Commit graph

54 commits

Author SHA1 Message Date
Kunal Mehta
1c234274d7 ApiFormatJson: Fix dieUsage call on unknown formatversion value
* Add missing error code
* Don't call staticly, it's not a static function

Change-Id: Ib6cee829b589f6fe0d092ebe7cca2a1d16c357fd
2015-04-20 14:57:45 +00:00
Brad Jorsch
db6a9636f1 API: Avoid warnings for parameters that don't exist in format=rawfm
As format=rawfm is intended for debugging, a recent change removed
definition of unnecessary parameters inherited from format=json. But the
inherited code was still assuming they were defined, causing PHP
warnings.

Bug: T96479
Change-Id: Id13ae541f13b6930c535d156dc5aac0a257d31e8
2015-04-20 10:16:03 -04:00
Brad Jorsch
1c57794e37 API: Overhaul ApiResult, make format=xml not throw, and add json formatversion
ApiResult was a mess: some methods could only be used with an array
reference instead of manipulating the stored data, methods that had both
array-ref and internal-data versions had names that didn't at all
correspond, some methods that worked on an array reference were
annoyingly non-static, and then the whole mess with setIndexedTagName.

ApiFormatXml is also entirely annoying to deal with, as it liked to
throw exceptions if certain metadata wasn't provided that no other
formatter required. Its legacy also means we have this silly convention
of using empty-string rather than boolean true, annoying restrictions on
keys (leading to things that should be hashes being arrays of key-value
object instead), '*' used as a key all over the place, and so on.

So, changes here:
* ApiResult is no longer an ApiBase or a ContextSource.
* Wherever sensible, ApiResult provides a static method working on an
  arrayref and a non-static method working on internal data.
* Metadata is now always added to ApiResult's internal data structure.
  Formatters are responsible for stripping it if necessary. "raw mode"
  is deprecated.
* New metadata to replace the '*' key, solve the array() => '[]' vs '{}'
  question, and so on.
* New class for formatting warnings and errors using i18n messages, and
  support for multiple errors and a more machine-readable format for
  warnings. For the moment, though, the actual output will not be changing
  yet (see T47843 for future plans).
* New formatversion parameter for format=json and format=php, to select
  between BC mode and the modern output.
* In BC mode, booleans will be converted to empty-string presence style;
  modules currently returning booleans will need to use
  ApiResult::META_BC_BOOLS to preserve their current output.

Actual changes to the API modules' output (e.g. actually returning
booleans for the new formatversion) beyond the use of
ApiResult::setContentValue() are left for a future change.

Bug: T76728
Bug: T57371
Bug: T33629
Change-Id: I7b37295e8862b188d1f3b0cd07f66ac34629678f
2015-04-10 16:57:15 -04:00
Brad Jorsch
e868f703ad API: Work around wfMangleFlashPolicy()
The things wfMangleFlashPolicy() does to the output break things in the
API. For JSON we can work around it, while for PHP we just have to error
out. XML isn't affected because <> are escaped anyway (unless something
somehow uses 'cross-domain-policy' as a tag name), and the rest are
going away soon so they're not worth the trouble.

Bug: 66776
Change-Id: Idc5f37bd778288a9cde572f081dc753d681ec354
2014-11-20 10:03:31 -05:00
Brad Jorsch
d25cb99202 API: Clean up and internationalize pretty-printed output
The syntax highlighting applied to the XML format is not all that great,
and applying it to other formats is just wrong. Instead of doing it
ourselves, let's just add a hook and let Extension:SyntaxHighlight_GeSHi
do it for us.

But for that to work, we have to add RL support to the pretty-printed
output, which means OutputPage. At the same time, lets internationalize
the header.

Bug: 65403
Change-Id: I04b1a3842abdf1fb360c54aa7164fc7cd2e50f4b
2014-10-13 16:17:37 -07:00
Brad Jorsch
df457f3809 API: HTMLize and internationalize the help, add Special:ApiHelp
The existing API help, formatted as basically a plain-text document
embedded in XML and with a little bolding and a few links
syntax-highlighted in after the fact, works ok for experienced programmers
but isn't at all newbie-friendly. Further, all the help is hard-coded in
English, which isn't very friendly to non-English speakers.

