Commit graph

4801 commits

Author SHA1 Message Date
Brian Wolff
99485235b0 API: When undoing an edit, allow overriding content model.
This brings the API in line with web UI changes from Ic528f65d.

Bug: T145044
Change-Id: Ib97eef38d228c4da4b062ee96ddbbbb926ee665b
2016-09-08 20:19:45 -07:00
Translation updater bot
94a5679cbe Localisation updates from https://translatewiki.net.
Change-Id: I11dbcc26b7ee18146c907c309bbc67ba4ccc9339
2016-09-08 23:10:04 +02:00
jenkins-bot
5b0aaf1fc5 Merge "Fix ApiStashEdit IDEA warnings" 2016-09-07 20:23:16 +00:00
Translation updater bot
7dac7a5903 Localisation updates from https://translatewiki.net.
Change-Id: Ib4a52f1616cdf4ed928731f1341e094a7f35092b
2016-09-07 22:08:41 +02:00
Aaron Schulz
ae648472b0 Fix ApiStashEdit IDEA warnings
Change-Id: Icc1d0225908e432df10c36d69c6ed282f8761198
2016-09-07 12:00:52 -07:00
Brad Jorsch
40e1070c32 API: Fix query+authmanagerinfo example message names
When code was copy-pasted to create the module, apparently the messages
didn't get renamed correctly.

Change-Id: I1bab2ed5a2b014602b6c3dc1e53a4ce53f78fa6f
2016-09-06 16:35:29 -04:00
Translation updater bot
609cc5702d Localisation updates from https://translatewiki.net.
Change-Id: I53d6598a7fdfc5af3b1afd61c182dc0e6491808d
2016-09-06 22:09:23 +02:00
jenkins-bot
f6c8b955bd Merge "Add API warnings when upload is same as older versions" 2016-09-06 18:55:02 +00:00
Matthias Mullie
4e50971b32 Add API warnings when upload is same as older versions
Bug: T141822
Change-Id: I115d84d865c59200dbb60bd962c093185c9afafe
2016-09-06 18:43:00 +00:00
Aaron Schulz
57e19b610d Renamed some variables from "slave" to "replica"
Change-Id: I455278294cd7ea344d14a76ac5957ece2e07fbf3
2016-09-05 23:03:01 -07:00
Aaron Schulz
950cf6016c Rename DB_SLAVE constant to DB_REPLICA
This is more consistent with LoadBalancer, modern, and inclusive
of master/master mysql, NDB cluster, and MariaDB galera cluster.

The old constant is an alias now.

Change-Id: I0b37299ecb439cc446ffbe8c341365d1eef45849
2016-09-05 22:55:53 -07:00
Aaron Schulz
16266edff3 Change "slave" => "replica DB" in /includes
Change-Id: Icb716219c9335ff8fa447b1733d04b71d9712bf9
2016-09-05 21:01:01 +00:00
Translation updater bot
fb962d346e Localisation updates from https://translatewiki.net.
Change-Id: Ib2530497c22f021d77f3838f9b1b6d3043cc51bc
2016-09-04 21:56:54 +02:00
Translation updater bot
623149a2cc Localisation updates from https://translatewiki.net.
Change-Id: Ib9a3add2d9502cfa52a9a464b92c21633028cca0
2016-09-03 23:50:07 +02:00
Translation updater bot
f55ffbfafd Localisation updates from https://translatewiki.net.
Change-Id: I22dc4d60a502074f810a7ef5b704dd7bda05801f
2016-09-02 22:15:53 +02:00
Chad Horohoe
e0b6c735a8 Don't mention $wgUser, it's ugly and it messes my grep-fu
Change-Id: Ic2b181a9f22f172aa8845a2e13bafa6142469ec4
2016-09-02 11:15:28 -07:00
Aaron Schulz
dc0cdc8a4d Make DeferredUpdates able to run DataUpdates
* Also make ErrorPageError exceptions display themselves
  in PRESEND mode. Before they were always suppressed.
* Make DataUpdate::runUpdates() simply wrap
  DeferredUpdates::execute().
* Remove unused installDBListener() method, which was
  basically moved to Maintenance.
* Enable DBO_TRX for DeferredUpdates::execute() in CLI mode
* Also perform sub-DeferrableUpdate jobs right after their
  parent for better transaction locality.
* Made rollbackMasterChangesAndLog() clear all master
  transactions/rounds, even if there are no changes yet.
  This keeps the state cleaner for continuing.
* For sanity, avoid calling acquirePageLock() in link updates
  unless the transaction ticket is set. These locks are
  already redundant and weaker in range than the locks the
  Job classes that run them get. This helps guard against
  DBTransactionError.
* Renamed $type to $stage to be more clear about the order.

Change-Id: I1e90b56cc80041d70fb9158ac4f027285ad0f2c9
2016-09-02 04:12:50 +00:00
Translation updater bot
1b67dc0885 Localisation updates from https://translatewiki.net.
Change-Id: Ib4393e8374d2b6596a461934e7a5a0f15a88e292
2016-09-01 22:08:52 +02:00
jenkins-bot
dc1a06b939 Merge "ApiParamInfo: Allow fetching info for all submodules of a module" 2016-09-01 00:56:19 +00:00
Translation updater bot
93e39eba6f Localisation updates from https://translatewiki.net.
Change-Id: I94ec22fbff6255c613997c008e185def799495ad
2016-08-31 21:57:45 +02:00
Brad Jorsch
be5c2ca017 ApiParamInfo: Allow fetching info for all submodules of a module
This allows fetching info for all query submodules with modules=query+*,
and info for all modules recursively with modules=main|main+**.

