Commit graph

29 commits

Author SHA1 Message Date
Umherirrender
3124a990a2 Use ::class to resolve class names in includes files
This helps to find renamed or misspelled classes earlier.
Phan will check the class names

Change-Id: I07a925c2a9404b0865e8a8703864ded9d14aa769
2018-01-27 20:34:29 +01:00
Umherirrender
c9d303d39e Remove "Created on" from file header comments
It is the job of git and svn to provide this information/metadata.
The form was different, some with short, some with long month name
some with leading zero at the day, some without.
The year is also present in the Copyright clause

Change-Id: If006907b82b9e45f13cfa2e45d41107a95570e1a
2018-01-26 23:12:40 +00:00
Brad Jorsch
4e6810e4a2 API: i18n for warnings and errors
API warnings and error messages are currently hard-coded English
strings. This patch changes that.

With a few exceptions, this patch should be compatible with non-updated
extensions:
* The change to ApiBase::$messageMap will blow up anything trying to
  mess with it.
* The changes to the 'ApiCheckCanExecute' hook will cause a wrong
  (probably unparsed) error message to be emitted for extensions not
  already using an ApiMessage. Unless they're currently broken like
  Wikibase.

Bug: T37074
Bug: T47843
Depends-On: Ia2b66b57cd4eaddc30b3ffdd7b97d6ca3e02d898
Depends-On: I2e1bb975bb0045476c03ebe6cdec00259bae22ec
Depends-On: I53987bf87c48f6c00deec17a8e957d24fcc3eaa6
Depends-On: Ibf93a459eb62d30f7c70d20e91ec9faeb80d10ed
Depends-On: I3cf889811f44a15935e454dd42f081164d4a098c
Depends-On: Ieae527de86735ddcba34724730e8730fb277b99b
Depends-On: I535344c29d51521147c2a26c341dae38cec3e931
Change-Id: Iae0e2ce3bd42dd4776a9779664086119ac188412
2016-12-06 10:20:48 -05:00
Siebrand Mazeland
bc0ae710e3 Use single quotes in API where possible
Change-Id: I972e296f4820f78f5dfcecc27bc4912ca84a3178
2016-03-08 17:27:00 +01:00
Kunal Mehta
6e9b4f0e9c Convert all array() syntax to []
Per wikitech-l consensus:
 https://lists.wikimedia.org/pipermail/wikitech-l/2016-February/084821.html

Notes:
* Disabled CallTimePassByReference due to false positives (T127163)

Change-Id: I2c8ce713ce6600a0bb7bf67537c87044c7a45c4b
2016-02-17 01:33:00 -08:00
Brad Jorsch
2257fe4228 Revert "Remove SessionManager, temporarily"
This reverts commit 823db5d63dd5200d04c63da50ba6bf16f928e70b.

Change-Id: Ibb3e023e4eb6715295586dea87d0725c344a8271
2016-02-03 21:44:59 +00:00
Brad Jorsch
5083e810eb Remove SessionManager, temporarily
The plan here is to take it out of 1.27.0-wmf.12 and put it back in
1.27.0-wmf.13.

Since BotPasswords depends on SessionManager, that's getting temporarily
removed too.

