Commit graph

165 commits

Author SHA1 Message Date
Daimona Eaytoy
8adf1bfb93 Replace some more usages of deprecated MWException
Bug: T328220
Change-Id: I3c36835fbd90acc301731e2b33ae4815cd4b0cc5
2023-06-09 02:07:08 +02:00
Tim Starling
242a5b2a56 Reset the cached skin in RequestContext::setUser()
Bug: T336504
Change-Id: I4fc815f00933193f6b0eeb996a2f75a4295ecb01
2023-05-12 10:45:54 +10:00
Umherirrender
e04d3a28f6 Replace internal Hooks::runner
The Hooks class contains deprecated functions and the whole class is
going to get removed, so remove the convenience function and inline the
code.

Bug: T335536
Change-Id: I8ef3468a64a0199996f26ef293543fcacdf2797f
2023-05-11 06:17:38 +00:00
Tim Starling
580ec48e5b Fix more PHPStorm inspections (#2)
* Illegal string offset and invalid argument supplied to foreach, due to incorrect type information
* Array internal pointer reset is unnecessary
* $hookData unused since MW 1.35 due to incomplete revert
* array_push() with single element
* Unnecessary sprintf()
* for loop can be replaced with str_repeat()
* preg_replace() can be replaced with rtrim()
* array_values() call is redundant
* Unnecessary cast to string
* Unnecessary ternary. Often the result relies on short-circuit evaluation, but I find it more readable nonetheless.

Change-Id: I4c45bdb59b51b243fa96286bec8b58deb097d707
2023-03-25 00:19:58 +00:00
Matěj Suchánek
c231736471 Fix some typos
Bug: T201491
Change-Id: I5c9408c262f09c936525f35abfacfa92a193b791
2023-03-21 15:58:09 +01:00
James D. Forrester
ad06527fb4 Reorg: Namespace the Title class
This is moderately messy.

Process was principally:

* xargs rg --files-with-matches '^use Title;' | grep 'php$' | \
  xargs -P 1 -n 1 sed -i -z 's/use Title;/use MediaWiki\\Title\\Title;/1'
* rg --files-without-match 'MediaWiki\\Title\\Title;' . | grep 'php$' | \
  xargs rg --files-with-matches 'Title\b' | \
  xargs -P 1 -n 1 sed -i -z 's/\nuse /\nuse MediaWiki\\Title\\Title;\nuse /1'
* composer fix

Then manual fix-ups for a few files that don't have any use statements.

Bug: T166010
Follows-Up: Ia5d8cb759dc3bc9e9bbe217d0fb109e2f8c4101a
Change-Id: If8fc9d0d95fc1a114021e282a706fc3e7da3524b
2023-03-02 08:46:53 -05:00
DannyS712
c1db64b808 Make use of ??= in more places
New feature from PHP 7.4

Change-Id: Ifa7a9bc7b2ec415ad7ecb23f4c1776f51f58fd6b
2022-12-17 01:10:13 +00:00
jenkins-bot
af9efedb55 Merge "Remove references to Suhosin and its INI settings" 2022-11-10 08:36:01 +00:00
Krinkle
08286fdf91 Setup: Promote clearActionName log message to runtime warning (2)
This reverts dc3bd3d721 (I385dca1d95) and re-applies d4ce0f3255 (Ib9fc34ca64).

The CI failures have been addressed.

Bug: T314008
Change-Id: I35a4f656c31b67ebb662bf6f6366f4ee846ecbda
2022-11-08 23:29:25 +00:00
Kevin Israel
17ba1988c0 Remove references to Suhosin and its INI settings
The Suhosin extension is no longer being developed, and its developers
never made a proper release for PHP 7.[1]

The suggested replacement, Snuffleupagus, does not have a configuration
setting for limiting the length of a request value[2]. If one existed,
it would be in the extension's own config file[3], not in php.ini.

