Commit graph

170 commits

Author SHA1 Message Date
Roan Kattouw
f174bb0ad0 Reverse a bad decision in r93820, which added a comment to WebRequest::getFullRequestURL() saying it would return protocol-relative URLs if $wgServer is protocol-relative. This behavior makes no sense, though, and most callers expect fully qualified URLs. So make it return a fully qualified URL and update the one caller that expected the return value would be compatible with getFullURL() 2011-08-19 13:25:43 +00:00
Alexandre Emsenhuber
77a3987052 Moved wfGetIP() to WebRequest::getIP():
* Changed all calls in core to the latter
* Also marked wfGetForwardedFor() as deprecated
* Moved wfGetIP() tests to WebRequestTest
2011-08-18 20:03:30 +00:00
Sam Reed
53851419a1 Upstreaming wikia change to WebRequest
Trim trailing whitespace

Tweak documentation
2011-08-18 00:54:06 +00:00
Daniel Friesen
0139030f2b Improve the ability for extensions to participate in how MediaWiki handles url paths:
- Allow extensions to hook into WebRequest::getPathInfo and add to or alter the way titles are extracted from paths
- Add a $variant argument to the GetLocalURL hook; It's always had $query, but never had $variant. As a result extensions using GetLocalURL never new if getLocalURL and have the possibility of trying to change the url in cases where they shouldn't and as a result breaking links on wiki with language variants.
- Add GetLocalURL::Internal hook for non-interwiki links. These kinds of links internally use a ugly hack for action=render and an extension using GetLocalURL can be buggy in render mode if they don't re-implement the same ugly hack that MW does. This ::Internal hook runs before the hack does so extension authors don't need to be exposed to our ugly hacky code.
- Add GetLocalURL::Article hook specifically for url tweaks to pretty urls (ie: Only when we would apply $wgArticlePath); This hook avoids the need for extensions that only want to tweak pretty url output. This hook avoids the need to make a bunch of tests for things like !$title->isExternal(), $query == '', and $variant === false which getLocalURL does and could potentially change in the future making wider GetLocalURL hooks change in function requiring extension updates.
2011-08-12 19:23:43 +00:00
Roan Kattouw
6adb2e86a5 Some random URL protocol forcing for protocol-relative URLs 2011-08-03 12:58:21 +00:00
Roan Kattouw
e2b9cc8899 (bug NNNNN) Rewrite most of wfExpandUrl() to handle protocol-relative URLs properly and more flexibly
* Fix a bug in rNNNNN where URLs like '/wiki/Foo' weren't expanded completely if $wgServer was protocol-relative. This caused bug NNNNN.
* Add an optional second parameter to wfExpandUrl(), which takes one the PROT_* constants. This allows the caller to determine which protocol should be used if the given URL is protocol-relative, or the given URL is domain-relative but $wgServer is protocol-relative. The options are PROT_HTTP (use http), PROT_HTTPS (use https), PROT_RELATIVE (keep the URL as protocol-relative), and PROT_CURRENT (use http if the current request is http, or https if the current request is https; this is the default).
* Factor the protocol/port detection part of WebRequest::detectServer() out into detectProtocolAndStdPort(), and add detectProtocol() as a wrapper. The latter is used by wfExpandUrl() in PROT_CURRENT mode.
* Rewrite the test suite to test all possible combinations of $wgServer, $defaultProto, $url and HTTP/HTTPS mode. This means the test suite now has 120 test cases rather than 4.
2011-07-27 08:21:40 +00:00
Aaron Schulz
b1193eec5f * Broke long Wiki.php lines
* Added getValueNames() function to WebRequest.php
2011-07-13 18:05:44 +00:00
Sam Reed
6102b8fab8 More return documentation and trimming trailing whitespace 2011-06-30 02:59:43 +00:00
Brion Vibber
f569ab1005 Tweak doc comments on WebRequest::getRequestURL() & WebRequest::getFullRequestURL() per in-person discussion with preilly; the docs were unclear as to whether the query string is included (it is). 2011-06-29 23:35:05 +00:00
Sam Reed
8bfd19b451 Swap else if for elseif
Trimming trailing whitespace also

