Commit graph

137 commits

Author SHA1 Message Date
Umherirrender
769bdbf091 docs: Fix nullable documentation for class properties
Change-Id: I6d0577124d852103f485ffdc819876a13f6641c3
2021-09-24 00:54:53 +00:00
DannyS712
a2b20b63d7 Emit deprecation warnings reading from $wgUser
With this patch deprecation warnings will be emitted
if $wgUser is accessed or written into. The only pattern
of usage still allowed is

$oldUser = $wgUser;
$wgUser = $newUser;
// Do something
$wgUser = $oldUser;

Once there is no deprecation warnings, we know that nothing
legitimately depends on $wgUser being set, so we can safely
remove the code that's still allowed as well.

Bug: T267861
Change-Id: Ia1c42b3a32acd0e2bb9b0e93f1dc3c82640dcb22
2021-09-15 20:17:04 -07:00
libraryupgrader
5357695270 build: Updating dependencies
composer:
* mediawiki/mediawiki-codesniffer: 36.0.0 → 37.0.0
  The following sniffs now pass and were enabled:
  * Generic.ControlStructures.InlineControlStructure
  * MediaWiki.PHPUnit.AssertCount.NotUsed

npm:
* svgo: 2.3.0 → 2.3.1
  * https://npmjs.com/advisories/1754 (CVE-2021-33587)

Change-Id: I2a9bbee2fecbf7259876d335f565ece4b3622426
2021-07-22 03:36:05 +00:00
Petr Pchelko
6260074a8c Move CRSF token generation to CsrfTokenSet
Change-Id: Idf68f1cc63fb2e01e004ff353fcda026fa4ec10f
2021-06-18 12:24:19 -07:00
Universal Omega
bed2c33c7b RequestContext: add @param documentation to setAuthority()
Change-Id: I78caeb1d76aebcf3e8c6ba48128078a0bbec520c
2021-05-09 23:18:48 +00:00
daniel
ae78073f54 Remove unstable marker from Authority interface
NOTE: this should be backported to 1.36 before the RC0 release!

Bug: T275768
Change-Id: I86c1f6e497dcda820944be5adfd80aed7b9c63bb
2021-04-13 21:24:10 +02:00
Umherirrender
8de3b7d324 Use static closures where safe to use
This is micro-optimization of closure code to avoid binding the closure
to $this where it is not needed.

Created by I25a17fb22b6b669e817317a0f45051ae9c608208

Change-Id: I0ffc6200f6c6693d78a3151cb8cea7dce7c21653
2021-02-11 00:13:52 +00:00
Petr Pchelko
30cf40568b Add Authority to Context
Bug: T271460
Change-Id: If1038c94ccf8f3e59b5242f5c33b66f076c60816
2021-01-20 09:07:27 -06:00
Umherirrender
6f4bf12fa1 Replace deprecated WikiPage::factory in RequestContext
Change-Id: Ib4f3a7f7d60f9e64c0cd00eb05afea6efe81675c
2020-11-11 22:46:45 +01:00
Daimona Eaytoy
d9ebc49147 Typehint SessionManager::getGlobalSession and RequestContext::getMain
These methods use a static property to cache the return value, and
although they're guaranteed to return an object (as per documentation,
current code, and current usage), some static analysis tool may fail to
understand this.

Change-Id: I4317e1bb11e9793de721356a579a7677137e52cc
2020-10-22 19:37:23 +02:00
daniel
dc436c3cff Introduce and apply NonSerializableTrait
The NonSerializableTrait prevents object serialization via php's native
serialization mechanism. Most objects are not safe to serialize, and
NonSerializableTrait provides a covenient and uniform way to protect
against serialization attempts.

This patch applies the NonSerializableTrait to some key classes in
MediaWiki.

Bug: T187731
Bug: T259181
Change-Id: I0c3b558d97e3415413bbaa3d98f6ebd5312c4a67
2020-09-28 21:55:49 +02:00
Timo Tijhof
7ab1fe1321 context: Throw from recursive calls to RequestContext::getLanguage
We haven't had these reported in over 90 days. I think we can
promote this to a runtime exception now.

Change-Id: I8c42c68e319df22cec44ef92328b7f0cae6168eb
2020-07-28 23:02:05 +00:00
Timo Tijhof
35d62b19e2 context: Remove duplicate log message from RequestContext::getLanguage()
> A long, long time ago,
> I can still remember how those warnings used to make me smile.
> And, I knew if I had my chance, that I could make those traces dance,
> and... Maybe they'd be present for a while.