Snuffleupagus does have a session encryption feature, which is similar
to that of Suhosin.[4] Note, however, that with the introduction of the
SessionManager framework, such a feature is incompatible with more than
just RequestContext::importScopedSession(). Snuffleupagus fails to
decrypt the string returned by PHPSessionHandler, zend_bailout() is
called[5], and an empty response is sent (unless, of course,
$wgPHPSessionHandling is set to 'disable').

[1]: https://github.com/sektioneins/suhosin7
[2]: https://github.com/jvoisin/snuffleupagus/blob/v0.8.3/config/suhosin.rules#L239-L251
[3]: https://snuffleupagus.readthedocs.io/config.html
[4]: https://snuffleupagus.readthedocs.io/cookies.html#cookie-encryption
[5]: https://github.com/jvoisin/snuffleupagus/blob/v0.8.3/src/sp_session.c#L53-L56

Change-Id: I561729fe2e3b57523de78ce63870987ab91cfd37
2022-11-03 10:34:03 -04:00
Tim Starling
d47ca15928 Make RequestContext::sanitizeLangCode() accept null
I think it's within the meaning of the method to sanitize the type of
the input. Code review shows that it's almost always called with
technically nullable input, so it's convenient to deal with nulls at
this single place.

The linked bug is a PHP 8.1 deprecation warning due to a test which set
up a StaticUserOptionsLookup without a language option.
StaticUserOptionsLookup does not fall back to the site defaults, so the
language was null, causing an error from strtolower().

Bug: T322099
Change-Id: I6dc61476c6869a7648a67be79a4835a5ac24fa92
2022-11-02 13:05:47 +11:00
Amir Sarabadani
bbe704b5c1 Reorg: Move some of request related classes to MediaWiki/Request
Redoing I5ea70120d74 but without moving WebRequest that caused issues
with phan-taint-plugin.

Moving:
 - DerivativeRequest
 - FauxRequest
 - FauxRequestUpload
 - PathRouter
 - WebRequestUpload

Bug: T321882
Change-Id: I832b133aaf61ee9f6190b0227d2f3de99bd1717b
2022-10-28 10:15:31 +00:00
Zabe
f6b9381d7f Revert "Reorg: Move some of request related classes to MediaWiki/Request"
This reverts commit 2bdc0b2b72.

Reason for revert: T166010#8349431

Bug: T166010
Change-Id: Idcd3025647aec99532f5d69b9c1718c531761283
2022-10-27 13:14:16 +00:00
Amir Sarabadani
2bdc0b2b72 Reorg: Move some of request related classes to MediaWiki/Request
Moving:
 - DerivativeRequest
 - FauxRequest
 - FauxRequestUpload
 - PathRouter
 - WebRequest
 - WebRequestUpload

Bug: T166010
Change-Id: I5ea70120d745f2876ae31d039f3f8a51e49e9ad8
2022-10-26 16:49:10 +02:00
Amir Sarabadani
0fff5089ba Reorg: Move StubObject classes in includes to its own directory
Bug: T166010
Change-Id: Idcf0e9dc6e0841e4f132207bce0f96774dad898c
2022-10-25 16:04:48 -04:00
Umherirrender
56adfea4d3 context: Remove deprecated IContextSource::getStats() implementations
Hard-deprecated since a6fe660.

Change-Id: Id26aabcb6cbcedfe45224af161a998bda3aff451
2022-09-30 19:52:40 +00:00
Awight
dc3bd3d721 Revert "Setup: Promote clearActionName log message to runtime warning"
This reverts commit d4ce0f3255.

Reason for revert: Causes unrelated test failures, ideally usages are made safe before the patch is merged.

Bug: T312838
Change-Id: I385dca1d95033961d3844e888521750443e49c95
2022-07-12 10:17:59 +00:00
Timo Tijhof
d4ce0f3255 Setup: Promote clearActionName log message to runtime warning
Introduced in 3fdfef96e4 (I1e259b54dca4), and as of d7beb0e4ec
(I72ffc9f36613bf9) the debug message is no longer triggered in a
typical local install, nor in production.

