Commit graph

255 commits

Author SHA1 Message Date
Umherirrender
7c3613951f i18n: Split apihelp for standard dir parameter
Easier to translate
There is no visible change for example on
Special:ApiHelp/query+watchlist

Bug: T285545
Change-Id: I536fa3e07a951f3ff98870678ffdbc294a3c7bc0
2023-08-05 15:06:52 +02:00
Umherirrender
6e0065ad20 Simplify WHERE conditions with field IS NULL
Reduce raw sql fragments on simple compares

Change-Id: I3f2340dfdbf5197cc22546911e6c5653dc5a6269
2023-07-24 19:22:36 +02:00
Umherirrender
160411d4cf Simplify WHERE conditions with field = '' OR IS NULL
Syntax supported since 26235c73

Change-Id: I397c76d4aba753a1629383559b95df86514f19ff
2023-07-01 22:17:42 +02:00
James D. Forrester
ad06527fb4 Reorg: Namespace the Title class
This is moderately messy.

Process was principally:

* xargs rg --files-with-matches '^use Title;' | grep 'php$' | \
  xargs -P 1 -n 1 sed -i -z 's/use Title;/use MediaWiki\\Title\\Title;/1'
* rg --files-without-match 'MediaWiki\\Title\\Title;' . | grep 'php$' | \
  xargs rg --files-with-matches 'Title\b' | \
  xargs -P 1 -n 1 sed -i -z 's/\nuse /\nuse MediaWiki\\Title\\Title;\nuse /1'
* composer fix

Then manual fix-ups for a few files that don't have any use statements.

Bug: T166010
Follows-Up: Ia5d8cb759dc3bc9e9bbe217d0fb109e2f8c4101a
Change-Id: If8fc9d0d95fc1a114021e282a706fc3e7da3524b
2023-03-02 08:46:53 -05:00
Alexander Vorwerk
f6bd18d6c2 Split a base class out of CommentStore
so that extensions (i.e. CheckUser) can implement their own comment
store without having a lot of code duplication

basically the comment store version of I3a6486532f2ef36

Bug: T233004
Change-Id: Ib40f99e00a514d41776ce521baf113e46d37e9cd
2023-01-01 22:34:36 +00:00
Umherirrender
07697bb57c api: Replace deprecated Linker::formatComment
Bug: T324906
Change-Id: I1fcb7bd9d84754793c07ac9e39e50c38b364e4c1
2022-12-11 00:56:46 +01:00
jenkins-bot
894890b3ce Merge "api: Do not use rctitle and rcnamespace together" 2022-11-14 08:51:41 +00:00
Umherirrender
6474d423a1 api: Do not use rctitle and rcnamespace together
The sql contains the namespace twice, which is not useful:
WHERE rc_namespace = ? AND (rc_namespace = ?) AND rc_title = '?' )

Change-Id: Ia0d50ad70dc4962b888b8baac8fc11be2ba537bb
2022-11-11 08:55:24 +00:00
Umherirrender
75ec894af0 api: Validate timestamp in continue parameter
Bug: T321265
Change-Id: Ib46bc3e643938f56e0c58a3c5f5e093327e00964
2022-11-01 22:40:10 +01:00
Bartosz Dziewoński
a8c9e98661 Deduplicate code for parsing API 'continue' parameters
30+ API modules had nearly identical code to split and validate
the value of the 'continue' parameter.

Introduce the ApiBase::parseContinueParamOrDie() method and use it to
replace most usages of ApiBase::dieContinueUsageIf(). A few remain in
modules with more complex continuation handling.

Inline most single-use variables that remained after validation was
moved into the new method.

Change-Id: I66bd59ecd4ad16e2039e90f7d66cfa276e6c1c2a
2022-09-29 16:05:31 +00:00
Bartosz Dziewoński
00b74a0e4b Use buildComparison() instead of raw SQL in more API modules (easy cases)
See ec79aa3943 about the new method.

These changes all follow the same simple patterns. More complex cases
are handled in I6231b6beae13474d4986929367a9adc6bb76b0db.

This commit was created by running the following terrible Ruby script
I devised: https://phabricator.wikimedia.org/P34833, then manually
reviewing the results: checking that the output makes sense in general,
that the affected variables are not used elsewhere in the file, and
that no comparison conditions have been lost. A few incorrect changes
were undone or corrected.