Ever since T45086, we have traces for warnings in production
so this is no longer needed. Also it uses getTraceAsString()
which is something we're trying to phase out.

Bug: T233342
Change-Id: I79ce582c7f057b22a9ead2f2b014aba41f869325
2020-07-23 22:10:54 +00:00
daniel
128565505c Mark additional classes as newable for now.
The following glasses are marked as newable per the
Stable Interface Policy, even though logically, they should not be
newable. This is done for classes that are currently instantiated
by extensions, and lack an alternative.

A better way for obtaining an instance of these classes should be
created in the future. At that point, direct instantiation should
be deprecated and replaced.

- includes/ApiMain.php - needs factory
- includes/media/BitmapMetadataHandler.php - should become a stateless service or use handler pattern
- includes/GitInfo.php - should become a stateless service
- includes/logging/LogPage.php - should become a stateless service or use command pattern
- includes/logging/ManualLogEntry.php - should become a stateless service or use command pattern
- includes/poolcounter/PoolCounterWorkViaCallback.php - needs a factory
- includes/context/RequestContext.php - needs to be narrowed down, and should use a factory
- includes/search/SearchHighlighter.php - should have a factory
- includes/TitleArrayFromResult.php - should perhaps be part of TitleFactory
- includes/user/User.php - should at least get a factory method for anons
- includes/diff/Diff.php: needs a TextDiffGenerator service or a factory
- includes/EditPage.php: needs a factory

Bug: T247862
Change-Id: I033158e693c98630ee167d9528fc8c9936f978d4
2020-07-08 18:06:12 +02:00
Tim Starling
47a1619027 Remove terminating line breaks from debug messages
A terminating line break has not been required in wfDebug() since 2014,
however no migration was done. Some of these line breaks found their way
into LoggerInterface::debug() calls, where they mess up the formatting
of the debug log.

So, remove terminating line breaks from wfDebug() and
LoggerInterface::debug() calls.

Also:
* Fix the stripping of leading line breaks from the log header emitted
  by Setup.php. This feature, accidentally broken in 2014, allows
  requests to be distinguished in the log file.
* Avoid using the global variable $self.
* Move the logging of the client IP back to Setup.php. It was moved to
  WebRequest in the hopes that it would not always be needed, however
  $wgRequest->getIP() is now called unconditionally a few lines up in
  Setup.php. This means that it is put in its proper place after the
  "start request" message.
* Wrap the log header code in a closure so that variables like $name do
  not leak into global scope.
* In Linker.php, remove a few instances of an unnecessary second
  parameter to wfDebug().

Change-Id: I96651d3044a95b9d210b51cb8368edc76bebbb9e
2020-06-03 12:01:16 +10:00
Tim Starling
68c433bd23 Hooks::run() call site migration
Migrate all callers of Hooks::run() to use the new
HookContainer/HookRunner system.

General principles:
* Use DI if it is already used. We're not changing the way state is
  managed in this patch.
* HookContainer is always injected, not HookRunner. HookContainer
  is a service, it's a more generic interface, it is the only
  thing that provides isRegistered() which is needed in some cases,
  and a HookRunner can be efficiently constructed from it
  (confirmed by benchmark). Because HookContainer is needed
  for object construction, it is also needed by all factories.
* "Ask your friendly local base class". Big hierarchies like
  SpecialPage and ApiBase have getHookContainer() and getHookRunner()
  methods in the base class, and classes that extend that base class
  are not expected to know or care where the base class gets its
  HookContainer from.
* ProtectedHookAccessorTrait provides protected getHookContainer() and
  getHookRunner() methods, getting them from the global service
  container. The point of this is to ease migration to DI by ensuring
  that call sites ask their local friendly base class rather than
  getting a HookRunner from the service container directly.
* Private $this->hookRunner. In some smaller classes where accessor
  methods did not seem warranted, there is a private HookRunner property
  which is accessed directly. Very rarely (two cases), there is a
  protected property, for consistency with code that conventionally
  assumes protected=private, but in cases where the class might actually
  be overridden, a protected accessor is preferred over a protected
  property.
* The last resort: Hooks::runner(). Mostly for static, file-scope and
  global code. In a few cases it was used for objects with broken
  construction schemes, out of horror or laziness.

