Commit graph

43 commits

Author SHA1 Message Date
Brad Jorsch
f459c1aeca SECURITY: Improve cross-domain-policy mangling
Take into account that the tag might have parameters.

Bug: T123653
Change-Id: Ie9799f5ea45badfb4e7b4be7e7fbc1c35cc86f26

Signed-off-by: Chad Horohoe <chadh@wikimedia.org>
2016-05-20 09:48:11 -07:00
Kunal Mehta
6e9b4f0e9c Convert all array() syntax to []
Per wikitech-l consensus:
 https://lists.wikimedia.org/pipermail/wikitech-l/2016-February/084821.html

Notes:
* Disabled CallTimePassByReference due to false positives (T127163)

Change-Id: I2c8ce713ce6600a0bb7bf67537c87044c7a45c4b
2016-02-17 01:33:00 -08:00
Aaron Schulz
6af3c39c07 Replace "squid" with "CDN" in various comments
Change-Id: Idcc528daf28e119349155d36e30a9bcf61b2e7d5
2015-12-09 17:35:37 -08:00
Faidon Liambotis
7e20cb51fe Replace XVO with support for the Key HTTP header
MediaWiki currently has support for a header called X-Vary-Options
(XVO), used to communicate to upstream caches more granular cache
variance options than the Vary header can.

The header was envisioned by Tim Starling back in 2008 and implemented
into MediaWiki and Squid 2.0, with those patches submitted to the
squid-dev mailing list at the time:
http://www.squid-cache.org/mail-archive/squid-dev/200802/0085.html
The patches never actually made it into an upstream Squid release,
however, and Squid has since evolved in potentially significant ways.

Wikimedia has since switched to Varnish but XVO was not ported over as
it was deemed too complex at the time; custom VCL was used instead. To
our knowledge, noone else is using XVO in production and certainly not
with recent, up-to-date MediaWiki releases.

There is currently work at IETF's httpbis working group for a "Key"
header that is in concept and implementation very similar to Tim's XVO
header: https://datatracker.ietf.org/doc/draft-fielding-http-key/

Rather than rip XVO out of MediaWiki, replace it with support for the
Key header, as preliminary defined by the draft spec. This is an almost
straight search-and-replace.

No other software (caching proxy or user-agent) currently implements Key
to my knowledge, so this is essentially untested.

Change-Id: I949fc289dd5d48bd34f3b37f7739e2b9cd5db277
2015-10-07 21:26:40 -07:00
Sergio Santoro
3de9803c06 Fix case insensitive string comparison for http header names
As of RFC 2616 sec 4.2, http header names are case insensitive.

Change-Id: Ib72df2572f5a9c825c5b3ad7735126f3687aad79
2014-12-12 02:38:43 +00:00
csteipp
92f22cd466 Make calling wfMangleFlashPolicy configurable
Add $wgMangleFlashPolicy so sites that define a safe master flash
policy can disable mangling of the <cross-domain-policy> string.

Bug: 66776
Change-Id: Ic0db939aae9d0bb6bdfc3cd9ce282661bad46783
2014-11-19 11:46:18 -08:00
Siebrand Mazeland
49cffd699c Make phpcs-strict pass on includes/ (2/~10)
Change-Id: I59fa9af7b16e0a5a4eb8a5cc764a605b18137316
2014-05-11 19:22:05 +00:00
umherirrender
8ad1c92441 Fixed some @params documentation (includes/*)
Swapped some "$var type" to "type $var" or added missing types
before the $var. Changed some other types to match the more common
spelling. Makes beginning of some text in captial.
Also added some missing @param.

Change-Id: I7f605aa9e117b5fd80d9b1440864fe526d2b14a5
2014-04-20 21:16:57 +02:00
Alexandre Emsenhuber
559afbf6d3 Fix fatal error when $wgValidateAllHtml is enabled and apache_request_headers() does not exists
Changed apache_request_headers() to headers_list() since the latter is always available

Change-Id: Ia52f5a0d12db0680aa03b57dd45c974291e88af9
2013-07-25 12:05:13 +02:00
Daniel Friesen
97caae596d Drop support for XHTML 1.0
* $wgHtml5 = false; is now ignored completely.
* $wgDocType and $wgDTD have been removed.
* $wgXhtmlDefaultNamespace is now ignored.
* XHTML5 will be output if $wgMimeType is set to an XML mime type (according to HTML5's rules).
* For backwards compatibility with extensions $wgHtml5 and $wgXhtmlDefaultNamespace are set
  in Setup.php but depending on them is deprecated.

