Commit graph

73 commits

Author SHA1 Message Date
Amir Sarabadani
bbe704b5c1 Reorg: Move some of request related classes to MediaWiki/Request
Redoing I5ea70120d74 but without moving WebRequest that caused issues
with phan-taint-plugin.

Moving:
 - DerivativeRequest
 - FauxRequest
 - FauxRequestUpload
 - PathRouter
 - WebRequestUpload

Bug: T321882
Change-Id: I832b133aaf61ee9f6190b0227d2f3de99bd1717b
2022-10-28 10:15:31 +00:00
Zabe
f6b9381d7f Revert "Reorg: Move some of request related classes to MediaWiki/Request"
This reverts commit 2bdc0b2b72.

Reason for revert: T166010#8349431

Bug: T166010
Change-Id: Idcd3025647aec99532f5d69b9c1718c531761283
2022-10-27 13:14:16 +00:00
Amir Sarabadani
2bdc0b2b72 Reorg: Move some of request related classes to MediaWiki/Request
Moving:
 - DerivativeRequest
 - FauxRequest
 - FauxRequestUpload
 - PathRouter
 - WebRequest
 - WebRequestUpload

Bug: T166010
Change-Id: I5ea70120d745f2876ae31d039f3f8a51e49e9ad8
2022-10-26 16:49:10 +02:00
Umherirrender
89b2d11a0d tests: Use Title::makeTitle instead of Title::newFromText
Avoid parsing known titles in tests to improve performance

Change-Id: Ie240eb42479d19714e64cc4606e26073fadc2e13
2022-09-23 21:53:11 +02:00
Umherirrender
ef0623ec06 tests/api: Add TestUser::getAuthority and use it
Change-Id: Icfb66f9927c8e67582010a208538b0b5e0ba353f
2022-08-06 23:15:27 +02:00
Umherirrender
6a8f3b4c55 tests/api: Use MediaWikiIntegrationTestCase::editPage for edits
Also improve MediaWikiIntegrationTestCase::editPage by accepting
LinkTarget objects and use services instead of static functions

Change-Id: I3d036b0837f212d3500159c1d3a3daa4e706882c
2022-08-06 22:21:51 +02:00
Tim Starling
51ddd70682 Remove Flash cross-domain policy mangling
Remove Flash cross-domain policy mangling. Users who are somehow still
using Flash as a browser extension will be exposed to CSRF
vulnerabilities.

Deprecate the config since deprecation has some advantages in the new
config system over simple removal.

Bug: T279496
Change-Id: I2c0e85a430d7e6aaf8d5decd00cf1dade04cebe1
2022-07-22 11:44:49 +10:00
Derick Alangi
86d4a253e7 tests: Migrate setMwGlobals() to overrideConfigValue(s)()
Directories covered are: /api/, /auth/ and /block/, more to come.

Change-Id: I9dfb0773cbfff36cba7389ed2d9b3c7b1b22612e
2022-07-19 15:42:15 +01:00
Reedy
0b5084f868 api: Replace numerous deprecated constants
Change-Id: I34ffcb70efbfa257da8dab6e0790aa0d697caf5b
2022-06-06 00:18:50 +01:00
Thiemo Kreuz
29aca66975 Fix visibility of setUp methods in tests
Change-Id: Iefc05b4f4a9c258a385a22fc8d87b29648900e44
2022-05-17 14:11:22 +02:00
Aaron Schulz
5c3547a5bb tests: Avoid unsafe use of setUpBeforeClass() in ApiFormatXmlTest
This avoids "Can't create user on real database" errors that can
occur if the order of test classes changes.

Bug: T50217
Change-Id: Iccd6a2d4f207d2a9ddf62544b3a24a9db15bda55
2022-03-07 21:59:49 +00:00
Timo Tijhof
8d406bbcd6 phpcs: Disable Generic.Files.LineLength for test files
There is a common and reasonable need for longer lines in tests.
The nudge for shorter lines doesn't seem valuable here. The natural
breaks will likely still fall in 80-100 given the enforced practice
for non-test code, e.g. whether through habit, or 80-100 column markers
in text editors, or the finite width of diff and code review
interfaces.