Constructors with new required arguments:
* AuthManager
* BadFileLookup
* BlockManager
* ClassicInterwikiLookup
* ContentHandlerFactory
* ContentSecurityPolicy
* DefaultOptionsManager
* DerivedPageDataUpdater
* FullSearchResultWidget
* HtmlCacheUpdater
* LanguageFactory
* LanguageNameUtils
* LinkRenderer
* LinkRendererFactory
* LocalisationCache
* MagicWordFactory
* MessageCache
* NamespaceInfo
* PageEditStash
* PageHandlerFactory
* PageUpdater
* ParserFactory
* PermissionManager
* RevisionStore
* RevisionStoreFactory
* SearchEngineConfig
* SearchEngineFactory
* SearchFormWidget
* SearchNearMatcher
* SessionBackend
* SpecialPageFactory
* UserNameUtils
* UserOptionsManager
* WatchedItemQueryService
* WatchedItemStore

Constructors with new optional arguments:
* DefaultPreferencesFactory
* Language
* LinkHolderArray
* MovePage
* Parser
* ParserCache
* PasswordReset
* Router

setHookContainer() now required after construction:
* AuthenticationProvider
* ResourceLoaderModule
* SearchEngine

Change-Id: Id442b0dbe43aba84bd5cf801d86dedc768b082c7
2020-05-30 14:23:28 +00:00
Petr Pchelko
204fa7e509 Remove usages of deprecated Language methods
Change-Id: Iad3375b141b1d87c890baec6ecd16ed92f93e699
2020-02-16 00:45:48 +00:00
James D. Forrester
4f2d1efdda Coding style: Auto-fix MediaWiki.Classes.UnsortedUseStatements.UnsortedUse
Change-Id: I94a0ae83c65e8ee419bbd1ae1e86ab21ed4d8210
2020-01-10 09:32:25 -08:00
jenkins-bot
b874e6ab98 Merge "Provide a full trace to GlobalTitleFail debug entries" 2020-01-06 19:24:24 +00:00
Kunal Mehta
99007e96c7 Use namespaced IPUtils class
Change-Id: I047e099a93203a59093946d336a143d899d0271f
2020-01-01 02:36:49 -08:00
Daimona Eaytoy
f16d87a8cc Provide a full trace to GlobalTitleFail debug entries
None of these is currently useful: see for instance [1]. Having a whole
trace can help a lot in finding where the faulty call is. Also avoid the
overhead of calling wfDebugLog.

[1] - https://logstash.wikimedia.org/app/kibana#/doc/logstash-*/logstash-mediawiki-2019.12.19/mediawiki?id=AW8gPL5bKWrIH1QRtQa3&_g=h@1251ff0

Bug: T159284
Change-Id: I25e0f0e2ef4899b4eaa644c74fdeaba21d79aefe
2019-12-20 14:12:59 +01:00
jenkins-bot
393909537e Merge "RequestContext: Clarify uselang support and how it works" 2019-11-01 03:08:19 +00:00
Timo Tijhof
c26ba1f162 RequestContext: Clarify uselang support and how it works
Follows-up to cad882954a. I considered augmenting
the sanitizeLangCode() or isValidCode() function to reject
invalid UTF-8. But I realise now that it isn't so much about
"invalid" UTF-8 as it is about non-canonical forms for expressing
otherwise valid UTF-8 strings.

For example "Le\xcc\x81cole" and "L\xc3\xa9cole" both render
as "Lécole" but use different ways to accomplish it. To prevent
creation of inaccessible page titles, and to make link creation
easy, UtfNormal is used to normalises these when opening redlink
urls and when saving wikitext.

While non-ASCII will continue to work after cad882954a, any
links to such characters must be made in normal form. Given
these are generally linked to from wiki pages or gadgets with
a predefined set of urls (and not typed ad-hoc by an end user)
this seems fine to require. I fid not find violations of this
on Commons.

Document the ceveat for now.

Change-Id: I36fece34e40f7e58b7aed5521c49a241a67d006f
2019-10-31 19:57:03 -07:00
Aryeh Gregor
0de9c47b50 Remove Language::factory and getParentLanguage use
Change-Id: I11f8801ef47ec1a1f63d840116e69667e6f3ae3c
2019-10-27 12:34:28 +02:00
Umherirrender
8752df6592 Use varargs for MessageLocalizer::msg and similar
Bug: T191666
Change-Id: I59f2ae1a96af392026fc106e57d23553003c16b8
2019-10-05 17:47:49 +00:00
Daimona Eaytoy
b65af759f1 RequestContext: Declare the dynamic property for language recursion
Change-Id: I601f98190cb8f760541ba1f05a3070fc43c25ccb
2019-09-08 18:32:05 +00:00
Daimona Eaytoy
5eac6d131c Unsuppress more phan issues (part 3)
Bug: T231636
Depends-On: I78354bf5f0c831108c8f606e50c87cf6bc00d8bd
Change-Id: I58e67c2b38389df874438deada4239510d21654f
2019-08-31 16:38:55 +00:00
jenkins-bot
66ac8dbd43 Merge "context: Use getRawVal instead of getVal for 'uselang' and 'useskin'" 2019-07-31 23:07:22 +00:00
Timo Tijhof
2058d79330 context: Make the getSkin() fallback logic more explicit
Previously the first two post-hook checks where mutually exclusive
and the fallback was generic (not conditional) which means we
would also allow the first two conditions to succeed in a way that
leaves $this->skin as null.

