Commit graph

239 commits

Author SHA1 Message Date
Aryeh Gregor
666ca1bdf3 Use MainConfigNames instead of string literals, #2
This covers all occurrences of /onfig->.*get( '/ in includes/.
Undoubtedly there are still plenty more to go.

Change-Id: I33196c4153437778496f40436bcde399638ac361
2022-04-13 18:55:46 +03:00
Amir Sarabadani
627c1c2c30 Allow setting max execution time to several special pages
These special pages and their counter-part APIs are:
 - Special:RecentChanges
 - Special:Watchlist
 - Special:Log
 - Special:Contributions

This also changes the way MAX_EXECUTION_TIME works from taking the value
as milliseconds, it takes seconds which is more intuitive for users.

Bug: T297708
Depends-On: I126e7181422d8da1a63afc3717faa4f72a687dd9
Change-Id: I3ff78751c3df3b6342f1865d35c2075f4415185d
2021-12-15 22:59:06 +01:00
Tim Starling
f7f84dddb3 Introduce CommentFormatter
CommentParser:

* Move comment formatting backend from Linker to a CommentParser service.
  Allow link existence and file existence to be batched.
* Rename $local to $samePage since I think that is clearer.
* Rename $title to $selfLinkTarget since it was unclear what the title
  was used for.
* Rename the "autocomment" concept to "section link" in public
  interfaces, although the old term remains in CSS classes.
* Keep unsafe HTML pass-through in separate "unsafe" methods, for easier
  static analysis and code review.

CommentFormatter:

* Add CommentFormatter and RowCommentFormatter services as a usable
  frontend for comment batches, and to replace the Linker static methods.
* Provide fluent and parametric interfaces.

Linker:

* Remove Linker::makeCommentLink() without deprecation -- nothing calls
  it and it is obviously an internal helper.
* Soft-deprecate Linker methods formatComment(), formatLinksInComment(),
  commentBlock() and revComment().

Caller migration:

* CommentFormatter single: Linker, RollbackAction, ApiComparePages,
  ApiParse
* CommentFormatter parametric batch: ImageHistoryPseudoPager
* CommentFormatter fluent batch: ApiQueryFilearchive
* RowCommentFormatter sequential: History feed, BlocklistPager,
  ProtectedPagesPager, ApiQueryProtectedTitles
* RowCommentFormatter with index: ChangesFeed, ChangesList,
  ApiQueryDeletedrevs, ApiQueryLogEvents, ApiQueryRecentChanges
* RevisionCommentBatch: HistoryPager, ContribsPager

Bug: T285917
Change-Id: Ia3fd50a4a13138ba5003d884962da24746d562d0
2021-09-28 11:13:03 -07:00
Petr Pchelko
8d7201894c Drop action api token methods deprecated in 1.24
Removes deprecated API endpoints and modules for dealing with
CSRF tokens.

Note: i18n messages are removed in a followup for ease of revert.

Bug: T280806
Depends-On: Ic83f44587db119ff2e3e6d5ff33a10894e0695e7
Change-Id: I58aedec6942ac5d3c21574cb0072f00ef365098c
2021-09-13 15:22:16 +00:00
jenkins-bot
e89e7aa8b0 Merge "Revert "Use CsrfTokenSet as CSRF token source"" 2021-08-05 23:37:31 +00:00
Kunal Mehta
a85f569dd1 Revert "Use CsrfTokenSet as CSRF token source"
This reverts commit 0d75fdb4f7.

Bug: T287542
Change-Id: Iedd3461869f973f8d621a39e6ad4674cbb577551
2021-08-05 15:48:26 -07:00
Umherirrender
e771db4274 api: list=recentchanges user param must not be an object
Avoid implicit User::__toString

Change-Id: Ia2d13c7127834b9bc2d59e31c8b231edd66f5e93
2021-08-06 00:28:00 +02:00
Petr Pchelko
0d75fdb4f7 Use CsrfTokenSet as CSRF token source
Change-Id: I079d2c802d9b48d6abf7f37fa9ef7dafac631345
2021-07-12 14:19:15 -07:00
Umherirrender
1810658dc1 api: Inject services into ApiQueryRecentChanges
Bug: T259960
Change-Id: Ifab55daae08ee49e07bef93656cb7eb474f46cae
2021-07-03 20:50:09 +02:00
Tim Starling
9c3c0b704b Use array_fill_keys() instead of array_flip() if that reflects the developer's intention
array_fill_keys() was introduced in PHP 5.2.0 and works like
array_flip() except that it does only one thing (copying keys) instead
of two things (copying keys and values). That makes it faster and more
obvious.