So let's rewrite it. The help text is now obtained from i18n messages
and output in HTML, with the default display consisting of help for a
single module with links to help for other modules. This, of course,
necessitates deprecating many of the existing help-related methods and
hooks and replacing them with new ones, but backwards compatibility is
maintained for almost everything.

At the same time, action=paraminfo also needs to support the
'description' and other help-related fields being output in wikitext or
HTML, and I11cb063d (to access all modules via the 'modules' parameter
instead of having 'modules', 'formatmodules', 'querymodules', and so on)
is folded in.

And we also add Special:ApiHelp. When directly accessed, it simply
redirects to api.php with appropriate parameters. But it's also
transcludable to allow up-to-date API help text to be included within
the on-wiki documentation.

Note this patch doesn't actually add i18n messages for any API modules
besides ApiMain and ApiHelp. That will come in a followup patch, but for
the moment the backwards-compatibility code handles them nicely.

While we're messing with the documentation, we may as well add the
"internal" flag requested in bug 62905 (although the 'includeinternal'
parameter it also requests doesn't make much sense anymore) and a
"deprecated" flag that's needed by several modules now.

Bug: 30936
Bug: 38126
Bug: 42343
Bug: 45641
Bug: 62905
Bug: 63211
Change-Id: Ib14c00df06d85c2f6364d83b2b10ce34c7f513cc
2014-10-10 10:46:39 -04:00
csteipp
fe32899523 SECURITY: Prepend jsonp callback with comment
Mitigate CVE-2014-4671 for unpatched flash players

Bug: 68187
Change-Id: I2f46e623c1f541dbbafb6e8333e0929055098b15
2014-07-30 20:26:39 +02:00
Thiemo Mättig
23632a4ecd Use precise ApiMain/ApiQuery type hints in all API modules
Which type is used depends on the ApiModuleManager responsible for
the API module. There are two managers, one in ApiMain and one in
ApiQuery. Both contain a list of API modules they instantiate.
Both use $this as the first parameter in the constructors of the
individual modules. There is no other regular way to instantiate the
modules, so we know the type must either be ApiMain or ApiQuery.

The lists don't intersect.

I would have prefered the naming scheme $mainModule for ApiMain
modules and $queryModule for ApiQuery modules but since this
doesn't add much I left the shorter variable names untouched.

Change-Id: Ie6bf19150f1c9b619655a06a8e051412665e54db
2014-05-16 11:07:23 -04:00
Siebrand Mazeland
ca209473d1 Remove unneeded uses of else{} in api/
Fixed a little documentation issue, removed a line of unreachable code
and fixed up two formatting issues in the process.

Change-Id: If29391ee1a0daf19973437f36c3216b8716debd0
2013-11-18 21:34:43 +01:00
Siebrand Mazeland
d026e1a403 Address errors and warnings in CodeSniffer in api/
Change-Id: I06de371393d50eada33154626874b106d814642b
2013-11-17 16:52:24 +01:00
Siebrand Mazeland
fe05f85a62 Update formatting on API classes
Change-Id: Ifd18a8de1d2580b723a5b91e8d202818fd97795a
2013-11-14 17:03:20 +00:00
Kevin Israel
79f80cc495 Combine JavaScript and JSON encoding logic
This will help with improving human readability of JS and JSON
objects encoded by both ResourceLoader and the API. This patch
also adds new "utf8" parameter to the JSON formatter of the API.

Changes to FormatJson class:

* Added escaping of '<', '>', and '&' by default to protect against XSS.
* Removed unnecessary escaping of '/' and added an additional option to
  unescape non-ASCII characters (those above U+007F) as well.
* Added PHP 5.3 pretty printing code (to replace Services_JSON) that
  uses a four-space indent as PHP 5.4 does.

Changes to Xml class:

* Defined Xml::encodeJsVar() in terms of FormatJson::encode()
  and added a pretty printing option. Also added a pretty printing
  option to Xml::encodeJsCall() as well.
* Deprecated Xml::escapeJsString() and QuickTemplate::jstext();
  callers have to add quotes themselves, hence the escaping of
  both double quotes and apostrophes.

