Commit graph

227 commits

Author SHA1 Message Date
jenkins-bot
a863646edd Merge "BlockUser: Restore blocking autoblocked IP addresses" 2021-08-11 13:22:32 +00:00
Alexander Vorwerk
dfb88f21ac McrUndoAction: inject ReadOnlyMode
Bug: T253078
Change-Id: I381fb0a4018f3e4cebe7aa21be36dbf1e8306316
2021-08-06 03:14:20 +02:00
Kunal Mehta
a85f569dd1 Revert "Use CsrfTokenSet as CSRF token source"
This reverts commit 0d75fdb4f7.

Bug: T287542
Change-Id: Iedd3461869f973f8d621a39e6ad4674cbb577551
2021-08-05 15:48:26 -07:00
Gergő Tisza
16f3b8c4c0 Make HTMLTitleTextField interwiki option tri-state
Make the 'interwiki' option temporarily accept null as well as true/false
(and default to null instead of false) so form fields which disallow
interwiki titles can avoid deprecation warnings. This also includes
implementing the new error message.

The idea is that for the duration of the deprecation process, form fields
can be set explicitly to interwiki => false (which will eventually become
the default). It would be super annoying to have to do this for all
title fields, but this way it's only needed for fields where users actually
submit interwiki titles with some frequency.

Also improve the logic for legacy fields (which do not set the option
either way): since these (while emitting a warning) allow an interwiki
title, it does not make sense to apply namespace etc. checks to that
title.

Bug: T288155
Change-Id: Ic00f4a0f27747b5ff0893b4c01f42f68a99771ab
2021-08-04 21:24:16 -07:00
jenkins-bot
579b057f29 Merge "Rename where* methods in UserSelectQueryBuilder" 2021-08-04 23:38:22 +00:00
TChin
97716b4432 Rename where* methods in UserSelectQueryBuilder
Bug: T278254
Change-Id: I3f6d120b4426d8729b8db0336ce6db2b35163f71
2021-08-04 16:32:03 -04:00
DannyS712
b8b44a6de9 Inject services into Mcr(Undo|Restore)Action
Bug: T253078
Change-Id: I7519f41df37a47a56bfb2d4419b52860ca1bb732
2021-08-04 18:04:43 +00:00
Matěj Suchánek
1902efbcc7 BlockUser: Restore blocking autoblocked IP addresses
This seems to be a regression from 166ed5c.
DatabaseBlock::newFromTarget may return an autoblock for an IP
unless there is an existing manual block. If so, ignore it
because it is allowed to have an IP address both manually
blocked and autoblocked (see ipb_address_unique index).

Also add an integration test case.

Bug: T287798
Change-Id: I7c9a66ba0ffe759f43f4d0821c30fb94649d3dea
2021-08-03 14:49:41 +00:00
Tim Starling
a8d6499c17 Make IResultWrapper::seek() throw an exception
Make IResultWrapper inherit from SeekableIterator instead of Iterator.
As suggested by the interface documentation, throw an
OutOfBoundsException when the seek is out of bounds, instead of failing
in subtle ways.

Change-Id: I60427bc9057677254f1b06177ec525f1ae917721
2021-08-02 11:37:45 +10:00
Petr Pchelko
339fd93f67 Make MovePageTest actually test valid moves
Before MovePageTest was skipped if the move was valid,
claiming we can't test actual moves. Now we can.

Additionally, use MediaTestTrait for file and repo
mocking.

Change-Id: Ie8a1edbdb2f22432919f03a60c2dacc5d4528615
2021-07-28 09:18:59 -07:00
jenkins-bot
93a1fd20bd Merge "Support ActorStore::newSelectQueryBuilder with query flags" 2021-07-27 21:41:02 +00:00
Petr Pchelko
3158ba5dfb Move EditResultBuilder::findIdenticalRevision to RevStore
Additionally it switches the query from DB_PRIMARY to DB_REPLICA.
I understand the idea with a quick revert, but I do not think
it can be that quick - to revert a newest revision of a page,
an editor or a bot needs to actually read it first, and reads
come from a replica. So we know at least some replicas already
had the latest revision showing to the user. Very likely by the
time revert is made, we'd have it in all replicas. If not - oh well,
we can't be perfect. But we shouldn't really do such a query on
primary - it's too heavy.