When array_flip() calls were paired, I left them as is, because that
pattern is too cute. I couldn't kill something so cute.

Sometimes it was hard to figure out whether the values in array_flip()
result were used. That's the point of this change. If you use
array_fill_keys(), the intention is obvious.

Change-Id: If8d340a8bc816a15afec37e64f00106ae45e10ed
2021-06-15 00:11:10 +00:00
Tim Starling
fd01c53778 Stop using legacy ActorMigration field "rc_user"
Bug: T278917
Change-Id: I4d6c175c637a2cb26c63e0b2b27d5ea8ce6b1e0d
2021-04-28 16:29:04 +10:00
DannyS712
523342c781 Inject CommentStore service into api query modules
- ApiQueryBlocks
- ApiQueryDeletedrevs
- ApiQueryFilearchive
- ApiQueryLogEvents
- ApiQueryProtectedTitles
- ApiQueryRecentChanges
- ApiQueryUserContribs
- ApiQueryWatchlist

Bug: T259960
Change-Id: Ib7ee815fcea3e72523124eb6a2eaf20ad9565cfe
2021-04-23 15:09:48 +00:00
Cindy Cicalese
f6e1891c6f Use Authority and GroupPermissionLookup in Action API
Replaces calls directly to PermissionManager with calls to
the Authority object available from Context or the
GroupPermissionLookup service.

This patch does not address use of PermissionManager for
blocks.

Deprecations:
- ApiBase::checkUserRightsAny deprecated passing optional
User parameter
- ApiBase::checkTitleUserPermissions deprecated passing
LinkTarget as first parameter, takes PageIdentity instead

Bug: T271462
Bug: T271854
Change-Id: I5d7cac1c28a37e074750c46cda03283980a07fca
2021-02-23 14:31:14 +00:00
Umherirrender
083a0e57cb Improve docs in api related classes
Change-Id: I78338d48530f098fa5d36fe84cfd45c0d160f444
2020-11-13 23:11:06 +01:00
Thiemo Kreuz
08cf4c49df Add PHPDoc documentation to all API query module constructors
Change-Id: I2bc140576efc891bb9b6e50e44041d5bb022ac8f
2020-10-27 19:16:41 +00:00
DannyS712
5f076458dd Remove uses of $wgUser in api token methods
Bug: T243708
Change-Id: I2f82af8c3413038fa321434759dc9e9a921e3118
2020-09-09 23:56:17 +00:00
DannyS712
a7d5f4055d Remove deprecated api token hooks
Hooks removed:
APIQueryInfoTokens
APIQueryRecentChangesTokens
APIQueryRevisionsTokens
APIQueryUsersTokens
ApiTokensGetTokenTypes

Bug: T248022
Change-Id: Ieae43b05e7ba4853a3b6c7e2b03197e85a8d3579
2020-09-08 17:08:21 +00:00
Tim Starling
68c433bd23 Hooks::run() call site migration
Migrate all callers of Hooks::run() to use the new
HookContainer/HookRunner system.

General principles:
* Use DI if it is already used. We're not changing the way state is
  managed in this patch.
* HookContainer is always injected, not HookRunner. HookContainer
  is a service, it's a more generic interface, it is the only
  thing that provides isRegistered() which is needed in some cases,
  and a HookRunner can be efficiently constructed from it
  (confirmed by benchmark). Because HookContainer is needed
  for object construction, it is also needed by all factories.
* "Ask your friendly local base class". Big hierarchies like
  SpecialPage and ApiBase have getHookContainer() and getHookRunner()
  methods in the base class, and classes that extend that base class
  are not expected to know or care where the base class gets its
  HookContainer from.
* ProtectedHookAccessorTrait provides protected getHookContainer() and
  getHookRunner() methods, getting them from the global service
  container. The point of this is to ease migration to DI by ensuring
  that call sites ask their local friendly base class rather than
  getting a HookRunner from the service container directly.
* Private $this->hookRunner. In some smaller classes where accessor
  methods did not seem warranted, there is a private HookRunner property
  which is accessed directly. Very rarely (two cases), there is a
  protected property, for consistency with code that conventionally
  assumes protected=private, but in cases where the class might actually
  be overridden, a protected accessor is preferred over a protected
  property.
* The last resort: Hooks::runner(). Mostly for static, file-scope and
  global code. In a few cases it was used for objects with broken
  construction schemes, out of horror or laziness.