Also:
* Improve detection and attribution by removing the last bit of cache
  duplication in MediaWiki.php and defer to RequestContext.php.

Change-Id: Ib9fc34ca64b7c0e89a774bee9a36fa3882eb4ec3
2022-07-12 15:26:04 +10:00
Matěj Suchánek
a6fe660504 Hard deprecate IContextSource::getStats() implementations
They have been deprecated since 1.27.

Depends-On: I82abb695f30a8c3869dfa620483a9168dbf49fa1
Depends-On: I3da32e6620f2213b50e0e366884c47188208acc1
Change-Id: I49d95873b18261954b0c50ff551f4b1ea9a5fbdf
2022-07-08 09:00:09 +02:00
Umherirrender
7949418333 tests: Expand DerivativeContextTest
Add test for the setter/getter of
Authority, Title, WikiPage and ActionName

Move the inital set into the test function, because some setter
resetting other properties and at test time the state is undefinded.

Also move the unconditional call of UserFactory::newFromAuthority into
::getUser to avoid calling MediaWikiServices from the unit tests

Change-Id: Ibf5eca24f056b2ee5388fa121674366424869f11
2022-07-02 14:43:55 +02:00
jenkins-bot
40abc7d834 Merge "Use User::isRegistered for readability instead of ::getId falsy check" 2022-05-23 04:06:10 +00:00
Umherirrender
03e66106d0 context: Replace deprecated User::getOption
Bug: T296083
Change-Id: I90f129d469163a5e277664f452547cf840a38b58
2022-04-29 21:46:30 +02:00
Umherirrender
49ad716948 Use User::isRegistered for readability instead of ::getId falsy check
Change-Id: I42aab149559e3e899cde6c77af76c66936ed0ef0
2022-04-29 21:15:57 +02:00
Aryeh Gregor
666ca1bdf3 Use MainConfigNames instead of string literals, #2
This covers all occurrences of /onfig->.*get( '/ in includes/.
Undoubtedly there are still plenty more to go.

Change-Id: I33196c4153437778496f40436bcde399638ac361
2022-04-13 18:55:46 +03:00
Timo Tijhof
3fdfef96e4 context: Add a cached RequestContext::getActionName method
This method is dependent on, and inherently must depend on, all of
Title, WikiPage, and WebRequest. And, like Title and WikiPage,
which also have getters in RequestContext, Action is also derived
from a query parameter that is widely recognised in almost all
web requests to index.php.

The status quo in core and extensions, is to obtain this value
via Action::getActionName(), which as a static method that bypasses
dependency injection and also has the problem of not being cached.
Caching it within ActionFactory seems hard and awkward, due to
varying by context.

In change I61d66211bd (22f9a32853) a cached wrapper method was added
internally to the Skin class. In change I8cbc4bba4d248d9 (235820d631)
another cached wrapper was added in the Gadgets extension.

This change takes this approach further by making it a stable public
method on RequestContext.

To facilitate testing and to offer basic confidence in this working
correctly, this commit also adopts the new method in two place that
are considered "safe" (Skin, and OutputPage). Both of these are
called relatively late in the PHP proccess and well after any Setup
code and overrides (such as in MediaWiki.php), during which it is
more complex to call this. I'll audit and update those in a subsequent
change.

Change-Id: I1e259b54dca48a32be5a8c6cbb8eb69aec2da115
2022-03-25 12:12:48 +00:00
Umherirrender
b126dbe3f2 Fix various documentation related to null types
The functions returning null or the class property is set explict null