Change-Id: I879479e13551789a67624ce66f0946d2f185e6ee
2022-02-18 18:32:05 +00:00
Reedy
8c39aab84b Remove or replace usages of "sanity"
Bug: T254646
Change-Id: Ib192dc5704a14d02c7c374d0ab29bac55c5df24a
2021-11-21 19:35:49 +00:00
libraryupgrader
5357695270 build: Updating dependencies
composer:
* mediawiki/mediawiki-codesniffer: 36.0.0 → 37.0.0
  The following sniffs now pass and were enabled:
  * Generic.ControlStructures.InlineControlStructure
  * MediaWiki.PHPUnit.AssertCount.NotUsed

npm:
* svgo: 2.3.0 → 2.3.1
  * https://npmjs.com/advisories/1754 (CVE-2021-33587)

Change-Id: I2a9bbee2fecbf7259876d335f565ece4b3622426
2021-07-22 03:36:05 +00:00
DannyS712
b45ddb2ab3 Use WikiPage::doUserEditContent() instead of ::doEditContent()
Results in passing a user where previously the fallback
to $wgUser was being used, mostly in tests.

Bug: T255507
Change-Id: Iabe24315b23c0ad1272353186425e71974528d23
2021-06-28 00:11:30 -07:00
Daimona Eaytoy
535d7abf59 phpunit: Mass-replace setMethods with onlyMethods and adjust
Ended up using
  grep -Prl '\->setMethods\(' . | xargs sed -r -i 's/setMethods\(/onlyMethods\(/g'

special-casing setMethods( null ) -> onlyMethods( [] )

and then manual fix of failing test (from PS2 onwards).

Bug: T278010
Change-Id: I012dca7ae774bb430c1c44d50991ba0b633353f1
2021-04-16 20:15:00 +02:00
Umherirrender
a1de8b8700 Tests: Mark more more closures as static
Result of a new sniff I25a17fb22b6b669e817317a0f45051ae9c608208

Bug: T274036
Change-Id: I695873737167a75f0d94901fa40383a33984ca55
2021-02-09 02:55:57 +00:00
jdlrobson
7f0412e644 Expose portlet data in SkinMustache
This data structure is sufficient to generate menus in
all Wikimedia deployed skins.

This new method will be used immediately in Example skin:
 Ifb30a2c1314692c2869bd99c523e19c821be1f08

and Vector skin:
I5f7adc1840441b508ffee40139b85b64021789e6

Bug: T262098
Bug: T255924
Change-Id: I1a163cac0bff7620dcac50350cb6b93445a0cfbc
2020-09-22 14:06:29 -07:00
addshore
959bc315f2 MediaWikiTestCase to MediaWikiIntegrationTestCase
The name change happened some time ago, and I think its
about time to start using the name name!
(Done with a find and replace)

My personal motivation for doing this is that I have started
trying out vscode as an IDE for mediawiki development, and
right now it doesn't appear to handle php aliases very well
or at all.

Change-Id: I412235d91ae26e4c1c6a62e0dbb7e7cf3c5ed4a6
2020-06-30 17:02:22 +01:00
Daimona Eaytoy
2e02e7fdb1 Fix most PHPUnit 8 compat issues in DBless tests
This patch fixes all PHPUnit 8 compat issues in the DBless suite, aside
from assertArraySubset.

Bug: T192167
Change-Id: Iea782386509b9e579f06d63687669e14bc437fad
2019-12-15 00:24:21 +00:00
Umherirrender
a1f0be1c21 Use nullable type in function signature
Enable the sniff

Change-Id: I9fff860706b0ffb99bb9e78ff26d15bc7c87bdb4
2019-11-20 19:20:38 +01:00
Max Semenik
dd7026585c Backwards-compatible PHPUnit 8 preparations
This commit splits changes from Ic14f5debc53e55d6714 to reduce it to
only strictly needed things. It can be merged immediately.