Constructors with new required arguments:
* AuthManager
* BadFileLookup
* BlockManager
* ClassicInterwikiLookup
* ContentHandlerFactory
* ContentSecurityPolicy
* DefaultOptionsManager
* DerivedPageDataUpdater
* FullSearchResultWidget
* HtmlCacheUpdater
* LanguageFactory
* LanguageNameUtils
* LinkRenderer
* LinkRendererFactory
* LocalisationCache
* MagicWordFactory
* MessageCache
* NamespaceInfo
* PageEditStash
* PageHandlerFactory
* PageUpdater
* ParserFactory
* PermissionManager
* RevisionStore
* RevisionStoreFactory
* SearchEngineConfig
* SearchEngineFactory
* SearchFormWidget
* SearchNearMatcher
* SessionBackend
* SpecialPageFactory
* UserNameUtils
* UserOptionsManager
* WatchedItemQueryService
* WatchedItemStore

Constructors with new optional arguments:
* DefaultPreferencesFactory
* Language
* LinkHolderArray
* MovePage
* Parser
* ParserCache
* PasswordReset
* Router

setHookContainer() now required after construction:
* AuthenticationProvider
* ResourceLoaderModule
* SearchEngine

Change-Id: Id442b0dbe43aba84bd5cf801d86dedc768b082c7
2020-05-30 14:23:28 +00:00
DannyS712
e9b012f3b1 Hard-deprecate api hooks for getting tokens
Soft deprecated in 1.24
The following hooks were hard deprecated:
* APIQueryInfoTokens
* APIQueryRecentChangesTokens
* APIQueryRevisionsTokens
* APIQueryUsersTokens
* ApiTokensGetTokenTypes

Bug: T232869
Bug: T232870
Bug: T232871
Bug: T232872
Bug: T232873
Bug: T245329
Change-Id: Ia14eae17b676ee0356eaf0679d8ac3af0b24b86a
2020-03-14 20:35:04 +00:00
Tim Starling
a06e3d06b1 Fix some PHPStorm inspection warnings in includes/api
Notably:
* In ApiManageTags, I used a switch instead of a dynamic function name,
  so that the call graph will be correct.
* In ApiImageRotate, checkTitleUserPermissions() has always returned
  void, this was an error introduced in 4e6810e4a2

Change-Id: Iea22616b8e7e2e0cc804619a54f8690898b2cb82
2020-02-18 14:17:37 -05:00
Brad Jorsch
c2b1525908 API: Use ParamValidator library
This brings significant modularization to the Action API's parameter
validation, and allows the Action API and MW REST API to share
validation code.

Note there are several changes in this patch that may affect other code;
see the entries in RELEASE-NOTES-1.35 for details.

Bug: T142080
Bug: T232672
Bug: T21195
Bug: T34675
Bug: T154774
Change-Id: I1462edc1701278760fa695308007006868b249fc
Depends-On: I10011be060fe6d27c7527312ad41218786b3f40d
2020-02-04 13:36:14 -05:00
James D. Forrester
0958a0bce4 Coding style: Auto-fix MediaWiki.Usage.IsNull.IsNull
Change-Id: I90cfe8366c0245c9c67e598d17800684897a4e27
2020-01-10 14:17:13 -08:00
jenkins-bot
5afbc90670 Merge "Add 'slot' param for recentchanges API query" 2019-12-03 20:51:23 +00:00
Cormac Parle
b4c7426a3f Add 'slot' param for recentchanges API query
Pass 'rcslot' as a param for the recent changes API to
only get changes (incl. reverts) for the specified slot

Bug: T230862
Change-Id: Iae53b1b22515116c61318ebe5ad3550c45554484
2019-11-25 12:54:47 +00:00
Umherirrender
731d9f748e Run GenderCache for api query modules using ApiQueryBase::addTitleInfo
When converting a Title object into a string for user or user talk
namespace the gender information are needed.

This patch set improves performance on wikis with gender distinction
like dewiki or ruwiki by combining the fetch of the information into one
query and avoids a query per unique user name.
It also avoids false results for request with apihighlimit, because the
apihighlimit with 5000 is higher than the query max limit of the
GenderCache with 1000

Bug: T200238
Change-Id: Ibe0561b210dbeb654117dad777e839640f51b4e4
2019-11-02 22:23:23 +01:00
Petr Pchelko
fd130247c2 Deprecate and replace usages of User:isAllowed{All,Any}
Bug: T220191
Change-Id: I197b8fadaa93e7b320fc19c10e3e09387fe09ad2
2019-08-21 18:36:16 -07:00
Petr Pchelko
1d286560d2 Replace User::isAllowed with PermissionManager.
Covers root includes, actions, api, block, changes,
changetags, diff and PermissionManager itself.