This reverts the following commits:
* 6acd424e0d SessionManager: Notify AuthPlugin before calling hooks
* 4d1ad32d8a Close a loophole in CookieSessionProvider
* fcdd643a46 SessionManager: Don't save non-persisted sessions to backend storage
* 058aec4c76 MessageCache: Don't get a ParserOptions for $wgUser before the end of Setup.php
* b5c0c03bb7 SessionManager: Save user name to metadata even if the user doesn't exist locally
* 13f2f09a19 SECURITY: Fix User::setToken() call on User::newSystemUser
* 305bc75b27 SessionManager: Don't generate user tokens when checking the tokens
* 7c4bd85d21 RequestContext::exportSession() should only export persisted session IDs
* 296ccfd4a9 SessionManager: Save 'persisted' flag in session metadata
* 94ba53f677 Move CSRF token handling into MediaWiki\Session\Session
* 46a565d6b0 Avoid false "added in both Session and $_SESSION" when value is null
* c00d0b5d94 Log backtrace for "User::loadFromSession called before the end of Setup.php"
* 4eeff5b559 Use $wgSecureCookie to decide whether to actually mark secure cookies as 'secure'
* 7491b52f70 Call session_cache_limiter() before starting a session
* 2c34aeea72 SessionManager: Abstract forceHTTPS cookie setting
* 9aa53627a5 Ignore auth cookies with value 'deleted'
* 43f904b51a SessionManager: Kill getPersistedSessionId()
* 50c5256352 SessionManager: Add SessionBackend::setProviderMetadata()
* f640d40315 SessionManager: Notify AuthPlugin when auto-creating accounts
* 70b05d1ac1 Add checks of $wgEnableBotPasswords in more places
* bfed32eb78 Do not raise a PHP warning when session write fails
* 722a7331ad Only check LoggedOut timestamp on the user loaded from session
* 4f5057b84b SessionManager: Change behavior of getSessionById()
* 66e82e614e Fix typo in [[MediaWiki:Botpasswords-editexisting/en]]
* f9fd9516d9 Add "bot passwords"
* d7716f1df0 Add missing argument for wfDebugLog
* a73c5b7395 Add SessionManager

Change-Id: I2389a8133e25ab929e9f27f41fa9a05df8147a50
2016-02-01 22:06:49 +00:00
Brad Jorsch
94ba53f677 Move CSRF token handling into MediaWiki\Session\Session
User keeps most of its token-related methods because anon edit tokens
are special. Login and createaccount tokens are completely moved.

Change-Id: I524218fab7e2d78fd24482ad364428e98dc48bdf
2016-01-27 15:27:20 -05:00
Brad Jorsch
42e9a65309 API: Forwards-compatibility for ApiTokens
To make it easier for stuff to transition, allow action=tokens to return
the new types that action=query&meta=tokens supports.

Change-Id: I83887e555d54978b392933b4a3f6dada7ed00793
2015-11-04 15:31:19 -05:00
Brad Jorsch
beab6b009e Change API result data structure to be cleaner in new formats
Nothing in this patch should result in changed output for format=json or
format=php except as noted in RELEASE-NOTES-1.25, and changed output for
format=xml should be similar or cosmetic. However, other code accessing
the result data directly may need to be updated.

Bug: T87053
Bug: T12887
Change-Id: I3500708965cb8869b5aed1543381aad208dadd13
2015-04-20 17:49:37 -04:00
Ricordisamoa
693ec8b76a New convenience method ApiBase::lacksSameOriginSecurity()
For consistent handling of API requests with the 'callback' argument.

Change-Id: Ic6e3483f5e8819498c693650a11728efc1bafcc0
2015-02-27 09:48:37 -05:00
Chad Horohoe
aa21e125a3 Remove obvious function-level profiling
Xhprof generates this data now. Custom profiling of various
sub-function units are kept.

Calls to profiler represented about 3% of page execution
time on Special:BlankPage (1.5% in/out); after this change
it's down to about 0.98% of page execution time.

Change-Id: Id9a1dc9d8f80bbd52e42226b724a1e1213d07af7
2015-01-07 11:14:24 -08:00
Aaron Schulz
e369f66d00 Replace wfRunHooks calls with direct Hooks::run calls
* This avoids the overhead of an extra function call

Change-Id: I8ee996f237fd111873ab51965bded3d91e61e4dd
2014-12-10 12:26:59 -08:00
Brad Jorsch
ad225f501c API: Internationalize all remaining core API modules
This also adds some new ApiBase::PARAM_* constants to generate more
helpful help, and a method to override the default description message
for the use of ApiDisabled and ApiQueryDisabled.