Bug: T192167
Change-Id: I8c541a66ea13421dbe7fa51d197d5455cc4786eb
2019-11-02 12:40:07 -07:00
Max Semenik
48a323f702 tests: Add explicit return type void to setUp() and tearDown()
Bug: T192167
Depends-On: I581e54278ac5da3f4e399e33f2c7ad468bae6b43
Change-Id: I3a21fb55db76bac51afdd399cf40ed0760e4f343
2019-10-30 14:31:22 -07:00
Daimona Eaytoy
8545ce131a Kill the remaining usages of PHPUnit4And6Compat methods
Bug: T192167
Change-Id: I1ea19e9b53683b7d32ff9836990ee73ab3e11104
2019-10-06 10:12:54 +00:00
Thiemo Kreuz
400a3d5e22 tests: Add type hints to ApiFormatBaseTest
These help making the code much more readable and explorable. IDEs
now allow to ctrl+click most of the methods to jump to their source.

Change-Id: If1e55fa549de27be2549f245eca6938ecd5cfd82
2019-09-26 14:14:47 +02:00
mainframe98
7b2fb55711 Mark passing non ObjectFactory spec to ApiModuleManager as deprecated
With Iee04afc27283547dd68d6db93f44ac2e0ebf1258, passing both the $class
and $factory parameter is deprecated in favor of just passing an
ObjectFactory spec as the third parameter.

Change-Id: I7b04d82c9daba52f5dc5e6c528739336279c7550
2019-09-09 21:59:03 +02:00
mainframe98
eb8823743c Use ObjectFactory to create API modules
This will allow constructing API modules that need services.

This overhauls some of the internals of the ApiModuleManager,
but the public interface remains unchanged.
The $class parameter of addModule, (now called $spec)
also allows passing an array with the spec of the module.
Note that this spec requires the attribute 'class' to be present,
even when 'factory' is specified. This is the same as before,
where $class was always required.

In a perfect DI world ObjectFactory would be injected into
ApiMain::__construct and ApiMain would pass that to its instance
of ApiModuleManager, but that is currently not possible, so for now
it is injected in ApiModuleManager by having ApiMain::__construct
call the service locator.

Bug: T222388
Change-Id: Iee04afc27283547dd68d6db93f44ac2e0ebf1258
2019-09-09 18:50:16 +00:00
C. Scott Ananian
afd3dbaa95 Don't silently fail if API result fails to encode
Ensure that errors encoding API results produce actionable log entries.

Part of the follow-up to T210550.

Change-Id: I6f311451e3b07b540f14352ce25af9d74a053d19
2018-12-05 13:28:33 -05:00
Aryeh Gregor
edb52e7338 Improve ApiFormatJson test coverage
The only thing missing is tests for the rawfm paths, which I don't
understand well enough to test easily.

Change-Id: I08779391798b9d2d5eeb7e19ec4764059336069c
2018-10-08 13:42:20 +03:00
Tim Starling
f6d582a91e Avoid a redirect loop when the request URL is not normalized
If the request URL was not normalized, for example having a double slash
in it, this could cause it to fail to match in the PathRouter. But the
canonicalizing redirect was using the normalized URL, causing a redirect
loop exception.

So:

* If the PathRouter fails to match with the original URL, try matching
  against the normalized URL. This allows it to still work for
  normalized URLs with a double slash in the title part of the path.
* Have WebRequest::getFullRequestURL() always return the URL without
  removing dot segments or interpreting double slashes. Just append
  the path to the server.
* Make MediaWikiTest.php use WebRequest instead of FauxRequest, allowing
  it to reproduce the exception in question. Add relevant test.
* Add tests for the new PathRouter behaviour.