Change-Id: I2fae8dbe5f19635f4d99e26242e3b08ddad8f8af
2021-07-25 07:36:31 -07:00
libraryupgrader
5357695270 build: Updating dependencies
composer:
* mediawiki/mediawiki-codesniffer: 36.0.0 → 37.0.0
  The following sniffs now pass and were enabled:
  * Generic.ControlStructures.InlineControlStructure
  * MediaWiki.PHPUnit.AssertCount.NotUsed

npm:
* svgo: 2.3.0 → 2.3.1
  * https://npmjs.com/advisories/1754 (CVE-2021-33587)

Change-Id: I2a9bbee2fecbf7259876d335f565ece4b3622426
2021-07-22 03:36:05 +00:00
Petr Pchelko
7e0246a89c Support ActorStore::newSelectQueryBuilder with query flags
Change-Id: Ia731415f627d72811cf7a354721bb0fb28b128eb
2021-07-21 15:32:44 +00:00
Tim Starling
bc76602493 DBMS-specific ResultWrapper subclasses
Cleanup after the switch of Database::query() to return ResultWrapper
instead of resource.

* Soft-deprecate the IResultWrapper accessors in IDatabase.
* Move relevant DBMS-specific functionality to ResultWrapper subclasses.
  The deprecated methods in IResultWrapper become short and simple.
  ResultWrapper is now abstract (b/c break).
* Move the implementation of fieldName(), numFields() and one of the
  fieldInfo() implementations to the ResultWrapper subclass in order to
  avoid ResultWrapper::unwrap() calls.
* Make Database::doQuery() return a ResultWrapper subclass instead of
  underlying result data, so that the Database parent class does not
  need to be aware of wrapper construction.
* Hard-deprecate ResultWrapper::unwrap(),
  DatabaseMysqlBase::fieldType(), DatabasePostgres::fieldType().
* Fix the inefficient seeking method in SQLite.
* Make FakeResultWrapper extend ResultWrapper with an implementation
  similar to the SQLite one. This is possible because ResultWrapper does
  not depend on IDatabase anymore.
* Resolve fixme in DatabasePostgres: from studying the source,
  neither pg_fetch_object() nor pg_num_rows() can set an error
  retrievable with pg_last_error(). Removed unnecessary warning
  suppression.
* ResultWrapperTest didn't make sense as a unit test anymore, so I
  adapted it as an integration test against the current DBMS.

This change also means that ResultWrapper::key() always gives the
correct offset, even if Iterator methods are not being used.

Bug: T286694
Change-Id: I935835316c0bd7d3d061bd8fde9c9ce99ce756ec
2021-07-21 06:54:26 -07:00
jenkins-bot
fe93ad5273 Merge "Add DummyServicesTrait::getDummyReadOnlyMode()" 2021-07-20 04:00:25 +00:00
Matěj Suchánek
166ed5cd95 BlockUser: Provide correct information to the post-block hook
Previously, BlockUser::placeBlockInternal attempted to insert
the new block with possible failure due to an existing block.
Regardless of the result, it would then retrieve the current
block which could be the just now inserted block. This one
was treated as the prior block and incorrectly provided to
the hook as such.

Refactor the method a little by retrieving the prior block
before attempting to insert a new one to make it more
efficient and to ensure the hook will have the correct value
for the prior block.

Change-Id: I70480ce32545f28f8317bb58f9c724d64cc54ccf
2021-07-17 12:26:14 +02:00
Petr Pchelko
0d75fdb4f7 Use CsrfTokenSet as CSRF token source
Change-Id: I079d2c802d9b48d6abf7f37fa9ef7dafac631345
2021-07-12 14:19:15 -07:00
DannyS712
32a37154f1 Move ApiWatchlistTraitTest back to unit tests
All dependencies are once again injected

Change-Id: I0c7d45fcb8d451a92dcf438a076a24cf231827d8
2021-07-06 20:37:45 +00:00
Umherirrender
d146800ee8 api: Inject services into ApiWatchlistTrait
Bug: T259960
Change-Id: I73596f8c924ec4a02a7042608d19a35f82bb752a
2021-07-06 20:15:30 +00:00
DannyS712
d290b63153 Add DummyServicesTrait::getDummyReadOnlyMode()
Returns an actual working ReadOnlyMode object
based on a ConfiguredReadOnlyMode and a mock
load balancer

Change-Id: I429c8e81343c24c536718b3fc112e797afbc05a2
2021-07-05 07:16:13 +00:00
DannyS712
b45ddb2ab3 Use WikiPage::doUserEditContent() instead of ::doEditContent()
Results in passing a user where previously the fallback
to $wgUser was being used, mostly in tests.

