: this should be backported to 1.36 before the RC0 release!

Bug: T275768
Change-Id: I86c1f6e497dcda820944be5adfd80aed7b9c63bb
2021-04-13 21:24:10 +02:00
Timo Tijhof
26c9849330 docs: Fix 'dependant' typos
The intended word in all these cases was the adjective "dependent".

Whilst the "dependant" does exist, it is a noun and generally
refers to a person. The word is rare used in general, but
especially so in a technology context.

Change-Id: Ic7e2d2ea6a566f4139ff1fdb77f38b0e962ccd9c
2021-02-18 16:59:20 +00:00
Umherirrender
8de3b7d324 Use static closures where safe to use
This is micro-optimization of closure code to avoid binding the closure
to $this where it is not needed.

Created by I25a17fb22b6b669e817317a0f45051ae9c608208

Change-Id: I0ffc6200f6c6693d78a3151cb8cea7dce7c21653
2021-02-11 00:13:52 +00:00
Petr Pchelko
30cf40568b Add Authority to Context
Bug: T271460
Change-Id: If1038c94ccf8f3e59b5242f5c33b66f076c60816
2021-01-20 09:07:27 -06:00
Umherirrender
6f4bf12fa1 Replace deprecated WikiPage::factory in RequestContext
Change-Id: Ib4f3a7f7d60f9e64c0cd00eb05afea6efe81675c
2020-11-11 22:46:45 +01:00
Daimona Eaytoy
d9ebc49147 Typehint SessionManager::getGlobalSession and RequestContext::getMain
These methods use a static property to cache the return value, and
although they're guaranteed to return an object (as per documentation,
current code, and current usage), some static analysis tool may fail to
understand this.

Change-Id: I4317e1bb11e9793de721356a579a7677137e52cc
2020-10-22 19:37:23 +02:00
jenkins-bot
746f24ba3b Merge "Clarify documentaion of RequestContextCreateSkinHook" 2020-10-08 22:55:41 +00:00
Ammar Abdulhamid
954524e4d7 Clarify documentaion of RequestContextCreateSkinHook
The $skin variable is just a variable reference with null value at the
time of the hook run and so does not hold skin object. Attempting to
call skin method on it will lead to error

Change-Id: I6262c3a9b3e5d19183785a2f8956064a91c0b1e7
2020-10-08 14:48:25 +01:00
jenkins-bot
72a90d3d06 Merge "Document hook names in hook interfaces." 2020-10-02 16:15:21 +00:00
daniel
dc436c3cff Introduce and apply NonSerializableTrait
The NonSerializableTrait prevents object serialization via php's native
serialization mechanism. Most objects are not safe to serialize, and
NonSerializableTrait provides a covenient and uniform way to protect
against serialization attempts.

This patch applies the NonSerializableTrait to some key classes in
MediaWiki.

Bug: T187731
Bug: T259181
Change-Id: I0c3b558d97e3415413bbaa3d98f6ebd5312c4a67
2020-09-28 21:55:49 +02:00
daniel
2e57447c58 Document hook names in hook interfaces.
Bug: T258665
Change-Id: Ifddbf57f8aa2e3eb0d5845601376cbafa08ed407
2020-09-27 12:03:12 +02:00
Timo Tijhof
7ab1fe1321 context: Throw from recursive calls to RequestContext::getLanguage
We haven't had these reported in over 90 days. I think we can
promote this to a runtime exception now.

Change-Id: I8c42c68e319df22cec44ef92328b7f0cae6168eb
2020-07-28 23:02:05 +00:00
Timo Tijhof
35d62b19e2 context: Remove duplicate log message from RequestContext::getLanguage()
> A long, long time ago,
> I can still remember how those warnings used to make me smile.
> And, I knew if I had my chance, that I could make those traces dance,
> and... Maybe they'd be present for a while.

Ever since T45086, we have traces for warnings in production
so this is no longer needed. Also it uses getTraceAsString()
which is something we're trying to phase out.

Bug: T233342
Change-Id: I79ce582c7f057b22a9ead2f2b014aba41f869325
2020-07-23 22:10:54 +00:00
jenkins-bot
a5f4732261 Merge "Replace "@stable for implementation" with "@stable to implement"" 2020-07-13 09:31:44 +00:00
jenkins-bot
39705eb311 Merge "Replace "@stable for subclassing" with "@stable to extend"" 2020-07-13 09:31:38 +00:00
jenkins-bot
0270990f0b Merge "Replace "@stable for calling" by "@stable to call"" 2020-07-13 09:27:04 +00:00
daniel
e6e0ad2472 Replace "@stable for implementation" with "@stable to implement"
For compliance with the new version of the table interface policy
(T255803).

This patch was created by an automated search & replace operation
on the includes/ directory.

Bug: T257789
Change-Id: I17e5e92e24c708ffc846945a136347670a3a20c7
2020-07-13 11:05:49 +02:00