Change-Id: I8ed363bd6b80a9481d44434a526f078cce20220f
2022-09-29 16:04:23 +00:00
Reedy
f15a759df1 api: Minor code cleanup
Change-Id: I1f20597093448d00435158a9ac861873000bb057
2022-08-14 13:10:53 +00:00
jenkins-bot
c624357cb7 Merge "api: Report external titles in more places as apierror-invalidtitle" 2022-08-05 01:07:04 +00:00
Reedy
f45fefec0e api: Replace numerous more deprecated constants
Change-Id: I498a315b8b4b56d5e2f939e797adbe0487cd7d07
2022-06-06 02:24:41 +01:00
Reedy
0b5084f868 api: Replace numerous deprecated constants
Change-Id: I34ffcb70efbfa257da8dab6e0790aa0d697caf5b
2022-06-06 00:18:50 +01:00
Umherirrender
00bc7a2b28 api: Report external titles in more places as apierror-invalidtitle
It is only useful to use local titles for various api parameters

Change-Id: Ife2a951e6b48b59e2b77d455c8343f79f1163b0a
2022-04-16 19:28:45 +00:00
Aryeh Gregor
666ca1bdf3 Use MainConfigNames instead of string literals, #2
This covers all occurrences of /onfig->.*get( '/ in includes/.
Undoubtedly there are still plenty more to go.

Change-Id: I33196c4153437778496f40436bcde399638ac361
2022-04-13 18:55:46 +03:00
Amir Sarabadani
627c1c2c30 Allow setting max execution time to several special pages
These special pages and their counter-part APIs are:
 - Special:RecentChanges
 - Special:Watchlist
 - Special:Log
 - Special:Contributions

This also changes the way MAX_EXECUTION_TIME works from taking the value
as milliseconds, it takes seconds which is more intuitive for users.

Bug: T297708
Depends-On: I126e7181422d8da1a63afc3717faa4f72a687dd9
Change-Id: I3ff78751c3df3b6342f1865d35c2075f4415185d
2021-12-15 22:59:06 +01:00
Tim Starling
f7f84dddb3 Introduce CommentFormatter
CommentParser:

* Move comment formatting backend from Linker to a CommentParser service.
  Allow link existence and file existence to be batched.
* Rename $local to $samePage since I think that is clearer.
* Rename $title to $selfLinkTarget since it was unclear what the title
  was used for.
* Rename the "autocomment" concept to "section link" in public
  interfaces, although the old term remains in CSS classes.
* Keep unsafe HTML pass-through in separate "unsafe" methods, for easier
  static analysis and code review.

CommentFormatter:

* Add CommentFormatter and RowCommentFormatter services as a usable
  frontend for comment batches, and to replace the Linker static methods.
* Provide fluent and parametric interfaces.

Linker:

* Remove Linker::makeCommentLink() without deprecation -- nothing calls
  it and it is obviously an internal helper.
* Soft-deprecate Linker methods formatComment(), formatLinksInComment(),
  commentBlock() and revComment().

Caller migration:

* CommentFormatter single: Linker, RollbackAction, ApiComparePages,
  ApiParse
* CommentFormatter parametric batch: ImageHistoryPseudoPager
* CommentFormatter fluent batch: ApiQueryFilearchive
* RowCommentFormatter sequential: History feed, BlocklistPager,
  ProtectedPagesPager, ApiQueryProtectedTitles
* RowCommentFormatter with index: ChangesFeed, ChangesList,
  ApiQueryDeletedrevs, ApiQueryLogEvents, ApiQueryRecentChanges
* RevisionCommentBatch: HistoryPager, ContribsPager

Bug: T285917
Change-Id: Ia3fd50a4a13138ba5003d884962da24746d562d0
2021-09-28 11:13:03 -07:00
Petr Pchelko
8d7201894c Drop action api token methods deprecated in 1.24
Removes deprecated API endpoints and modules for dealing with
CSRF tokens.

Note: i18n messages are removed in a followup for ease of revert.