Bug: T255507
Change-Id: Iabe24315b23c0ad1272353186425e71974528d23
2021-06-28 00:11:30 -07:00
vladshapik
e991dff925 Hard-deprecate AbstractBlock::getTargetAndType() and getTarget()
Replace all uses of AbstractBlock::getTarget with
Block ::getTargetName and ::getTargetUserIdentity.
Create AbstractBlockTest and two test cases for
AbstractBlock::getTarget and ::getTargetAndType.
It tests triggering of the deprecation warning.

Bug: T282247
Depends-On: I0543f363af66c57f5763b91320d87a69f23f9466
Change-Id: Iaeca824cac30172178de72f3cf7b7ae4cdd6f880
2021-06-22 16:59:00 +03:00
Tim Starling
b4849e03b7 Use the unserialized form of image metadata internally
Image metadata is usually a serialized string representing an array.
Passing the string around internally and having everything unserialize
it is an awkward convention.

Also, many image handlers were reading the file twice: once for
getMetadata() and again for getImageSize(). Often getMetadata()
would actually read the width and height and then throw it away.

So, in filerepo:

* Add File::getMetadataItem(), which promises to allow partial
  loading of metadata per my proposal on T275268 in a future commit.
* Add File::getMetadataArray(), which returns the unserialized array.
  Some file handlers were returning non-serializable strings from
  getMetadata(), so I gave them a legacy array form ['_error' => ...]
* Changed MWFileProps to return the array form of metadata.
* Deprecate the weird File::getImageSize(). It was apparently not
  called by anything, but was overridden by UnregisteredLocalFile.
* Wrap serialize/unserialize with File::getMetadataForDb() and
  File::loadMetadataFromDb() in preparation for T275268.

In MediaHandler:

* Merged MediaHandler::getImageSize() and MediaHandler::getMetadata()
  into getSizeAndMetadata(). Deprecated the old methods.
* Instead of isMetadataValid() we now have isFileMetadataValid(), which
  only gets a File object, so it can decide what data it needs to load.
* Simplified getPageDimensions() by having it return false for non-paged
  media. It was not called in that case, but was implemented anyway.

In specific handlers:

* Rename DjVuHandler::getUnserializedMetadata() and
  extractTreesFromMetadata() for clarity. "Metadata" in these function
  names meant an XML string.
* Updated DjVuImage::getImageSize() to provide image sizes in the new
  style.
* In ExifBitmapHandler, getRotationForExif() now takes just the
  Orientation tag, rather than a serialized string. Also renamed for
  clarity.
* In GIFMetadataExtractor, return the width, height and bits per channel
  instead of throwing them away. There was some conflation in
  decodeBPP() which I picked apart. Refer to GIF89a section 18.
* In JpegMetadataExtractor, process the SOF0/SOF2 segment to extract
  bits per channel, width, height and components (channel count). This
  is essentially a port of PHP's getimagesize(), so should be bugwards
  compatible.
* In PNGMetadataExtractor, return the width and height, which were
  previously assigned to unused local variables. I verified the
  implementation by referring to the specification.
* In SvgHandler, retain the version validation from unpackMetadata(),
  but rename the function since it now takes an array as input.

In tests:

* In ExifBitmapTest, refactored some tests by using a provider.
* In GIFHandlerTest and PNGHandlerTest, I removed the tests in which
  getMetadata() returns null, since it doesn't make sense when ported to
  getMetadataArray(). I added tests for empty arrays instead.
* In tests, I retained serialization of input data since I figure it's
  useful to confirm that existing database rows will continue to be read
  correctly. I removed serialization of expected values, replacing them
  with plain data.
* In tests, I replaced access to private class constants like
  BROKEN_FILE with string literals, since stability is essential. If
  the class constant changes, the test should fail.

Elsewhere:

* In maintenance/refreshImageMetadata.php, I removed the check for
  shrinking image metadata, since it's not easy to implement and is
  not future compatible. Image metadata is expected to shrink in
  future.