Bug: 26818
Change-Id: I1987190f1ba5bf41738e7bd611209706c1f6bb5c
2013-03-27 20:22:45 -04:00
Yuri Astrakhan
0aa24ae558 Fixed many small spelling mistakes and php docs, var decl.
Change-Id: I1508ed7eb77e5e4f700fb63955d626c4f5915840
2013-03-10 23:45:51 -04:00
Yuri Astrakhan
503cd2f4ae (bug 35885) remove api version string and parameter
API was using SVN's version keyword which GIT does not support.
All related methods were either removed, or for those that
could have been used from extensions, emptied out.
api.php?version now shows unrecognized param warning.

Change-Id: I910ca1448ed2ed697ac19b17c486d130aa1d7e03
2013-01-18 12:41:18 -05:00
Antoine Musso
4f5d2386f3 escape HTML elements in docblock with double quotes
Doxygen choke on text enclosed by '<' and '>' since it tries to
interpret them as HTML or XML elements. This patch adds double quotes
in includes/api/*.php files around the two following strings:

 <Firstname>.<Lastname>@gmail.com
 <Firstname><Lastname>@gmail.com

Which becomes:

 "<Firstname>.<Lastname>@gmail.com"
 "<Firstname><Lastname>@gmail.com"

Tested locally, it prevents doxygen 1.8.0 related warnings.

Change-Id: I36d82eb3fd4989ee3ffc65b0b527b83711d1ba69
2012-07-15 22:15:45 +02:00
John Du Hart
2e7d867478 Removed the 'eclipse helper' bit on top of every API module
It's a parctice that dates back to 2006 when the API was first written, and frankly isn't covered by the coding conventions. Same thing with the docblocks, they're all copypasted with some bits changed and don't even make sense if you look at them in the genereated code docs.
I don't feel that any of us depend on this anymore (get a better IDE), so in the inerest of consistancy it's time we said goodbye to it.
2011-11-16 00:17:26 +00:00
Sam Reed
6309c920dd Delete all the "API for MediaWiki 1.8+" comments
Add since to ApiQueryQueryPage
2010-12-22 20:52:06 +00:00
Alexandre Emsenhuber
457eb73b61 Standardised file description headers, added @file 2010-08-07 19:59:42 +00:00
Niklas Laxström
b63099ec13 Whitespace fix 2010-07-08 09:28:31 +00:00
Derk-Jan Hartman
921619b119 Correct the address of the FSF in some of the GPL headers
59 Temple Place -> 51 Franklin Street
2010-06-21 13:13:32 +00:00
Sam Reed
e55ed729c4 Mixture of things.
Couple of class comments

Normalisation of "." usage at end of lines (removed)

Normalisation of {prefix}parameter as per bug 23461
2010-05-11 22:30:18 +00:00
Jack Phoenix
604906deb5 API: coding style cleanup, fix copyright symbol, more braces 2010-02-23 12:30:23 +00:00
Mark A. Hershberger
8b36a2b969 various eol whitespace now instead of when someone needs to do CR 2010-02-12 06:44:16 +00:00
Aryeh Gregor
3758769f0d stylize.php on API code
"I wouldn't object to stylizing the API code to bring it in line with
the rest of MW on principle, but I'm not gonna bother myself." --Roan
<http://www.mediawiki.org/wiki/Special:Code/MediaWiki/60657#c5108>

If you're seeing this commit in blames, tell your blame tool to ignore
whitespace, e.g., git blame -w or svn blame -x -w.
2010-01-11 15:55:52 +00:00
Tim Starling
7b7f9f0d4d Comments and whitespace fixes only. 2009-09-10 06:43:01 +00:00
Michael Dale
7efc871cba * (bug 20336) changed json_decode json_encode to static class in global functions
** we should update extensions as well
* added config for fileCheckModify date check to scriptLoader unique script id generation
2009-09-09 22:26:16 +00:00
Michael Dale
52c5db1a47 * removed plain-text output because IE is retarded treats plain-text as html (in fact no mime type I have found lets you send text to IE and have it treat it like text :( .... 2009-08-15 22:38:01 +00:00
Michael Dale
b2d1c1a4b1 * added content-type plain/text output param for json format
* added content-type "application/json" or 'text/javascript' per callback param
2009-08-15 20:24:30 +00:00
Michael Dale
305179ffa3 * added missing setIndexedTagName for some upload api array results
* switched apiFormatJson output from 'application/json' to 'text/javascript'
2009-08-15 10:22:20 +00:00
Michael Dale
aefc40d749 here it is ... the upload-api, script-server, js2 (javascript phase2) branch merge 1st attempt.
Here is a short overview of changes and associated default configuration variables (most everything is off by default) also see ~soon to be updated~: http://www.mediawiki.org/wiki/Media_Projects_Overview