Bug: T280806
Depends-On: Ic83f44587db119ff2e3e6d5ff33a10894e0695e7
Change-Id: I58aedec6942ac5d3c21574cb0072f00ef365098c
2021-09-13 15:22:16 +00:00
jenkins-bot
e89e7aa8b0 Merge "Revert "Use CsrfTokenSet as CSRF token source"" 2021-08-05 23:37:31 +00:00
Kunal Mehta
a85f569dd1 Revert "Use CsrfTokenSet as CSRF token source"
This reverts commit 0d75fdb4f7.

Bug: T287542
Change-Id: Iedd3461869f973f8d621a39e6ad4674cbb577551
2021-08-05 15:48:26 -07:00
Umherirrender
e771db4274 api: list=recentchanges user param must not be an object
Avoid implicit User::__toString

Change-Id: Ia2d13c7127834b9bc2d59e31c8b231edd66f5e93
2021-08-06 00:28:00 +02:00
Petr Pchelko
0d75fdb4f7 Use CsrfTokenSet as CSRF token source
Change-Id: I079d2c802d9b48d6abf7f37fa9ef7dafac631345
2021-07-12 14:19:15 -07:00
Umherirrender
1810658dc1 api: Inject services into ApiQueryRecentChanges
Bug: T259960
Change-Id: Ifab55daae08ee49e07bef93656cb7eb474f46cae
2021-07-03 20:50:09 +02:00
Tim Starling
9c3c0b704b Use array_fill_keys() instead of array_flip() if that reflects the developer's intention
array_fill_keys() was introduced in PHP 5.2.0 and works like
array_flip() except that it does only one thing (copying keys) instead
of two things (copying keys and values). That makes it faster and more
obvious.

When array_flip() calls were paired, I left them as is, because that
pattern is too cute. I couldn't kill something so cute.

Sometimes it was hard to figure out whether the values in array_flip()
result were used. That's the point of this change. If you use
array_fill_keys(), the intention is obvious.

Change-Id: If8d340a8bc816a15afec37e64f00106ae45e10ed
2021-06-15 00:11:10 +00:00
Tim Starling
fd01c53778 Stop using legacy ActorMigration field "rc_user"
Bug: T278917
Change-Id: I4d6c175c637a2cb26c63e0b2b27d5ea8ce6b1e0d
2021-04-28 16:29:04 +10:00
DannyS712
523342c781 Inject CommentStore service into api query modules
- ApiQueryBlocks
- ApiQueryDeletedrevs
- ApiQueryFilearchive
- ApiQueryLogEvents
- ApiQueryProtectedTitles
- ApiQueryRecentChanges
- ApiQueryUserContribs
- ApiQueryWatchlist

Bug: T259960
Change-Id: Ib7ee815fcea3e72523124eb6a2eaf20ad9565cfe
2021-04-23 15:09:48 +00:00
Cindy Cicalese
f6e1891c6f Use Authority and GroupPermissionLookup in Action API
Replaces calls directly to PermissionManager with calls to
the Authority object available from Context or the
GroupPermissionLookup service.

This patch does not address use of PermissionManager for
blocks.

Deprecations:
- ApiBase::checkUserRightsAny deprecated passing optional
User parameter
- ApiBase::checkTitleUserPermissions deprecated passing
LinkTarget as first parameter, takes PageIdentity instead

Bug: T271462
Bug: T271854
Change-Id: I5d7cac1c28a37e074750c46cda03283980a07fca
2021-02-23 14:31:14 +00:00
Umherirrender
083a0e57cb Improve docs in api related classes
Change-Id: I78338d48530f098fa5d36fe84cfd45c0d160f444
2020-11-13 23:11:06 +01:00
Thiemo Kreuz
08cf4c49df Add PHPDoc documentation to all API query module constructors
Change-Id: I2bc140576efc891bb9b6e50e44041d5bb022ac8f
2020-10-27 19:16:41 +00:00
DannyS712
5f076458dd Remove uses of $wgUser in api token methods
Bug: T243708
Change-Id: I2f82af8c3413038fa321434759dc9e9a921e3118
2020-09-09 23:56:17 +00:00
DannyS712
a7d5f4055d Remove deprecated api token hooks
Hooks removed:
APIQueryInfoTokens
APIQueryRecentChangesTokens
APIQueryRevisionsTokens
APIQueryUsersTokens
ApiTokensGetTokenTypes

Bug: T248022
Change-Id: Ieae43b05e7ba4853a3b6c7e2b03197e85a8d3579
2020-09-08 17:08:21 +00:00
Tim Starling
68c433bd23 Hooks::run() call site migration
Migrate all callers of Hooks::run() to use the new
HookContainer/HookRunner system.