Bug: T275268
Change-Id: I039785d5b6439d71dcc21dcb972177dba5c3a67d
2021-06-08 17:04:01 +10:00
Roman Stolar
67cc77312f Update DatabaseBlock construct option 'by' and 'byText' usage to use User Identity only
Bug: T283641
Change-Id: Ic6d4a6e10bda0115c87a85d8a9ddfd4098cd1373
2021-06-02 17:01:32 +03:00
Tim Starling
2fdbdff4f8 Add test for MWFileProps
Change-Id: I6bce2419145b8f7162051880bc9db69463059ece
2021-05-26 14:37:45 +00:00
Alexander Vorwerk
def29c6d06 ActorStore: avoid throwing in case of invalid usernames
When an username cannot be a valid actor,
ActorStore::newUserIdentityByName() should return null instead of
throwing an Exception.

Bug: T283167
Change-Id: Id04978cf2a417f2354d5e336ed1b0b67462603e9
2021-05-19 20:30:55 +00:00
jenkins-bot
3d7868059d Merge "RevisionDeleter: Use PageIdentity instead of Title" 2021-05-10 13:41:25 +00:00
jenkins-bot
b6fea99341 Merge "DatabaseBlockStore: fetch correct ActorNormalization" 2021-05-10 09:13:12 +00:00
daniel
2a1087fa40 RevisionDeleter: Use PageIdentity instead of Title
RevDelList for now still uses a Title internally.

Change-Id: Id839ac697bd742e908f465cf5330da486dc73111
2021-05-06 13:42:13 +02:00
jenkins-bot
d58e417207 Merge "Eliminate use of Title object in REST infrastructure" 2021-05-06 08:40:46 +00:00
Petr Pchelko
4ca16e8d08 Eliminate use of Title object in REST infrastructure
Change-Id: I585f0f23cac5f6dc2a4879f69f7b83828fda3dd3
2021-05-05 18:54:58 -07:00
Aaron Schulz
99d5d2e8cc rdbms: cleanup getServer() and connection parameter fields in Database
Make getServer() always return a string, as documented, even with new
Database::NEW_UNCONNECTED handles that have yet to call open(). If the
'host' parameter to __construct() is ''/null, getServer() now returns
'localhost' instead of null. This avoids problems like fatal errors in
calls to TransactionProfiler::recordConnection().

Use Database constants for "connectionParams" field keys for better
static analysis.

Also:
* Add Database::getServerName() method that returns "readable" server
  names in the style of LoadBalancer::getServerName(). Note that the
  "hostName" field is already passed in from LoadBalancer.
* Migrate most getServer() callers to getServerName() for easier
  debugging and more readable logging.
* Also, normalize Database/LoadBalancer SPI logging context to use
  "db_server" and reduce logging code duplication in LoadBalancer.

Bug: T277056
Change-Id: I00ed4049ebb45edab1ea07561c47e226a423ea3b
2021-05-05 19:44:02 +00:00
Petr Pchelko
7ba9cbcac7 DatabaseBlockStore: fetch correct ActorNormalization
DatabaseBlockStore is capable of inserting cross-wiki
DatabaseBlock, which works via passing non-local IDatabase.
Ideally, we'd want to make Block a WikiAwareEntity, have
cross-wiki DatabaseBlockStore, etc. But as a quick-fix for
a regression we can just fetch correct ActorNormalization

Bug: T281972
Change-Id: I796f54b7b7303b8c442d5b9ba1926b76d3805fb5
2021-05-05 13:13:20 +02:00
jenkins-bot
5127fe1b43 Merge "Add MediaWikiIntegrationTestCase::runJobs() and use it" 2021-05-05 03:15:17 +00:00
Tim Starling
0e05879d7e Add MediaWikiIntegrationTestCase::runJobs() and use it
JobRunner catches all exceptions and hides them in the status array,
meaning that it is not obvious when a job fails during a test case.
So, introduce MediaWikiIntegrationTestCase::runJobs(), which runs jobs
and asserts various things about the returned status array.

Depends-On: I4f4790c5d16a0767790eeff202e0be8fcdaeda93
Depends-On: I118f9e3f8950fd82d7b02baed6705b29fd6ab7d5
Change-Id: I63603aa158f77df4b40add096cb248f3b24979f4
2021-05-05 02:51:30 +00:00
DannyS712
41287e87d8 Add MediaWikiTitleCodec and NamespaceInfo to DummyServicesTrait
Move MockTitleTrait::makeMockTitleCodec to DummyServicesTrait, and
replace the two existing uses, which are in core. Add some new
uses instead of mocking each time.

Unfortunately, we cannot use an actual MediaWikiTitleCodec
for the tests in BadFileLookup, because those tests are unit tests
and a MalformedTitleException cannot be created in the context
of a unit test. BadFileLookupTest gets around this by using
a mock that throws a mock exception - add a comment inline
explaining why we cannot use a real MediaWikiTitleCodec.