= Upload Improvements =
==Upload API ==
* Based on the early work of Bryan Tong and others it adds the upload option to the api.
* We rewrite Special:Upload page to include use the new refactoring
* Added in token checks in both the SpecialUpload.php page so avoids DOS / xss copy-by-url JavaScript based cross site POST file submissions

== Copy by URL==
$wgAllowCopyUploads = false;
* http class rewrite includes a new http background download see: includes/HttpFunctions.php

* spins off a php process that calls: maintenance/http_session_download.php
* pushes updates to the session and gives the user a progress bar on http copy uploads from other server progress (using js2 upload interface) (if not using the js2 upload interface it does the request in-place but the download is limited to the php ini timeout time)

== Firefogg ==
* Firefogg enables resumable upload by chunks
* progress indicators and conditional invokation (js2 system)
* and of-course client side transcoding.

= Script Server =
$wgEnableScriptLoader = false;
* off by default if $wgEnableScriptLoader is turned on script files are grouped, gziped, cached etc.
for more info see: http://www.mediawiki.org/wiki/Extension:ScriptLoader

* Includes some early skin js include fixes (skin/script system still lots of love)
* Includes a "javascript class autoloader" this is packaged into mwEmbed so that the mwEmbed library can work in stand alone mode (while retaining localization and script serving) (one such application is the make page for firefogg.org : http://www.firefogg.org/make/index.html  )
* The file that contains the autojavascript loading classes is: js2/php/jsAutoloadLocalClasses.php
* One can use this auto class loading dependency system with extensions and add-ons but I need to better document that.

= js2 system  / mwEmbed=
$wgEnableJS2system = false

* includes initial rewrite towards more jquery based javascript code
* especially for the Special:Upload page.
* Also the edit page include support for the "add-media-wizard"
* includes dependency loader for javascript that optionally takes advantage of the script-loader
* remote embedding of javascript interfaces (like embedding video, or commons media searching)

* $wgDebugJavaScript = false; .. .this variable lets you always get "always fresh javascript". When used with the script-loader it does not minify the script-loader output.

= mwEmbed =
* Will commit a separate patch to oggHandler that conditionally outputs  <video tag> to use the new javascript video player.
** mv_embed player includes: play-head, volume control, remote embedding, oggz-chop support across plugins.
* add-media-wizard adds easy inserts of media to pages (with import)

== jQuery==
* we include a base install of jQuery, jQuery ui and some plugins.
* all the javascript classes are in the scriptloader so its easy to load any set of jquery ui components that you may need using the script-server. You get a callback so you can then execute js with dependencies loaded.

== other stuff ==
there is a bit more code in js2 that pertains to sequence editing, timed text display and basic image editing. We include a base import of pixastic-lib & pixastic-editor... will work with the pixastic developer to try and ensure upstream compatibility on our usage of the library for in-browser photo and sequence manipulation.
2009-07-14 23:52:14 +00:00
Roan Kattouw
5811f0e274 API: (bug 16422) Don't show help in format=jsonfm unless specifically requested with action=help 2009-04-28 11:42:14 +00:00
Roan Kattouw
0d4b512622 API: Add a check for PHP bug 45314 (PHP's WDDX formatter messes up UTF-8) and fix up a similar check for JSON, which couldn't possibly succeed due to missing quotes. See also http://lists.wikimedia.org/pipermail/mediawiki-api/2009-March/001039.html 2009-03-23 19:58:07 +00:00
Roan Kattouw
4268665fc1 API: (bug 16798) Fix for PHP bug 46944 (PHP's JSON formatter encodes certain UTF8 characters incorrectly) by falling back to our own formatter if PHP's is broken. Also fix up our own JSON formatter which also messed up these characters, albeit in a different way. Slightly modified patch by Brad Jorsch. 2009-01-12 14:11:20 +00:00
Alexandre Emsenhuber
087a9f70c5 WARNING: HUGE COMMIT
Doxygen documentation update:
* Changed alls @addtogroup to @ingroup. @addtogroup adds the comment to the group description, but doesn't add the file, class, function, ... to the group like @ingroup does. See for example http://svn.wikimedia.org/doc/group__SpecialPage.html where it's impossible to see related files, classes, ... that should belong to that group.
* Added @file to file description, it seems that it should be explicitely decalred for file descriptions, otherwise doxygen will think that the comment document the first class, variabled, function, ... that is in that file.
* Removed some empty comments
* Removed some ?>