General principles:
* Use DI if it is already used. We're not changing the way state is
  managed in this patch.
* HookContainer is always injected, not HookRunner. HookContainer
  is a service, it's a more generic interface, it is the only
  thing that provides isRegistered() which is needed in some cases,
  and a HookRunner can be efficiently constructed from it
  (confirmed by benchmark). Because HookContainer is needed
  for object construction, it is also needed by all factories.
* "Ask your friendly local base class". Big hierarchies like
  SpecialPage and ApiBase have getHookContainer() and getHookRunner()
  methods in the base class, and classes that extend that base class
  are not expected to know or care where the base class gets its
  HookContainer from.
* ProtectedHookAccessorTrait provides protected getHookContainer() and
  getHookRunner() methods, getting them from the global service
  container. The point of this is to ease migration to DI by ensuring
  that call sites ask their local friendly base class rather than
  getting a HookRunner from the service container directly.
* Private $this->hookRunner. In some smaller classes where accessor
  methods did not seem warranted, there is a private HookRunner property
  which is accessed directly. Very rarely (two cases), there is a
  protected property, for consistency with code that conventionally
  assumes protected=private, but in cases where the class might actually
  be overridden, a protected accessor is preferred over a protected
  property.
* The last resort: Hooks::runner(). Mostly for static, file-scope and
  global code. In a few cases it was used for objects with broken
  construction schemes, out of horror or laziness.

Constructors with new required arguments:
* AuthManager
* BadFileLookup
* BlockManager
* ClassicInterwikiLookup
* ContentHandlerFactory
* ContentSecurityPolicy
* DefaultOptionsManager
* DerivedPageDataUpdater
* FullSearchResultWidget
* HtmlCacheUpdater
* LanguageFactory
* LanguageNameUtils
* LinkRenderer
* LinkRendererFactory
* LocalisationCache
* MagicWordFactory
* MessageCache
* NamespaceInfo
* PageEditStash
* PageHandlerFactory
* PageUpdater
* ParserFactory
* PermissionManager
* RevisionStore
* RevisionStoreFactory
* SearchEngineConfig
* SearchEngineFactory
* SearchFormWidget
* SearchNearMatcher
* SessionBackend
* SpecialPageFactory
* UserNameUtils
* UserOptionsManager
* WatchedItemQueryService
* WatchedItemStore

Constructors with new optional arguments:
* DefaultPreferencesFactory
* Language
* LinkHolderArray
* MovePage
* Parser
* ParserCache
* PasswordReset
* Router

setHookContainer() now required after construction:
* AuthenticationProvider
* ResourceLoaderModule
* SearchEngine

Change-Id: Id442b0dbe43aba84bd5cf801d86dedc768b082c7
2020-05-30 14:23:28 +00:00
DannyS712
e9b012f3b1 Hard-deprecate api hooks for getting tokens
Soft deprecated in 1.24
The following hooks were hard deprecated:
* APIQueryInfoTokens
* APIQueryRecentChangesTokens
* APIQueryRevisionsTokens
* APIQueryUsersTokens
* ApiTokensGetTokenTypes

Bug: T232869
Bug: T232870
Bug: T232871
Bug: T232872
Bug: T232873
Bug: T245329
Change-Id: Ia14eae17b676ee0356eaf0679d8ac3af0b24b86a
2020-03-14 20:35:04 +00:00
Tim Starling
a06e3d06b1 Fix some PHPStorm inspection warnings in includes/api
Notably:
* In ApiManageTags, I used a switch instead of a dynamic function name,
  so that the call graph will be correct.
* In ApiImageRotate, checkTitleUserPermissions() has always returned
  void, this was an error introduced in 4e6810e4a2

Change-Id: Iea22616b8e7e2e0cc804619a54f8690898b2cb82
2020-02-18 14:17:37 -05:00
Brad Jorsch
c2b1525908 API: Use ParamValidator library
This brings significant modularization to the Action API's parameter
validation, and allows the Action API and MW REST API to share
validation code.