Bug: 71638
Change-Id: Ic0c3d232e0498d58a043037e2e0c6f0b1c3edad3
2014-10-20 16:56:35 -04:00
jenkins-bot
2e65d68c73 Merge "API: HTMLize and internationalize the help, add Special:ApiHelp" 2014-10-13 22:19:47 +00:00
Brad Jorsch
df457f3809 API: HTMLize and internationalize the help, add Special:ApiHelp
The existing API help, formatted as basically a plain-text document
embedded in XML and with a little bolding and a few links
syntax-highlighted in after the fact, works ok for experienced programmers
but isn't at all newbie-friendly. Further, all the help is hard-coded in
English, which isn't very friendly to non-English speakers.

So let's rewrite it. The help text is now obtained from i18n messages
and output in HTML, with the default display consisting of help for a
single module with links to help for other modules. This, of course,
necessitates deprecating many of the existing help-related methods and
hooks and replacing them with new ones, but backwards compatibility is
maintained for almost everything.

At the same time, action=paraminfo also needs to support the
'description' and other help-related fields being output in wikitext or
HTML, and I11cb063d (to access all modules via the 'modules' parameter
instead of having 'modules', 'formatmodules', 'querymodules', and so on)
is folded in.

And we also add Special:ApiHelp. When directly accessed, it simply
redirects to api.php with appropriate parameters. But it's also
transcludable to allow up-to-date API help text to be included within
the on-wiki documentation.

Note this patch doesn't actually add i18n messages for any API modules
besides ApiMain and ApiHelp. That will come in a followup patch, but for
the moment the backwards-compatibility code handles them nicely.

While we're messing with the documentation, we may as well add the
"internal" flag requested in bug 62905 (although the 'includeinternal'
parameter it also requests doesn't make much sense anymore) and a
"deprecated" flag that's needed by several modules now.

Bug: 30936
Bug: 38126
Bug: 42343
Bug: 45641
Bug: 62905
Bug: 63211
Change-Id: Ib14c00df06d85c2f6364d83b2b10ce34c7f513cc
2014-10-10 10:46:39 -04:00
Brad Jorsch
85f7b9085b API: Log usage of action=tokens
Change-Id: I5fb7d4e3c7924e61747b652a5cbc3ce0a7ccef01
2014-10-03 14:06:43 -04:00
Brad Jorsch
fdddf94570 API: Overhaul token handling
The current token handling is a mess. This simplifies things greatly:
* *All* tokens are obtained from action=query&meta=tokens, rather than
  being spread over action=tokens, action=query&prop=info,
  action=query&prop=revisions, action=query&prop=recentchanges, and
  action=query&prop=users. All these old methods are deprecated.
* Similarly, there is only one hook to register new token types. All old
  hooks are deprecated.
* All tokens are cacheable.
* Most token types are dropped in favor of a 'csrf' token. They already
  were returning the same token anyway.
* All token-using modules will document the required token type in a
  standard manner in action=help and are documented in machine-readable
  fashion in action=paraminfo.

Note this will require updates to all extensions using tokens.

Change-Id: I2793a3f2dd64a4bebb0b4d065e09af1e9f63fb89
2014-08-26 14:53:45 -04:00
Brad Jorsch
f0a6435f3b API: Remove action=paraminfo 'props' and 'errors' result properties
The format for 'props' was never specified and the list for 'errors' is
impossible to keep updated when considering that many errors come from
MediaWiki backend code and extension hook functions. And since there
doesn't seem to be any real use case for either of these, let's just
kill both of them instead of wasting effort on trying to fix them.

Note that neither getResultProperties nor getPossibleErrors are called
from any extensions in gerrit, and none of the other deprecated methods
are called outside of the implementations of those two methods. Removing
the obsolete methods is left to the maintainers of the extensions, as
keeping them hurts nothing and is needed to maintain compatibility with
earlier versions of MediaWiki.