Paired with adding of NamespaceInfo to make mocking the language
methods related to namespaces easier by matching the real
logic in the Language class to the extend possible. Update a few
tests to use the DummyServicesTrait for their NamespaceInfo services.

Change-Id: Ibd691ccf0e632e1bf0bc1f7e9ddc0c660d5cad32
2021-05-04 19:10:23 +00:00
jenkins-bot
efb73d0649 Merge "ActorStore: Always canonicalize provided user name" 2021-05-03 09:58:09 +00:00
James D. Forrester
64898405cb build: Upgrade mediawiki-codesniffer from v35.0.0 to v36.0.0
Change-Id: I8905d0d69738a1cd6997c104080fdf128d315e8b
2021-04-29 13:00:15 -07:00
James D. Forrester
df5eb22f83 Replace uses of DB_MASTER with DB_PRIMARY
Just an auto-replace from codesniffer for now.

Change-Id: I5240dc9ac5929d291b0ef1c743ea2bfd3f428266
2021-04-29 09:24:31 -07:00
Petr Pchelko
f870ea5232 ActorStore: Always canonicalize provided user name
We don't actually know where is the given user name coming from
and whether it's been normalized before hitting the storage layer,
so always check if it's a valid user name.

Bug: T273933
Change-Id: Ie9848188c81c95bedff9d18e6398bd3511c459e4
2021-04-29 06:34:03 -07:00
Petr Pchelko
8ef1a98260 Add ActorStore::deleteActor
This is an extremely dangerous method, but it's needed
for the temporary users magic in translate extension.
At least going via ActorStore we can keep our in-process
caches consistent and get rid of some static methods
and caching in user object.

Change-Id: I8157f7ccee7d72aee405e9b6109dfc1838e1f380
2021-04-29 05:13:55 -07:00
Petr Pchelko
f50c097b9a Keep ActorStore caches consistent on user rename
Multi-key in-memory keys for the actors is complicated
enough to have it's own small abstraction.

Change-Id: Id0e091504b71a44ce52d418c5737d64ac70495e9
2021-04-26 14:02:00 -07:00
DannyS712
633ec93a8c Clean up WatchlistManager tests
Most of the code in WatchlistManager does not depend
on integration logic, with the exception of
- ::clearTitleUserNotifications adding a DeferredUpdate

- ::addWatch and ::removeWatch using
User::newFatalPermissionDeniedStatus, which uses
MediaWikiServices

Move the majority of the rest to the unit tests, except
for an integration test of the overall basic functionality
that we leave to make sure that the integration with the
actual services works properly.

Also take this opportunity to document why the integration
tests left behind need to be integration test, and fix
the name of some tests to addWach/removeWatch instead of
the old doWatch/doUnwatch.

Explicitely add 'watchlist' to the tables used by the
integration test.

Change-Id: I899ef1618c59c179ed2591149b93969fd935276d
2021-04-23 17:19:34 +00:00
Thiemo Kreuz
f10f4e05de Remove some meaningless $this->equalTo() from tests
This is the default behavior anyway when using ->with().

Change-Id: I64b6474280eb7da122eb22fc0afa28cca81e96c5
2021-04-22 10:47:54 +02:00
Cindy Cicalese
fb6b6e058c Fix parameter order of setWatch to match add/removeWatch
Change-Id: I0ea63482a5cab24c23b49b8bbe6c80bdbe8b102b
2021-04-21 04:41:38 +00:00
Cindy Cicalese
b242d49a62 Use WatchlistManager in API classes
Change-Id: I7b2016162e86b455c0102742751981c44d7e829c
2021-04-21 04:41:06 +00:00
Cindy Cicalese
f8ed11e170 Replace doWatch/doUnwatch with addWatch*/removeWatch*
Change-Id: I8882bc24b178ea49198bed5fb206e1a8ea0a4f30
2021-04-20 22:46:07 -04:00
jenkins-bot
b72b2973b0 Merge "Move watchlist-related methods from WatchAction to WatchlistManager" 2021-04-21 02:13:17 +00:00
Cindy Cicalese
577824ae7f Move watchlist-related methods from WatchAction to WatchlistManager
Deprecate the watchlist-related methods in WatchAction.

Change-Id: Id235cc483e2f1f3a432e2c26aebc48ae6cd73a0b
2021-04-20 21:44:54 -04:00