Aside from that not being possible right now, it also duplicates a
null check in two places, which isn't ideal.

Codify that the first two blocks always result in $this->skin
being assigned non-null by using an 'else' branch instead of another
generic check.

Change-Id: I7986684bf1bb2daad3aaddfbcd2ca02e652f78c2
2019-07-29 23:42:23 +00:00
Timo Tijhof
cad882954a context: Use getRawVal instead of getVal for 'uselang' and 'useskin'
Bug: T189966
Change-Id: I9db7b3f36f5457e80aa9b673bcb56deb83e47a18
2019-07-30 00:02:52 +01:00
Derick Alangi
c51f012739 Use AtEase::quietCall() instead of Wikimedia\quietCall()
Wikimedia\quietCall() is deprecated and AtEase is here for use.
I would have loved to do restoreWarnings() and suppressWarnings()
in this same patch set but will continue the work for a later patch.

Bug: T182273
Change-Id: I43e3a5f378c99b5c40883b35ba133cbd126fc433
2019-06-10 14:18:19 +00:00
Derick Alangi
3086799014 context: Replace deprecated use of SkinFactory::getDefaultInstance()
Replace with MediaWikiServices::getInstance()->getSkinFactory()

Change-Id: I2cf7afad249e52e13a56fbe92b1665dfebec793f
2019-04-15 20:21:21 +01:00
Lucas Werkmeister
46f79f8eb3 Use finally instead of try-catch-throw
When this exception handler was introduced in change Ifbc1db4b82 (commit
9636d44448), MediaWiki still supported PHP 5.3.2, where finally was not
available. It was added in PHP 5.5, though, which we’ve required for a
while now, so we can simplify this a bit.

Change-Id: I7c967fb713de7495739e18ff6c6058a630129fda
2019-03-26 14:13:51 +01:00
Derick Alangi
34f78a69ef specialpage: Fix login crash caused by unknown language via ?uselang
Per Krinkle's comments here: T198054#4598447, it's exactly what is
happening. @Fomafix suggests we handle the exception that is been
thrown by Language::factory() when there is an invalid language code
provided. The attempt is to fix this in the central way of ever request
whether POST or GET.

We're working within a particular context, and within this request
context, we can create a language user's language object then generate
a language object. If uselang parameter is provided an invalid language
code, getLanguage in this request context will default to $wgLanguageCode
then use this code to create the user's language object. In addition,
getLanguage() invalidates cached user interface language.

Bug: T198054
Change-Id: I825fdfa882a4243ffc63c9de0d7f482e2cfb9862
2019-01-29 16:16:02 +00:00
Aryeh Gregor
90d4f56fe4 Mass conversion of $wgContLang to service
Brought to you by vim macros.

Bug: T200246
Change-Id: I79e919f4553e3bd3eb714073fed7a43051b4fb2a
2018-08-11 22:44:29 -06:00
Max Semenik
8085c58a4b Replace call_user_func_array(), part 1
Uses new PHP 5.6 syntax like ...parameter unpacking and
calling anything looking like a callback to make the code more readable.
There are much more occurrences but this commit is intentionally limited
to an easily reviewable size.