Doing in 3 commits (3/3), so hopefully reviewable in CR...
2011-06-17 16:05:35 +00:00
Tim Starling
b4311ca022 Fixes for r90105, r90193:
* Actually removed $wgProto.
* Per Aryeh's suggestions on the future of $wgServer: made $wgServer detection in DefaultSettings.php more permanent by merging it with the new code from r90105. This means that bug 14977 is properly fixed now. 
* Require entry points to set up the autoloader before including DefaultSettings.php. Comments on bug 14977 indicate that at some point in the past, this may have broken something. Anything that breaks now should just be fixed, we need the autoloader. Tested the most common entry points.
* Since the detection code has moved from Installer to WebRequest, I also moved the relevant test file and updated the test. The function under test is now public static, so r90154 is superseded.
2011-06-16 05:52:16 +00:00
Tim Starling
d9c41a6819 Fixed typo in comment. 2011-06-10 11:32:28 +00:00
Tim Starling
f3f1fcdc2c * Added a REQUEST_URI check to the bug 28235 handling.
* Moved most of the bug 28235 code out to a separate library class, since I was running out of distinct function names. 
* Merged the QUERY_STRING and PATH_INFO security checks, since they are dealing with the exact same problem. Removed WebRequest::isQueryStringBad(). 
* Deal with img_auth.php by having it specify what extension it expects to be streaming out. This extension can then be compared with the extension that IE might detect.
2011-06-06 11:59:20 +00:00
Platonides
923f44359b Follow up r60599. Make normalizeUnicode() work even if $wgContLang is still not set,
just as it did before (eg. getGPCVal() check). This allows for early calls before
MediaWiki is completely initialised.
2011-06-04 21:19:07 +00:00
Tim Starling
97ff30ddb4 (bug 28840) If the query string hits bug 28235, redirect to a safer URL instead of showing an unhelpful error message. IE 6 will only use the extension of the final destination for its cache filename. 2011-06-03 05:32:51 +00:00
Platonides
641f485965 Document r89248,r89249 isQueryStringBad() 2011-06-01 21:22:53 +00:00
Tim Starling
fcdb441ff8 Fix for r89248: don't run the regex if findIE6Extension returns false. Only affects performance, the logic is the same. 2011-06-01 02:05:18 +00:00
Tim Starling
a9b9efecb4 * Only blacklist query string extensions which match /^[a-zA-Z0-9_-]+$/. This avoids blacklisting pretty much every api.php URL with a dot in it, due to extensions like "webm&smaxage=3600&maxage=3600&format=jsonfm" being detected. Such an extension is unlikely to be registered to a dangerous file type. The proposed regex matches all extensions registered in HKEY_CLASSES_ROOT on my Windows XP VM, but does not include the ampersand, so avoids matching multiple URL parameters.
* Fixed a logic error in WebRequest::isPathInfoBad() from r88883, which caused dangerous PATH_INFO strings to be allowed as long as QUERY_STRING was set.
* Refactored the query string checks in WebRequest and img_auth.php into a single new function: isQueryStringBad().
2011-06-01 02:01:59 +00:00
Tim Starling
529e92b283 Fixes for r88883, r89197:
* Modified WebRequest::findIE6Extension() to fix the performance issue and the hash parsing issue I noted on CR 
* In FindIE6ExtensionTest, fixed all the assertEquals() calls, I had the expected and actual around the wrong way
* Added a couple of extra tests for cases that seemed important during the rewrite.
2011-06-01 00:51:09 +00:00
Roan Kattouw
8dab43f703 (bug 28840) URLs with dots break because of IE6 security check
* Replace the overly paranoid regex with a function that simulates IE6's behavior
* Remove the UA check in isPathInfoBad(), was causing more problems than it was worth
* Revert r87711, going back to using dots for dots in ResourceLoader URLs, instead of exclamation marks
* Append &* to ResourceLoader URLs. * is an illegal character in extensions, and putting it at the end of the URL ensures that both IE6 and our detection function will deem the URL to have no extension (unless something like .html? appears in the query string, but in that case we're screwed no matter what)
2011-05-26 09:49:45 +00:00
Siebrand Mazeland
75c6696aa8 Use consistent notation for "@todo FIXME". Should update http://svn.wikimedia.org/doc/todo.html nicely. 2011-05-17 22:03:20 +00:00
Sam Reed
f985524076 More versions added to @deprecated tags
Couple of inbound calls fixed up