Found by phan strict checks

Change-Id: I4a271093fb6526564d8083a08249c64cb21f2453
2022-02-26 10:31:24 +01:00
Reedy
2a2bb1e9bd Remove or replace usages of "sane"
Bug: T254646
Change-Id: I096b2cf738a1395a14f1d47bcbed0c2c686c2581
2021-11-22 13:35:17 +00:00
Reedy
7bf779524a Remove or replace usages of "sanity"
Bug: T254646
Change-Id: I2b120f0b9c9e1dc1a6c216bfefa3f2463efe1001
2021-11-19 23:19:42 +00:00
Umherirrender
769bdbf091 docs: Fix nullable documentation for class properties
Change-Id: I6d0577124d852103f485ffdc819876a13f6641c3
2021-09-24 00:54:53 +00:00
DannyS712
a2b20b63d7 Emit deprecation warnings reading from $wgUser
With this patch deprecation warnings will be emitted
if $wgUser is accessed or written into. The only pattern
of usage still allowed is

$oldUser = $wgUser;
$wgUser = $newUser;
// Do something
$wgUser = $oldUser;

Once there is no deprecation warnings, we know that nothing
legitimately depends on $wgUser being set, so we can safely
remove the code that's still allowed as well.

Bug: T267861
Change-Id: Ia1c42b3a32acd0e2bb9b0e93f1dc3c82640dcb22
2021-09-15 20:17:04 -07:00
libraryupgrader
5357695270 build: Updating dependencies
composer:
* mediawiki/mediawiki-codesniffer: 36.0.0 → 37.0.0
  The following sniffs now pass and were enabled:
  * Generic.ControlStructures.InlineControlStructure
  * MediaWiki.PHPUnit.AssertCount.NotUsed

npm:
* svgo: 2.3.0 → 2.3.1
  * https://npmjs.com/advisories/1754 (CVE-2021-33587)

Change-Id: I2a9bbee2fecbf7259876d335f565ece4b3622426
2021-07-22 03:36:05 +00:00
Petr Pchelko
6260074a8c Move CRSF token generation to CsrfTokenSet
Change-Id: Idf68f1cc63fb2e01e004ff353fcda026fa4ec10f
2021-06-18 12:24:19 -07:00
Universal Omega
bed2c33c7b RequestContext: add @param documentation to setAuthority()
Change-Id: I78caeb1d76aebcf3e8c6ba48128078a0bbec520c
2021-05-09 23:18:48 +00:00
daniel
ae78073f54 Remove unstable marker from Authority interface
NOTE: this should be backported to 1.36 before the RC0 release!

Bug: T275768
Change-Id: I86c1f6e497dcda820944be5adfd80aed7b9c63bb
2021-04-13 21:24:10 +02:00
Umherirrender
8de3b7d324 Use static closures where safe to use
This is micro-optimization of closure code to avoid binding the closure
to $this where it is not needed.

Created by I25a17fb22b6b669e817317a0f45051ae9c608208

Change-Id: I0ffc6200f6c6693d78a3151cb8cea7dce7c21653
2021-02-11 00:13:52 +00:00
Petr Pchelko
30cf40568b Add Authority to Context
Bug: T271460
Change-Id: If1038c94ccf8f3e59b5242f5c33b66f076c60816
2021-01-20 09:07:27 -06:00
Umherirrender
6f4bf12fa1 Replace deprecated WikiPage::factory in RequestContext
Change-Id: Ib4f3a7f7d60f9e64c0cd00eb05afea6efe81675c
2020-11-11 22:46:45 +01:00
Daimona Eaytoy
d9ebc49147 Typehint SessionManager::getGlobalSession and RequestContext::getMain
These methods use a static property to cache the return value, and
although they're guaranteed to return an object (as per documentation,
current code, and current usage), some static analysis tool may fail to
understand this.

Change-Id: I4317e1bb11e9793de721356a579a7677137e52cc
2020-10-22 19:37:23 +02:00
daniel
dc436c3cff Introduce and apply NonSerializableTrait
The NonSerializableTrait prevents object serialization via php's native
serialization mechanism. Most objects are not safe to serialize, and
NonSerializableTrait provides a covenient and uniform way to protect
against serialization attempts.

This patch applies the NonSerializableTrait to some key classes in
MediaWiki.