Change-Id: Iad9634e2ee420b5a3bbffe550421fde4fa1819b0
2013-05-15 23:09:25 -07:00
umherirrender
ef2f507d23 Fixed spacing in files direct in includes folder
Added spaces before if, foreach
Added some braces for one line statements

Change-Id: Ibb8dd102db045522d12ff939075ba7420d95ab6b
2013-04-21 06:38:49 +00:00
Yuri Astrakhan
9506e3d812 Spellchecked /includes directory
* Ran spell-checker over code comments in /includes/
* A few spellchecking fixes for wfDebug() calls

Found one very strange (NOOP?) line in Linker.php - see "TODO: BUG?"

Change-Id: Ibb86b51073b980eda9ecce2cf0b8dd33f058adbf
2013-03-13 03:42:41 -04:00
Dereckson
7276fd4d90 (bug 43218) Fixing PHP notice: undefined SERVER_PROTOCOL key
Change-Id: I1ce7605a7c8503aed37ed9b3e7c3f3c13083db6f
2012-12-18 15:45:06 +01:00
umherirrender
85d8ee1f87 Remove a bunch of trailing spaces and unneeded newlines
Change-Id: I00f369641320acd7f087427ef031f3ee7efa0997
2012-10-10 20:14:40 +02:00
Alexandre Emsenhuber
d1f8640a3b Added missing GPLv2 headers in some places.
Also made file/class documentation more consistent.

Change-Id: Ia45d0756cd84138da267bf1cbd1a58be7f28c6d1
2012-05-11 10:34:29 +02:00
Antoine Musso
9b6a4c922a debug statements for HTMLFileCache / Output 2012-02-09 10:56:36 +00:00
Sam Reed
3614ecfffb And more documentation. Yaaaay 2011-05-28 17:18:50 +00:00
Sam Reed
a9554c1677 More adding, updating and tweaking of documentation 2011-05-21 19:07:24 +00:00
Siebrand Mazeland
75c6696aa8 Use consistent notation for "@todo FIXME". Should update http://svn.wikimedia.org/doc/todo.html nicely. 2011-05-17 22:03:20 +00:00
Alexandre Emsenhuber
7b79d94515 * Standardised file description headers
* Added some descriptions
* Added @file where needed
2010-08-14 17:42:40 +00:00
Tim Starling
4c94b8a9ec Send XVO headers only if $wgUseXVO is true. 2010-07-23 05:00:58 +00:00
Aryeh Gregor
643866f8b7 War on xml:lang
There is no reason to use this in HTML in addition to the lang
attribute.  No spec requires it (AFAIK) and it's completely redundant.
2010-02-11 17:25:10 +00:00
Platonides
da21210211 (bug 22034) use wfClientAcceptsGzip() in wfGzipHandler instead of reimplementing it.
$wgUseGzip check on wfClientAcceptsGzip() is removed since HTMLFileCache (the only wfClientAcceptsGzip() user) already checked that before calling it. This way, $wgUseGzip stays applying only for file cache, and $wgDisableOutputCompression for  output handler.
2010-01-14 16:35:35 +00:00
Siebrand Mazeland
7c27e42fb8 Revert 60864: "Use wfClientAcceptsGzip() in wfGzipHandler." Causes PHP Notice: Undefined index: HTTP_ACCEPT_ENCODING in GlobalFunctions.php on line 1175 2010-01-09 19:14:43 +00:00
Siebrand Mazeland
29e47fa366 (bug 22034) Use wfClientAcceptsGzip() in wfGzipHandler. Patch by Platonides.
wfGzipHandler should use wfClientAcceptsGzip() instead of reimplementing it. Patch does this and removes the $wgUseGzip check on wfClientAcceptsGzip() since HTMLFileCache (the only wfClientAcceptsGzip() user) already checked that before calling it. This way $wgUseGzip stays applying only for file cache, and $wgDisableOutputCompression for output handler.
2010-01-09 18:10:11 +00:00
Alexandre Emsenhuber
c3ec19debc Replaced all @fixme with "@todo Fixme" since doxygen doesn't have a @fixme command 2009-12-15 21:26:58 +00:00
OverlordQ
a989843cd0 Code cleanup, covert leading spaces into tabs per coding style 2009-11-14 21:27:13 +00:00
Domas Mituzas
1508f598ad sweet spot for compression, per:
* http://spreadsheets.google.com/pub?key=t-EjyzEfh0t39hoQbf-a5fw
2009-08-28 17:46:19 +00:00
Siebrand Mazeland
9e968c0bfa Re-revert r46344 because of crossing commits (r46346) 2009-01-27 15:20:31 +00:00
Siebrand Mazeland
4b9b399711 Revert r46344. PHP Fatal error: Class 'MWTidy' not found in /var/www/w/includes/parser/Parser.php on line 378 2009-01-27 15:17:45 +00:00
Alexandre Emsenhuber
c119961f31 Per Brion's comment on http://www.mediawiki.org/wiki/Special:Code/MediaWiki/46145#c1445 :
* Refactored Tidy function in a new class, MWTidy
* Only added Parser::tidy() for b/c, Parser::internalTidy() and Parser::externalTidy() were marked as private and are unused in core and extensions
* Added RELEASE-NOTES entry
2009-01-27 15:09:19 +00:00
Alexandre Emsenhuber
da85e17316 Tweaks for the "Whole HTML Validation" feature:
* Allow to use external tidy
* Accept application/xhtml+xml mime type
* Fix XHTML errors on errors reports :)
2009-01-24 16:26:05 +00:00
Tim Starling
4b04f1a2eb Fixed excessive memory usage in PCRE in wfMangleFlashPolicy(). Was causing OOM on various big pages. Possible upstream regression, deserves investigation. 2008-05-30 14:58:29 +00:00
Siebrand Mazeland
79d5225c0e * remove end of line whitespace
* remove empty lines at end of file
* remove "?>" where still present
2008-04-14 07:45:50 +00:00
Tim Starling
377561cd1e * Introduced OutputPage::addWikiMsg() and OutputPage::wrapWikiMsg(), to make it easier to avoid double-parsing. Double-parsing introduces differences between the old and new parsers.
* Used the new functions in the relevant places throughout the core. Where this was not possible, used wfMsgNoTrans() to avoid double-parsing.
* Calling wfEscapeWikiText() on a title before passing it to a message is unnecessary and causes bugs. The best idea is to let the message do its own escaping. Removed wfEscapeWikiText() from the caller of addedwatchtext, removedwatchtext, deletedtext, protect-text, nosuchusershort and movepage-moved. Updated all message files to use <nowiki>$1</nowiki> where appropriate in these messages. 
* Removed unnecessary empty message handling from semiprotectedpagewarning
* Removed nonsense warning about the output of wfMsg() not being safe for inclusion in HTML. 
* Changed wfShellExec() to use passthru/ob_get_contents instead of exec(). This avoids corruption of whitespace in the response. 
* Added $wgValidateAllHtml feature, to optionally validate HTML on output. 
* Fixed missing newline in cascadeprotected in MessagesEn.php
* Belatedly updated addedwatchtext to take account of the new "monobook" skin. No unwatch link in the sidebar anymore.
2008-02-18 07:25:35 +00:00
Tim Starling
55bd3a0279 Add an X-Vary-Options header, as per my proposed squid patch 2008-02-08 07:12:38 +00:00
Brion Vibber
455feda3ac * (bug 11795) Be more paranoid about confirming accept-encoding header is present 2007-10-29 17:41:55 +00:00
Brion Vibber
f4080c1838 Don't do gzip compression if the URL path ends in .gz or .tgz
This confuses Safari and triggers a download of the page,
even though it's pretty clearly labeled as viewable HTML.
Bad Safari! Bad!