Some ancient code removed as it's been marked deprecated
2011-05-06 21:50:18 +00:00
Tim Starling
1db9197660 * Fix for bug 28534: IE 6 content type detection again
* Fix for bug 28639: user object instance cache pollution
* Release notes formatting tweak.
2011-05-05 05:29:50 +00:00
Alexandre Emsenhuber
4207ab0c63 * (bug 28511) Use [] syntax instead of {} for string offset access 2011-04-17 07:59:58 +00:00
Niklas Laxström
6d43e71d2a Fix regression introduced in r82451. Only happens when getAllHeaders was not called before LanguageSelector hook was executed, not sure in which conditions this happens or not. 2011-04-14 11:58:52 +00:00
Tim Starling
7aeb423a6e (bug 28507) Fix for r85844: that revision was not actually sufficient to fix bug 28235, since URLs can have more than one question mark in them. 2011-04-14 07:10:59 +00:00
Tim Starling
ccb27f0b59 Check all MSIE requests since we also want to protect IE 3-5 etc. 2011-04-12 01:26:17 +00:00
Tim Starling
3ef857fe4d Fix for bug 28235: IE6 looks for the file extension in the query string 2011-04-12 00:55:10 +00:00
Alexandre Emsenhuber
60f1302644 Per Platonides, fix for r82686: make ApiUploadTest work again
Added option request parameter to User::editToken() and User::matchEditToken() and use them where possible from the api.
Also removed $_SESSION usage since it's no longer needed
2011-03-02 12:52:47 +00:00
Alexandre Emsenhuber
7a62c8d542 Factorise common code:
* Made appendQuery() use appendQueryArray() by using wfCgiToArray()
* Introduced getQueryValues() to get values passed in the query string; FauxRequest will return an empty array when faking a POST request
2011-02-23 20:23:35 +00:00
Alexandre Emsenhuber
8e7741c77d Merged retrieval of request URL and header from WebRequest and Setup.php to avoid duplicate code and reduced the number of wfDebug() calls in Setup.php.
The only side effect is that headers name are in uppercase in the debug log.
2011-02-19 13:09:17 +00:00
Mark A. Hershberger
0677934401 * recover dropped check of $wgUsePathInfo from r81363
* document getPathInfo
2011-02-02 15:44:37 +00:00
Sam Reed
49b6b1cc61 Followup r81373, r81363
PHP Notice:  Undefined variable: matches in /home/ci/cruisecontrol-bin-2.8.3/projects/mw/source/includes/WebRequest.php on line 109

Explicitally define $matches at top of function, allowing it to always be defined for all paths
2011-02-02 13:02:45 +00:00
Mark A. Hershberger
72dd2cf8c6 follow up r81363 and fix Bug#27099 2011-02-02 03:14:37 +00:00
Mark A. Hershberger
9de57fff82 * Remove last bit of code that uses PATH_INFO from img_auth.php so that people who want to use protected images on hosts with sadly mis-shapen PHPs (e.g. GoDaddy) can.
* Mangle PATH_INFO handler in WebRequest so that all the relevant bits are in a (couple of) static functions.
2011-02-02 01:08:15 +00:00
Mark A. Hershberger
a2ec67cfb5 Whitespace cleanup 2011-02-01 23:08:10 +00:00
Sam Reed
4ee5d368db Followup r72119, add some braces
Document $db in parserTest
2011-01-07 00:55:09 +00:00
Ilmari Karonen
fec364732f followup r78209: fix typo, better word choice 2010-12-10 22:42:46 +00:00
Ilmari Karonen
75086e9f35 (bug 16019) Make WebRequest::interpolateTitle() do nothing when run from api.php 2010-12-10 22:39:17 +00:00
Chad Horohoe
f3054e5787 Drop silly $_ prefix from 4.x days 2010-11-05 12:59:37 +00:00
Chad Horohoe
0f149cf548 Document return type. Autosuggestion and the like :) 2010-11-05 12:54:58 +00:00
Trevor Parscal
dc723fc710 * Improved on r73567, this makes WebRequest::getFuzzyBool case insensitive, making 'false', 'FALSE', 'FaLsE', etc to be boolean false
* Fixed syntax error in Skin.php
2010-09-27 15:59:58 +00:00
Chad Horohoe
e4189f5920 Fix a bunch of '? true : false' instances 2010-09-27 14:24:13 +00:00
Trevor Parscal
6de8690746 * Added WebRequest::getFuzzyBool, which is a more JavaScript friendly version of getBool. Essentailly the same thing, except the string 'false' is also considered boolean false.
* Made use of getFuzzyBool where otherwise awkward and sometimes varied versions of 'flase' === false detection were being used.
2010-09-22 20:15:31 +00:00
Sam Reed
ecf56c33fa Braces and spaces 2010-09-04 03:43:33 +00:00
Mark A. Hershberger
3751511ff0 fill out appendQuery() for FauxRequest — probably should be refactored
into the parent class, but the parent uses $_GET where we have $this->data
2010-09-01 16:58:44 +00:00
Ryan Kaldari
aaa70d34ac Fixing comment so that method documentation isn't broken 2010-08-31 00:33:14 +00:00
Alexandre Emsenhuber
7b79d94515 * Standardised file description headers
* Added some descriptions
* Added @file where needed
2010-08-14 17:42:40 +00:00
Chad Horohoe
aa7b63ce83 Cleanup getCookie() and use it all over the place instead of using $_COOKIE directly 2010-08-06 15:00:43 +00:00
Platonides
4467d11a46 Follow up r70356.
Improve WebRequest getAcceptLang(): Add support for q=0 language and the special range "*", always return the language codes in lowercase.
2010-08-03 13:23:31 +00:00