Bug: T187731
Bug: T259181
Change-Id: I0c3b558d97e3415413bbaa3d98f6ebd5312c4a67
2020-09-28 21:55:49 +02:00
Timo Tijhof
7ab1fe1321 context: Throw from recursive calls to RequestContext::getLanguage
We haven't had these reported in over 90 days. I think we can
promote this to a runtime exception now.

Change-Id: I8c42c68e319df22cec44ef92328b7f0cae6168eb
2020-07-28 23:02:05 +00:00
Timo Tijhof
35d62b19e2 context: Remove duplicate log message from RequestContext::getLanguage()
> A long, long time ago,
> I can still remember how those warnings used to make me smile.
> And, I knew if I had my chance, that I could make those traces dance,
> and... Maybe they'd be present for a while.

Ever since T45086, we have traces for warnings in production
so this is no longer needed. Also it uses getTraceAsString()
which is something we're trying to phase out.

Bug: T233342
Change-Id: I79ce582c7f057b22a9ead2f2b014aba41f869325
2020-07-23 22:10:54 +00:00
daniel
128565505c Mark additional classes as newable for now.
The following glasses are marked as newable per the
Stable Interface Policy, even though logically, they should not be
newable. This is done for classes that are currently instantiated
by extensions, and lack an alternative.

A better way for obtaining an instance of these classes should be
created in the future. At that point, direct instantiation should
be deprecated and replaced.

- includes/ApiMain.php - needs factory
- includes/media/BitmapMetadataHandler.php - should become a stateless service or use handler pattern
- includes/GitInfo.php - should become a stateless service
- includes/logging/LogPage.php - should become a stateless service or use command pattern
- includes/logging/ManualLogEntry.php - should become a stateless service or use command pattern
- includes/poolcounter/PoolCounterWorkViaCallback.php - needs a factory
- includes/context/RequestContext.php - needs to be narrowed down, and should use a factory
- includes/search/SearchHighlighter.php - should have a factory
- includes/TitleArrayFromResult.php - should perhaps be part of TitleFactory
- includes/user/User.php - should at least get a factory method for anons
- includes/diff/Diff.php: needs a TextDiffGenerator service or a factory
- includes/EditPage.php: needs a factory

Bug: T247862
Change-Id: I033158e693c98630ee167d9528fc8c9936f978d4
2020-07-08 18:06:12 +02:00
Tim Starling
47a1619027 Remove terminating line breaks from debug messages
A terminating line break has not been required in wfDebug() since 2014,
however no migration was done. Some of these line breaks found their way
into LoggerInterface::debug() calls, where they mess up the formatting
of the debug log.

So, remove terminating line breaks from wfDebug() and
LoggerInterface::debug() calls.

Also:
* Fix the stripping of leading line breaks from the log header emitted
  by Setup.php. This feature, accidentally broken in 2014, allows
  requests to be distinguished in the log file.
* Avoid using the global variable $self.
* Move the logging of the client IP back to Setup.php. It was moved to
  WebRequest in the hopes that it would not always be needed, however
  $wgRequest->getIP() is now called unconditionally a few lines up in
  Setup.php. This means that it is put in its proper place after the
  "start request" message.
* Wrap the log header code in a closure so that variables like $name do
  not leak into global scope.
* In Linker.php, remove a few instances of an unnecessary second
  parameter to wfDebug().

Change-Id: I96651d3044a95b9d210b51cb8368edc76bebbb9e
2020-06-03 12:01:16 +10:00
Tim Starling
68c433bd23 Hooks::run() call site migration
Migrate all callers of Hooks::run() to use the new
HookContainer/HookRunner system.