Added following groups:
* ExternalStorage
* JobQueue
* MaintenanceLanguage

One more thing: there are still a lot of warnings when generating the doc.
2008-05-20 17:13:28 +00:00
Siebrand Mazeland
79d5225c0e * remove end of line whitespace
* remove empty lines at end of file
* remove "?>" where still present
2008-04-14 07:45:50 +00:00
Bryan Tong Minh
02387af88e (bug 12136) Extend allowed characters in JSON callback to ][.'"_A-Za-z0-9 2008-04-05 18:52:33 +00:00
Brion Vibber
46619295eb Safety fixes for API:
* drop user credentials for JSON callback output
* anticipating future changes, don't report anon edit tokens in JSON callback output
2008-03-03 05:45:37 +00:00
Roan Kattouw
19358606a1 API: Changing all modules' getParamDescription(), getAllowedParams() and getDescription() methods to public. ApiParamInfo needs them, and some versions of PHP threw fatal errors because they were protected. Oddly, other versions didn't (maybe because the caller and the callee have a common ancestor?) 2008-01-28 19:05:26 +00:00
Aryeh Gregor
a15c419b3d Remove ?>'s from files. They're pointless, and just asking for people to mess with the files and add trailing whitespace. (Yes, I looked over every one and reverted those that were bogus. Slash-enter a million times in less worked well enough, although it was a bit mind-numbing.) 2007-06-29 01:19:14 +00:00
Yuri Astrakhan
cb38c11c84 API: documentation and cleanup. 2007-05-20 23:31:44 +00:00
Yuri Astrakhan
6e1226c640 * API: JSON format now allows callback parameter 2007-05-15 18:45:20 +00:00
Nick Jenkins
f9619da3f0 Yet more doc tweaks:
* Add @addtogroup tags to various classes, to try and group conceptually-related classes together.
* Add brief descriptions to various Special pages, thanks to Phil Boswell.
* Moving some docs to be right above the classes they represent, so that they are picked up.
2007-04-20 08:55:14 +00:00
Yuri Astrakhan
ed43f714f4 API * better self-description for various modules
* namespace type for parameters
* fixed bug with incorrect ordering in paging
* fixed bug with revisions and watchlist paging
2006-11-03 06:53:47 +00:00
Yuri Astrakhan
f928f9a6cd API * Better log events info * Added RAW debugging format 2006-10-17 02:01:20 +00:00
Yuri Astrakhan
e5752b2372 * API: added prop parameter to watchlist, added partrolled flag 2006-10-16 05:53:07 +00:00
Yuri Astrakhan
262435b9f8 * API: help screen now shows default and allowed parameter values
* API: added experimental watchlist rss/atom feed
* API: if available, json_encode() will be used
* API: opensearch parameter changed to "search=" (more descriptive)
* API: minor parameter cleanup, a wrapper for Feed class
2006-10-16 00:08:03 +00:00
Yuri Astrakhan
7a710254db * API query optimizations
* API allow modules to have custom printers
2006-10-15 07:43:52 +00:00
Yuri Astrakhan
b56d23ed46 * API: Restructured to allow internal usage. Error handling cleanup.
* API: Added opensearch module, added apprefix param for list=allpages
2006-10-14 07:18:08 +00:00
Yuri Astrakhan
04399b2063 * API: added version information to each module (available via api.php?version command) 2006-10-01 21:20:55 +00:00
Yuri Astrakhan
e859600cea * API: pageSet now supports pageids, revised revisions listings, lots of examples. 2006-10-01 20:17:16 +00:00