Change-Id: Idcec077ef3fdf029b632cceafd0150851ad723e3
2018-06-04 23:39:04 -07:00
Reedy
fbc0347466 Update MediaWiki\quietCall() -> Wikimedia\quietCall()
Bug: T182273
Change-Id: Id7d8e176fcd93040e30e46cb64fc6a3d36bc8230
2018-02-10 10:49:33 +00:00
Thiemo Mättig
4d9de6140e Improve 1-letter variable names in MutableContext and implementations
I'm also removing obsolete short comments that don't add anything to
whats already obvious from the method header. For example, I really don't
need a comment to understand that a method that's called "setUser" and
accepts a parameter named "$user" of type "User" is meant to "set the
User object". I mean, how more obvious can it be? ;-)

Change-Id: Ib079108457a5aa2a6896e95837542ab93b465144
2018-01-07 15:53:55 +01:00
jenkins-bot
58f37bd13c Merge "Remove self-explaining "section heading" comments from classes" 2017-12-30 21:25:15 +00:00
Thiemo Mättig
fa15c98787 Improve (weak and strict) type hints invarious places
Change-Id: I3a42ec1547fae971d7b495c99dd144739d8521ab
2017-12-28 16:31:56 +01:00
Thiemo Mättig
544122a6c2 Remove self-explaining "section heading" comments from classes
I can see that "parent::__construct" literally calls the parent
constructor. I can see that stuff preceeded by the keyword "protected"
is protected. I really (really) don't need comments explaining such.

Change-Id: I7458e714976a6acd3ba6a7c93fdc27d03903df83
2017-12-28 16:12:08 +01:00
Niklas Laxström
a6c9c21983 Remove unuseful debug messages
I spotted one of these in my debug log. Without context it is not
useful nor informative. Given it can actually come from three places,
it is useless.

Change-Id: Ic293d8944e9a1a8152c5a5e0b695c5ddc07ee6aa
2017-12-04 10:40:05 +00:00
Umherirrender
bd741b83bc build: Updating mediawiki/mediawiki-codesniffer to 13.0.0
Change-Id: Ia24dbf015f2b4781683ca980a460d0ac3e85674e
2017-09-25 17:31:56 +02:00
Umherirrender
ace44e2064 Use correct variable name in @param documentation
For some varargs a variable name is added with suffix ,... as seen for
many other varargs

Some @param are swapped, because there are in the wrong order

Enable Sniff MediaWiki.Commenting.FunctionComment.ParamNameNoMatch

Change-Id: I60fec6025bce824d5c67563ab7b65ad6cd628ad8
2017-08-11 19:27:19 +02:00
Timo Tijhof
01938ae7db statsd: Rename MediawikiStatsdDataFactory to IBufferingStatsdDataFactory
Follows-up I2874175647e (7fdc3d09a3).

* Avoid "MediaWiki" in class names. If unavoidable, always camelcase.
* Use a more descriptive name, matching the implementing the class ("Buffering").
* Use "I" prefix for consistency with other MediaWiki-provided interfaces.
  (Avoid "Interface" suffix, which is foreign to MediaWiki and is only used
  in the StatsdClient namespace, which this interface is not in).

Bug: T166354
Change-Id: I06de59122625f9c23e7c1a1bfa69a7ddabbf379e
2017-07-07 17:22:50 -07:00
Amir Sarabadani
d062560f24 Require $key in msg() functions
Note: calling msg() with no parameter was never supported,
doing this on a RequestContext for example would result in:
PHP Warning:  Missing argument 1 for wfMessage() ...followed
by a bunch of fallout.

So this patch only formally declares what was already a
requirement in reality.

Change-Id: I1864afb8bcc641698689828914949a06506d8f3a
2017-06-14 13:26:27 +04:30
Stanislav Malyshev
7fdc3d09a3 Refactor Statsd classes to enable null collector to work.
The following changes are added:
- Created MediawikiStatsdDataFactory interface
- Added hasData() method to see if there are any data to send
- Added getData() method to fetch data
- Made service infrastructure use MediawikiStatsdDataFactory interface
- Made wfLogProfilingData() use MediawikiStatsdDataFactory interface
- Added capability to enable/disable buffering collector

Bug: T166354
Change-Id: I2874175647e987996a9a399829b3319674471aaa
2017-05-29 15:33:02 -07:00
James D. Forrester
9635dda73a includes: Replace implicit Bugzilla bug numbers with Phab ones
It's unreasonable to expect newbies to know that "bug 12345" means "Task T14345"
except where it doesn't, so let's just standardise on the real numbers.

Change-Id: I6f59febaf8fc96e80f8cfc11f4356283f461142a
2017-02-21 18:13:24 +00:00
addshore
b12086b618 Get ConfigFactory & MainConfig from MediaWikiServices
Change-Id: Iafdd7e00747060572463ffb05aae4543f3a06163
2016-11-23 00:12:38 +00:00
Kunal Mehta
61adc1e146 Use namespaced ScopedCallback
The un-namespaced \ScopedCallback is deprecated.

Change-Id: Ie014d5a775ead66335a24acac9d339915884d1a4
2016-10-17 15:46:05 -07:00