Note there are several changes in this patch that may affect other code;
see the entries in RELEASE-NOTES-1.35 for details.

Bug: T142080
Bug: T232672
Bug: T21195
Bug: T34675
Bug: T154774
Change-Id: I1462edc1701278760fa695308007006868b249fc
Depends-On: I10011be060fe6d27c7527312ad41218786b3f40d
2020-02-04 13:36:14 -05:00
James D. Forrester
0958a0bce4 Coding style: Auto-fix MediaWiki.Usage.IsNull.IsNull
Change-Id: I90cfe8366c0245c9c67e598d17800684897a4e27
2020-01-10 14:17:13 -08:00
jenkins-bot
5afbc90670 Merge "Add 'slot' param for recentchanges API query" 2019-12-03 20:51:23 +00:00
Cormac Parle
b4c7426a3f Add 'slot' param for recentchanges API query
Pass 'rcslot' as a param for the recent changes API to
only get changes (incl. reverts) for the specified slot

Bug: T230862
Change-Id: Iae53b1b22515116c61318ebe5ad3550c45554484
2019-11-25 12:54:47 +00:00
Umherirrender
731d9f748e Run GenderCache for api query modules using ApiQueryBase::addTitleInfo
When converting a Title object into a string for user or user talk
namespace the gender information are needed.

This patch set improves performance on wikis with gender distinction
like dewiki or ruwiki by combining the fetch of the information into one
query and avoids a query per unique user name.
It also avoids false results for request with apihighlimit, because the
apihighlimit with 5000 is higher than the query max limit of the
GenderCache with 1000

Bug: T200238
Change-Id: Ibe0561b210dbeb654117dad777e839640f51b4e4
2019-11-02 22:23:23 +01:00
Petr Pchelko
fd130247c2 Deprecate and replace usages of User:isAllowed{All,Any}
Bug: T220191
Change-Id: I197b8fadaa93e7b320fc19c10e3e09387fe09ad2
2019-08-21 18:36:16 -07:00
Petr Pchelko
1d286560d2 Replace User::isAllowed with PermissionManager.
Covers root includes, actions, api, block, changes,
changetags, diff and PermissionManager itself.

Bug: T220191
Change-Id: Ic027d32f5dd8f4c74865df0c8a9fcf91123c889c
2019-08-20 14:43:51 -07:00
Timo Tijhof
5aa9ba58ea API: Always select rc_user from database (regardless of rcprop=user)
Bug: T228425
Change-Id: I1b6f684c8289282326da0e326b90fcf8ff87d71e
2019-07-31 13:45:34 +00:00
Lucas Werkmeister
178b7ad6a4 SECURITY: Fix cache mode for (un)patrolled recent changes query
Restricting the list of recent changes to patrolled, not patrolled,
autopatrolled, not autopatrolled, or unpatrolled recent changes requires
special permissions (as does displaying that status in the properties of
returned entries), but we only set the cache mode to private in the
first two cases.

Bug: T212118
Change-Id: I4c3fe6e47f80ebf97fa37875c704328d08772d26
2019-06-06 16:54:29 +00:00
Aaron Schulz
cb15755e92 Normalize use of "INNER JOIN" to "JOIN" in database queries
The ANSI SQL default join type is INNER and this might save
some line breaks here and there.

Change-Id: Ibd39976f46ca3f9b71190d3b60b76ca085787a00
2019-03-06 09:17:30 -08:00
Reedy
4691389fa4 Use (int) rather than intval()
Bug: T216969
Change-Id: I4c06716c83b69d128f26fa7f68736808aa2d3d64
2019-02-25 00:38:33 +00:00
Kunal Mehta
cc5d9a92a2 build: Updating mediawiki/mediawiki-codesniffer to 24.0.0
Change-Id: I66b1775b7c1d36076d9ca78cbeb42787a743f2aa
2019-02-07 18:39:42 +00:00
jenkins-bot
85fa38d0b7 Merge "Migrate Api modules from tag_summary table to change_tag" 2018-11-30 19:13:46 +00:00
Amir Sarabadani
02a930d7fb Drop $wgChangeTagsSchemaMigrationStage
Bug: T194163
Change-Id: Ieb6cc60cacf9dd0d86641b1be817249cdce42112
2018-11-28 23:03:41 +01:00