Bug: T100782
Change-Id: Ic0f3a0060904abc364f75dae920480b81175d52f
2018-07-16 15:55:59 +10:00
Bartosz Dziewoński
485f66f174 Use PHP 7 '??' operator instead of '?:' with 'isset()' where convenient
Find: /isset\(\s*([^()]+?)\s*\)\s*\?\s*\1\s*:\s*/
Replace with: '\1 ?? '

(Everywhere except includes/PHPVersionCheck.php)
(Then, manually fix some line length and indentation issues)

Then manually reviewed the replacements for cases where confusing
operator precedence would result in incorrect results
(fixing those in I478db046a1cc162c6767003ce45c9b56270f3372).

Change-Id: I33b421c8cb11cdd4ce896488c9ff5313f03a38cf
2018-05-30 18:06:13 -07:00
Fomafix
37789ebf45 Xml.php: Do not escape double quotes in $contents of Xml::element()
There is no need to escape double quotes in content of XML.
Html::element() also does not escape double quotes in content.

ENT_NOQUOTES escapes '<', '>' and '&' but not "'" and '"'.
https://secure.php.net/manual/en/function.htmlspecialchars.php

Change-Id: I3b585c43e532cca1a8951d6c9e8b4825fc3b012d
2018-05-23 20:03:54 +00:00
Timo Tijhof
665e9b7bf2 Convert OutputHandler functions to a class
* Convert OutputHandler.php from global functions to a class.

  - wfOutputHandler → OutputHandler::handle
    (no alias, no usage outside core)
  - wfGzipHandler → OutputHandler::handleGzip
    (private, no usage outside class)
  - wfRequestExtension → OutputHandler::findUriExtension
    (private, no usage outside class)
  - wfMangleFlashPolicy → OutputHandler::mangleFlashPolicy
    (private, no usage outside class)
  - wfDoContentLength → OutputHandler::emitContentLength
    (private, no usage outside class)
  - wfHtmlValidationHandler → OutputHandler::validateAllHtml
    (private, no usage outside class)

* Add the class to autoload.php for exposure outside WebStart.
  Specifically, for use in ApiFormatPhpTest. This also removes the
  need to manually load the class because this code runs after
  Setup.php loads AutoLoader.php.

Bug: T189966
Change-Id: I27a41ec0ae0ee30aeb313a616323b967605c4055
2018-03-20 21:11:32 -07:00
Brad Jorsch
7bc541a4a7 ApiFormatBase: Encode filenames in Content-Disposition
The return value for ApiFormatBase::getFilename() was formerly
documented as "must be encoded for inclusion in a Content-Disposition
header's filename parameter." While this is ok for the common use case
where the module is returning a constant string or can assume whatever
it gets back from getExtensionsForType() is ok, it's not in general a
good idea to make all callers handle that.

Further, it's not possible to represent characters outside of the
ISO-8859-1 character set in a 'filename' parameter. You have to use
'filename*' to do that (see RFC 5987 and RFC 6266).

So, this patch changes the definition of getFilename() to remove the
encoding requirement, and adds code to properly convert and escape the
value for the 'filename' and (if necessary) 'filename*' parameters.

Note this may give unexpected results (double encoding) if any module
actually is returning an encoded filename. I don't see any such cases in
core or in extensions in Gerrit.

Change-Id: I0c2749a847b639f228efff4e1917a61612a1f7d1
2018-02-07 15:12:33 -05:00
Umherirrender
45da581551 Use ::class to resolve class names in tests
This helps to find renamed or misspelled classes earlier.
Phan will check the class names

Change-Id: Ie541a7baae10ab6f5c13f95ac2ff6598b8f8950c
2018-01-26 22:49:13 +01:00
Phantom42
92e249c4dc Add tests for ApiFormatRaw
Bug: T183767
Change-Id: I63ce42dd61f6e47f7278c436cad1e4f05e287b04
2018-01-04 19:28:27 +02:00
Brad Jorsch
a8f5964cfe Add tests for ApiFormatBase
Ensuring proper behavior of the base class lets comprehensive tests of
subclasses be simpler.