Change-Id: Ie11a401d60c834059fbf1b5625ca8ea093b3337c
2014-08-07 16:51:19 +01:00
addshore
719d7a2f03 Add final period to API module descriptions
Change-Id: Icae68c1ab1fd0006e00a3a9a56ae8f831d3d0d45
2014-03-10 09:04:08 +00:00
Siebrand Mazeland
d1c1724ee5 The light at the end of the API code format updating tunnel
Change-Id: I12fdb71bc87a8ad5ed5b9f1fe9c06bd0f7154e9a
2013-11-14 18:29:19 +00:00
Brad Jorsch
43f3ab65cf SECURITY: Prevent tokens in jsonp mode
Add checks to token-returning functions to prevent returning tokens in
jsonp mode. This affects action=tokens, action=login,
action=createaccount, and action=query&list=deletedrevs.

Also, remove the "gettoken" parameter to action=block and
action=unblock, which has been deprecated since 1.20.

Bug: 49090
Change-Id: Ibeaa5c72d8084585092b15935a3f5709104bf7f7
2013-09-03 15:04:47 -07:00
umherirrender
c9fa62d917 cleanup action=tokens
* profile of execute function is done by the caller
* $type is always lower case, because param validation would reject all
other values
* use array syntax for callbacks
* use all token types in the result properties description

Change-Id: I7ed1d339df3f94305fbedb0052bb778efba59b7c
2013-02-14 20:33:21 +01:00
Antoine Musso
b2fba3f27f api: remove duplicate __contruct calls
For historical reasons, all our API class had a dummy __construct which
simply calls their parent constructor.  This patch removes all such
occurences to save out some bytes.

Change-Id: I667955d7821f780fc5ce23823d74dedb1729b9fa
2013-01-29 09:38:17 +01:00
Yuri Astrakhan
503cd2f4ae (bug 35885) remove api version string and parameter
API was using SVN's version keyword which GIT does not support.
All related methods were either removed, or for those that
could have been used from extensions, emptied out.
api.php?version now shows unrecognized param warning.

Change-Id: I910ca1448ed2ed697ac19b17c486d130aa1d7e03
2013-01-18 12:41:18 -05:00
Petr Onderka
80aa025528 Added result properties to action=paraminfo
Added information about the properties of the results of API calls
to action=paraminfo, including information about "property groups":
what should the prop parameter be set to to get that property.

Uses the same format for types as parameters already do.
The output format of some modules doesn't fit this, so the result
properties for them weren't added, or only partially.

Partially implemented modules:
* expandtemplates:
  parsetree is in its own tag
* protect, allusers, backlinks, deletedrevs, info, imageinfo,
  logevents, querypage, recentchanges, revisions, searchinfo,
  usercontribs, userinfo, users, watchlist, upload:
  response with partially complex structure

Not implemented modules:
* feedcontributions, feedwatchlist, opensearch, rds:
  non-standard reponse
* help:
  error is normal response; not very useful for automated tools anyway
* paraminfo, parse, pageprops, siteinfo, userrights:
  response with complex structure

Change-Id: Iff2a9bef79f994e73eef3062b4dd5461bff968ab
2012-06-06 19:24:59 +02:00
Szymon Świerkosz
7cf5f38232 Move optionstoken from meta=userinfo to action=tokens.
Follow up to I0d6c654a7354ba77e65e338423952a6a78c1150f.
I have also added a URL to a help page on mw.org.

Change-Id: Ie223930cfc313aff150e2dcfd70b74bf4360a8a8
2012-05-06 16:07:17 +02:00
Max Semenik
ab4e51863b Make API action=tokens extendable
LocalSettings snippet for testing:

$wgHooks['ApiTokensGetTokenTypes'][] = function( &$hookTypes ) {
	$hookTypes['foo'] = function() { return 'bar'; };
	return true;
};

Change-Id: Idf1f4379e677d21059c1b4e12f80e9d2bafb9897
2012-04-25 12:48:53 +04:00
Kaldari
9ec8e3525b (bug 27757) API method for retrieving tokens
Change-Id: I58bc5847b996d100712781052f20150f76786ed1
2012-04-02 18:06:03 +01:00