Bug is still present in Safari 2.0.4/Mac and 3.0.2/Win.

We have had a live hack for this on Wikimedia sites for .gz files;
hadn't noticed the .tgz problem before though.

While I was in there, also made a tweak so wfGzipHandler() makes
sure the Vary: header is there whether the current agent sent us
an Accept-Encoding header or not.
2007-07-19 19:06:32 +00:00
Aryeh Gregor
a15c419b3d Remove ?>'s from files. They're pointless, and just asking for people to mess with the files and add trailing whitespace. (Yes, I looked over every one and reverted those that were bogus. Slash-enter a million times in less worked well enough, although it was a bit mind-numbing.) 2007-06-29 01:19:14 +00:00
Brion Vibber
0757f0a92e Fix regression: typo caused 'Vary: Accept-Encoding' to be sent overwriting more exact Vary lines such as the Vary: Accept-Encoding, Cookie used for squid mode 2007-02-20 05:04:36 +00:00
Brion Vibber
94e8f63eb7 Don't suppress gzip mode for zero-length output; failing to send the
Content-Encoding header with 304 responses confuses some browsers.
2007-02-20 04:58:54 +00:00
Brion Vibber
62ef8829fb * Further fix to Special:Export etc; instead of trying to suppress those
Content-Encoding and Content-Length headers, just don't send them 
  in the first place!
* Suppress Content-Length from wfOutputHandler if $wgDisableOutputCompression set
* Fix typo that caused $wgDisableOutputCompression to *enable* instead of *disable* compression ;)
2007-02-20 04:46:07 +00:00
Tim Starling
28dc3ec888 * Moved the main ob_start() from the default LocalSettings.php to WebStart.php.
The ob_start() section should preferably be removed from older 
  LocalSettings.php files.
* Give Content-Length header for HTTP/1.0 clients.
* Partial support for Flash cross-domain-policy filtering. Text entry points should be protected, but uploads are not.
2007-02-19 23:03:37 +00:00