This also adjusts ApiFormatTestBase to be a bit more usable, passing an
array of options through to encodeData() instead of just a class name.
And removes the unused 'SKIP' from testGeneralEncoding, but allows
expecting an exception (for use in I63ce42dd).

Change-Id: Ib2a1fa0b04860b09105376881ff8411f9534c453
2018-01-03 16:08:12 -05:00
Umherirrender
255d76f2a1 build: Updating mediawiki/mediawiki-codesniffer to 15.0.0
Clean up use of @codingStandardsIgnore
- @codingStandardsIgnoreFile -> phpcs:ignoreFile
- @codingStandardsIgnoreLine -> phpcs:ignore
- @codingStandardsIgnoreStart -> phpcs:disable
- @codingStandardsIgnoreEnd -> phpcs:enable

For phpcs:disable always the necessary sniffs are provided.
Some start/end pairs are changed to line ignore

Change-Id: I92ef235849bcc349c69e53504e664a155dd162c8
2018-01-01 14:10:16 +01:00
Brad Jorsch
4e6810e4a2 API: i18n for warnings and errors
API warnings and error messages are currently hard-coded English
strings. This patch changes that.

With a few exceptions, this patch should be compatible with non-updated
extensions:
* The change to ApiBase::$messageMap will blow up anything trying to
  mess with it.
* The changes to the 'ApiCheckCanExecute' hook will cause a wrong
  (probably unparsed) error message to be emitted for extensions not
  already using an ApiMessage. Unless they're currently broken like
  Wikibase.

Bug: T37074
Bug: T47843
Depends-On: Ia2b66b57cd4eaddc30b3ffdd7b97d6ca3e02d898
Depends-On: I2e1bb975bb0045476c03ebe6cdec00259bae22ec
Depends-On: I53987bf87c48f6c00deec17a8e957d24fcc3eaa6
Depends-On: Ibf93a459eb62d30f7c70d20e91ec9faeb80d10ed
Depends-On: I3cf889811f44a15935e454dd42f081164d4a098c
Depends-On: Ieae527de86735ddcba34724730e8730fb277b99b
Depends-On: I535344c29d51521147c2a26c341dae38cec3e931
Change-Id: Iae0e2ce3bd42dd4776a9779664086119ac188412
2016-12-06 10:20:48 -05:00
Brad Jorsch
f459c1aeca SECURITY: Improve cross-domain-policy mangling
Take into account that the tag might have parameters.

Bug: T123653
Change-Id: Ie9799f5ea45badfb4e7b4be7e7fbc1c35cc86f26

Signed-off-by: Chad Horohoe <chadh@wikimedia.org>
2016-05-20 09:48:11 -07:00
Reedy
83fb19cb13 Swap the rest of array() -> []
Change-Id: I76a7259ed952a0673a1941f08b39b545211fba07
2016-03-30 22:04:58 +00:00
Kunal Mehta
6e9b4f0e9c Convert all array() syntax to []
Per wikitech-l consensus:
 https://lists.wikimedia.org/pipermail/wikitech-l/2016-February/084821.html

Notes:
* Disabled CallTimePassByReference due to false positives (T127163)

Change-Id: I2c8ce713ce6600a0bb7bf67537c87044c7a45c4b
2016-02-17 01:33:00 -08:00
Brad Jorsch
42e257a1a2 API: Remove dbg, txt, and yaml formats
Per RFC: https://www.mediawiki.org/wiki/Requests_for_comment/Ditch_crappy_API_formats

Bug: T95715
Change-Id: I8e4e9ad3c96504cf4587cb4632504eff21b5ff75
2015-11-18 09:19:51 -05:00
Amir E. Aharoni
c50cbe48ab Fix remaining Generic.Files.LineLength failures
Except the ones for which there is no clear way to fix
because of T114213.