Bug: T220191
Change-Id: Ic027d32f5dd8f4c74865df0c8a9fcf91123c889c
2019-08-20 14:43:51 -07:00
Timo Tijhof
5aa9ba58ea API: Always select rc_user from database (regardless of rcprop=user)
Bug: T228425
Change-Id: I1b6f684c8289282326da0e326b90fcf8ff87d71e
2019-07-31 13:45:34 +00:00
Lucas Werkmeister
178b7ad6a4 SECURITY: Fix cache mode for (un)patrolled recent changes query
Restricting the list of recent changes to patrolled, not patrolled,
autopatrolled, not autopatrolled, or unpatrolled recent changes requires
special permissions (as does displaying that status in the properties of
returned entries), but we only set the cache mode to private in the
first two cases.

Bug: T212118
Change-Id: I4c3fe6e47f80ebf97fa37875c704328d08772d26
2019-06-06 16:54:29 +00:00
Aaron Schulz
cb15755e92 Normalize use of "INNER JOIN" to "JOIN" in database queries
The ANSI SQL default join type is INNER and this might save
some line breaks here and there.

Change-Id: Ibd39976f46ca3f9b71190d3b60b76ca085787a00
2019-03-06 09:17:30 -08:00
Reedy
4691389fa4 Use (int) rather than intval()
Bug: T216969
Change-Id: I4c06716c83b69d128f26fa7f68736808aa2d3d64
2019-02-25 00:38:33 +00:00
Kunal Mehta
cc5d9a92a2 build: Updating mediawiki/mediawiki-codesniffer to 24.0.0
Change-Id: I66b1775b7c1d36076d9ca78cbeb42787a743f2aa
2019-02-07 18:39:42 +00:00
jenkins-bot
85fa38d0b7 Merge "Migrate Api modules from tag_summary table to change_tag" 2018-11-30 19:13:46 +00:00
Amir Sarabadani
02a930d7fb Drop $wgChangeTagsSchemaMigrationStage
Bug: T194163
Change-Id: Ieb6cc60cacf9dd0d86641b1be817249cdce42112
2018-11-28 23:03:41 +01:00
Amir Sarabadani
c91cc078bf Migrate Api modules from tag_summary table to change_tag
Bug: T209525
Change-Id: I7624d86bbff675eab7fee97adf3b7e2e6753f81d
2018-11-27 18:12:06 +01:00
Brad Jorsch
dff469a408 Re-namespace RevisionStore and RevisionRecord classes
During development a lot of classes were placed in MediaWiki\Storage\.
The precedent set would mean that every class relating to something
stored in a database table, plus all related value classes and such,
would go into that namespace.

Let's put them into MediaWiki\Revision\ instead. Then future classes
related to the 'page' table can go into MediaWiki\Page\, future classes
related to the 'user' table can go into MediaWiki\User\, and so on.

Note I didn't move DerivedPageDataUpdater, PageUpdateException,
PageUpdater, or RevisionSlotsUpdate in this patch. If these are kept
long-term, they probably belong in MediaWiki\Page\ or MediaWiki\Edit\
instead.

Bug: T204158
Change-Id: I16bea8927566a3c73c07e4f4afb3537e05aa04a5
2018-10-09 10:22:48 -04:00
Amir Sarabadani
0841a0f79e API: Use ct_tag_id in queries when applicable
Bug: T194162
Change-Id: I2146cd1f72b546277723102ab64c79567549ff5b
2018-09-04 22:22:29 +02:00
Brad Jorsch
07842be379 API: Update query modules for MCR
MCR deprecated the Revision class in favor of the broadly similar
RevisionRecord, and more interestingly added the concept of multiple
content "slots" to revisions.

Thus, prop=revisions, prop=deletedrevisions, and so on gain a parameter
to specify which slots are wanted. When this new parameter is not
specified (and any content-related props are specified), a warning about
the legacy format will be issued.

The rest of the modules just needed to call methods or use constants on
RevisionRecord instead of Revision. ApiQueryDeletedrevs wasn't touched,
since it has been deprecated since 1.25 anyway.

This also updates a few non-query modules that don't depend on details
of editing, diffing, or viewing MCR revisions that haven't been figured
out yet.