General principles:
* Use DI if it is already used. We're not changing the way state is
  managed in this patch.
* HookContainer is always injected, not HookRunner. HookContainer
  is a service, it's a more generic interface, it is the only
  thing that provides isRegistered() which is needed in some cases,
  and a HookRunner can be efficiently constructed from it
  (confirmed by benchmark). Because HookContainer is needed
  for object construction, it is also needed by all factories.
* "Ask your friendly local base class". Big hierarchies like
  SpecialPage and ApiBase have getHookContainer() and getHookRunner()
  methods in the base class, and classes that extend that base class
  are not expected to know or care where the base class gets its
  HookContainer from.
* ProtectedHookAccessorTrait provides protected getHookContainer() and
  getHookRunner() methods, getting them from the global service
  container. The point of this is to ease migration to DI by ensuring
  that call sites ask their local friendly base class rather than
  getting a HookRunner from the service container directly.
* Private $this->hookRunner. In some smaller classes where accessor
  methods did not seem warranted, there is a private HookRunner property
  which is accessed directly. Very rarely (two cases), there is a
  protected property, for consistency with code that conventionally
  assumes protected=private, but in cases where the class might actually
  be overridden, a protected accessor is preferred over a protected
  property.
* The last resort: Hooks::runner(). Mostly for static, file-scope and
  global code. In a few cases it was used for objects with broken
  construction schemes, out of horror or laziness.

Constructors with new required arguments:
* AuthManager
* BadFileLookup
* BlockManager
* ClassicInterwikiLookup
* ContentHandlerFactory
* ContentSecurityPolicy
* DefaultOptionsManager
* DerivedPageDataUpdater
* FullSearchResultWidget
* HtmlCacheUpdater
* LanguageFactory
* LanguageNameUtils
* LinkRenderer
* LinkRendererFactory
* LocalisationCache
* MagicWordFactory
* MessageCache
* NamespaceInfo
* PageEditStash
* PageHandlerFactory
* PageUpdater
* ParserFactory
* PermissionManager
* RevisionStore
* RevisionStoreFactory
* SearchEngineConfig
* SearchEngineFactory
* SearchFormWidget
* SearchNearMatcher
* SessionBackend
* SpecialPageFactory
* UserNameUtils
* UserOptionsManager
* WatchedItemQueryService
* WatchedItemStore

Constructors with new optional arguments:
* DefaultPreferencesFactory
* Language
* LinkHolderArray
* MovePage
* Parser
* ParserCache
* PasswordReset
* Router

setHookContainer() now required after construction:
* AuthenticationProvider
* ResourceLoaderModule
* SearchEngine

Change-Id: Id442b0dbe43aba84bd5cf801d86dedc768b082c7
2020-05-30 14:23:28 +00:00
Petr Pchelko
204fa7e509 Remove usages of deprecated Language methods
Change-Id: Iad3375b141b1d87c890baec6ecd16ed92f93e699
2020-02-16 00:45:48 +00:00
James D. Forrester
4f2d1efdda Coding style: Auto-fix MediaWiki.Classes.UnsortedUseStatements.UnsortedUse
Change-Id: I94a0ae83c65e8ee419bbd1ae1e86ab21ed4d8210
2020-01-10 09:32:25 -08:00
jenkins-bot
b874e6ab98 Merge "Provide a full trace to GlobalTitleFail debug entries" 2020-01-06 19:24:24 +00:00
Kunal Mehta
99007e96c7 Use namespaced IPUtils class
Change-Id: I047e099a93203a59093946d336a143d899d0271f
2020-01-01 02:36:49 -08:00
Daimona Eaytoy
f16d87a8cc Provide a full trace to GlobalTitleFail debug entries
None of these is currently useful: see for instance [1]. Having a whole
trace can help a lot in finding where the faulty call is. Also avoid the
overhead of calling wfDebugLog.

[1] - https://logstash.wikimedia.org/app/kibana#/doc/logstash-*/logstash-mediawiki-2019.12.19/mediawiki?id=AW8gPL5bKWrIH1QRtQa3&_g=h@1251ff0

Bug: T159284
Change-Id: I25e0f0e2ef4899b4eaa644c74fdeaba21d79aefe
2019-12-20 14:12:59 +01:00
jenkins-bot
393909537e Merge "RequestContext: Clarify uselang support and how it works" 2019-11-01 03:08:19 +00:00