Bug: T102614
Change-Id: I94a1fc7c890c82a36f0b51e42d311585c275775c
2015-10-03 17:23:07 +00:00
Amir E. Aharoni
94068c3e81 Fix Generic.Files.LineLength phpcs check under phpunit/includes/api
Bug: T102614
Change-Id: Ic0b3d9b58fee8dc20a976ae65dcb7072a3afc3b1
2015-10-03 17:18:05 +00:00
umherirrender
271da88127 Some bugzilla.wikimedia.org -> phabricator.wikimedia.org changes
Changed some old bugzilla links to new phabricator links in comments,
test data and error message. This reduces the need for redirects from
old bugzilla to new phabricator from our source code.

Change-Id: Id98278e26ce31656295a23f3cadb536859c4caa5
2015-09-24 17:17:25 +02:00
Max Semenik
b1876e3dd7 API: Remove WDDX and dump formats
Per RFC: https://www.mediawiki.org/wiki/Requests_for_comment/Ditch_crappy_API_formats

Change-Id: I4c9e64875be509906021255d70b90688f2e5ddf3
2015-07-01 11:43:39 -04:00
Brad Jorsch
4bbd86a859 API: Also mangle indexed tag names in format=xml
I had thought no one would be silly enough to set invalid tag names for
ApiResult::setIndexedTagName(), since it's specifically *for* XML tag
names. Apparently I was wrong.

Bug: T97599
Change-Id: I62ad832b1d8c23a275e5c67160f0b1febe5f3454
2015-04-30 09:02:17 -04:00
Brad Jorsch
beab6b009e Change API result data structure to be cleaner in new formats
Nothing in this patch should result in changed output for format=json or
format=php except as noted in RELEASE-NOTES-1.25, and changed output for
format=xml should be similar or cosmetic. However, other code accessing
the result data directly may need to be updated.

Bug: T87053
Bug: T12887
Change-Id: I3500708965cb8869b5aed1543381aad208dadd13
2015-04-20 17:49:37 -04:00
Brad Jorsch
1c57794e37 API: Overhaul ApiResult, make format=xml not throw, and add json formatversion
ApiResult was a mess: some methods could only be used with an array
reference instead of manipulating the stored data, methods that had both
array-ref and internal-data versions had names that didn't at all
correspond, some methods that worked on an array reference were
annoyingly non-static, and then the whole mess with setIndexedTagName.

ApiFormatXml is also entirely annoying to deal with, as it liked to
throw exceptions if certain metadata wasn't provided that no other
formatter required. Its legacy also means we have this silly convention
of using empty-string rather than boolean true, annoying restrictions on
keys (leading to things that should be hashes being arrays of key-value
object instead), '*' used as a key all over the place, and so on.

So, changes here:
* ApiResult is no longer an ApiBase or a ContextSource.
* Wherever sensible, ApiResult provides a static method working on an
  arrayref and a non-static method working on internal data.
* Metadata is now always added to ApiResult's internal data structure.
  Formatters are responsible for stripping it if necessary. "raw mode"
  is deprecated.
* New metadata to replace the '*' key, solve the array() => '[]' vs '{}'
  question, and so on.
* New class for formatting warnings and errors using i18n messages, and
  support for multiple errors and a more machine-readable format for
  warnings. For the moment, though, the actual output will not be changing
  yet (see T47843 for future plans).
* New formatversion parameter for format=json and format=php, to select
  between BC mode and the modern output.
* In BC mode, booleans will be converted to empty-string presence style;
  modules currently returning booleans will need to use
  ApiResult::META_BC_BOOLS to preserve their current output.

Actual changes to the API modules' output (e.g. actually returning
booleans for the new formatversion) beyond the use of
ApiResult::setContentValue() are left for a future change.

Bug: T76728
Bug: T57371
Bug: T33629
Change-Id: I7b37295e8862b188d1f3b0cd07f66ac34629678f
2015-04-10 16:57:15 -04:00