Bug: T200568
Change-Id: I1327d1784f5cedb006cd74df834cf9a560a77a5d
2018-07-27 23:33:45 +00:00
Umherirrender
130ec2523d Fix PhanTypeMismatchDeclaredParam
Auto fix MediaWiki.Commenting.FunctionComment.DefaultNullTypeParam sniff

Change-Id: I865323fd0295aabd06f3e3c75e0e5043fb31069e
2018-07-07 00:34:30 +00:00
jenkins-bot
b37772a991 Merge "Add ability to filter based on rc_title in API" 2018-05-24 10:13:06 +00:00
Amir Sarabadani
00a4f0939c Replace rc_patrolled values with contants, part I
This constants has been recently introduced and it's good to use them

Change-Id: I8ce56dc95de3e49610dca71c00965ca1ac74bcf0
2018-04-11 22:35:31 +02:00
Amir Sarabadani
728321e113 Make autopatrol third option in rc_patrolled and use it in API
Bug: T184791
Change-Id: If64ba8b845b122a87f20646dddf72ef257b793cb
2018-04-03 18:44:37 +02:00
Amir Sarabadani
4158cb5b9b Add ability to filter based on rc_title in API
Bug: T57377
Change-Id: I0b14bde58a4012816f2998d663d88ab035c927b7
2018-03-16 14:58:52 +01:00
Brad Jorsch
27c61fb1e9 Add actor table and code to start using it
Storing the user name or IP in every row in large tables like revision
and logging takes up space and makes operations on these tables slower.
This patch begins the process of moving those into one "actor" table
which other tables can reference with a single integer field.

A subsequent patch will remove the old columns.

Bug: T167246
Depends-On: I9293fd6e0f958d87e52965de925046f1bb8f8a50
Change-Id: I8d825eb02c69cc66d90bd41325133fd3f99f0226
2018-02-23 10:06:20 -08:00
addshore
e5879da149 Pass $key into CommentStore methods and use MediawikiServices
This allows CommentStore to be added to MediaWikiServices
without the need of an aditional Factory.

This change includes a compatability layer to allow the behaviour
from 1.30 to continue to be used while deprecated.

CommentStore::newKey has been deprecated.
Keys are now passed into the public methods of CommentStore
where needed.
The following CommentStore methods have had their signatures changed
to introduced a $key parameter, but when used in conjunction with
CommentStore::newKey behaviour will remain unchanged:
  * CommentStore::getFields
  * CommentStore::getJoin
  * CommentStore::getComment
  * CommentStore::getCommentLegacy
  * CommentStore::insert
  * CommentStore::insertWithTemplate

Change-Id: I3abb62a5cfb0dcd456da9f4eb35583476ae41cfb
2018-02-05 15:34:12 +00:00
Umherirrender
3124a990a2 Use ::class to resolve class names in includes files
This helps to find renamed or misspelled classes earlier.
Phan will check the class names

Change-Id: I07a925c2a9404b0865e8a8703864ded9d14aa769
2018-01-27 20:34:29 +01:00
Umherirrender
c9d303d39e Remove "Created on" from file header comments
It is the job of git and svn to provide this information/metadata.
The form was different, some with short, some with long month name
some with leading zero at the day, some without.
The year is also present in the Copyright clause

Change-Id: If006907b82b9e45f13cfa2e45d41107a95570e1a
2018-01-26 23:12:40 +00:00
Brad Jorsch
5ec0132821 ApiQueryRecentChanges: Fetch comment fields if rctoken is used
When the deprecated rctoken parameter is used, the module calls
RecentChange::newFromRow(), which now requires that the comment fields
be present.

Bug: T175307
Change-Id: Ida025f419e43809c34fff386f1a1ee8881393b80
2017-09-07 16:58:57 -04:00
Brad Jorsch
11cf01dd9a Add comment table and code to start using it
A subsequent patch will remove the old columns.

Bug: T166732
Change-Id: Ic3a434c061ed6e443ea072bc62dda09acbeeed7f
2017-08-30 15:05:00 +10:00
Baha
036b9c4167 Make API documentation links language aware
Links generated by the API are now aware of the user's preferred
language and will show documents in that language if available.

To test, log in to mediawiki.org and set your language preference to 'es',
then on an MediaWiki installation with this patch view the generated
expanded API help at `api.php?action=help&recursivesubmodules=1&modules=main`.
Each link to documentation on mediawiki.org should take you to its
translated /es subpage, if one exists.

Bug: T104518
Change-Id: I339a1f3ae1bce9d759cf251899d57c32b1def91e
2017-04-05 11:08:25 -04:00