Bug: T28680
Change-Id: Icca5d2fda39d9d43fe20d77e34779412cec77aad
2016-08-31 15:27:07 -04:00
Brad Jorsch
e7be66b4d7 ApiQueryAllDeletedRevisions: More namespace handling fixes
* If the user specifically requests an empty list of namespaces, they
  should get no pages.
* `ar_namespace` should always be in the query so MySQL can do a range
  search instead of a full index scan.
* The example provided didn't match its description.

Bug: T89665
Change-Id: I91afc25db488f75c7f2b1ef343766b4bd7da5472
2016-08-31 13:19:13 -04:00
Translation updater bot
4e9392dc50 Localisation updates from https://translatewiki.net.
Change-Id: I197f28fb1bb4507234a7f534160f017db2476598
2016-08-30 22:04:17 +02:00
jenkins-bot
81100ad05b Merge "API: Warn when input parameters are normalized" 2016-08-30 01:46:36 +00:00
jenkins-bot
837f40d6be Merge "API: Use U+001F (Unit Separator) for separating multi-valued parameters" 2016-08-30 01:45:03 +00:00
jenkins-bot
8c807b8f1f Merge "Remove Block::purgeExpired() call from block query API" 2016-08-29 16:30:15 +00:00
Aaron Schulz
0bf5f49f14 Remove Block::purgeExpired() call from block query API
This avoids master queries on HTTP GET. Filter out rows on the
fly and allow for pruning to only happen when blocks do.

Change-Id: Idd25b2f8a789ba191fde87e997910e78d67c7021
2016-08-29 16:17:07 +00:00
Brad Jorsch
087e25021b API: Warn when input parameters are normalized
If a client submits data that is not NFC-normalized Unicode or that
contains C0 controls other than HT, LF, and CR, it gets normalized before
the API ever sees it. Which can lead to difficult-to-handle bugs when,
for example, a title is subject to normalization so the client can't
find the specific title it submitted anywhere in the response (T139130).

This patch does two things:
* Detects when normalization was applied to an input value (at the
  MediaWiki level, anyway; if PHP or earlier does it we're just out of
  luck) and add a warning to that effect.
* For ApiPageSet's 'titles' parameter, split into the individual titles
  and add them to the 'normalized' list in the response. This requires
  encoding the pre-normalized strings to avoid ApiResult's own
  normalization.

Bug: T29849
Bug: T144071
Change-Id: I215fd3edd7a5e1b45292e60768bf6dd5ad7f34de
2016-08-29 15:00:45 +00:00
Brad Jorsch
75a85b412c API: Use U+001F (Unit Separator) for separating multi-valued parameters
When a multi-valued parameter's value begins with U+001F, the values
will be split on that character instead of pipes. This will be useful
for things such as action=options&change= or meta=allmessages&amargs=.
Since MediaWiki doesn't otherwise accept C0 control characters
(WebRequest::getVal() replaces them with �), there's no possibility that
this will conflict with a literal use of U+001F.

Special:ApiSandbox and mw.Api are updated to make use of this, with the
latter having an option to disable the behavior in case something is
depending on [ 'foo', 'bar|baz' ] turning into 'foo|bar|baz'.

Pipe is still used as the separator when the value doesn't begin with
U+001F, and will be forever since it's generally more human-friendly and
is needed for backwards compatibility with basically every API client in
existence. The requirement that the value begin with U+001F, rather than
simply contain U+001F, is to avoid clients having to somehow
special-case "param=foo|bar" where that's intended to be a single value
"foo|bar" rather than two values "foo" and "bar".

Bug: T141960
Change-Id: I45f69997667b48887a2b67e93906364a652ace5a
2016-08-29 11:00:25 -04:00
jenkins-bot
87c069c801 Merge "ApiResult: Remove double space in error message" 2016-08-29 14:47:46 +00:00
Bartosz Dziewoński
f465c7feb4 ApiResult: Remove double space in error message
Change-Id: I5888d617ab9aebe5ae1fe4da6873639a81f60fc3
2016-08-29 16:02:04 +02:00
Translation updater bot
85c5c69c1a Localisation updates from https://translatewiki.net.
Change-Id: Ic246c3d4e15143a000363bcfb64921cc88e1ae58
2016-08-28 22:02:22 +02:00
jenkins-bot
c2e2afbc90 Merge "API: Some raw message cleanup" 2016-08-27 01:18:10 +00:00
jenkins-bot
366b6bb86b Merge "ApiUpload: Better handle unreasonably large metadata in 'imageinfo'" 2016-08-26 17:02:32 +00:00
Bartosz Dziewoński
13d2035cbb ApiUpload: Better handle unreasonably large metadata in 'imageinfo'
Bug: T143993
Change-Id: I1fcdbca9981dd034572eeb32070d574cf97a132f
2016-08-26 16:53:52 +02:00
jenkins-bot
4c8ffe38d8 Merge "Add urls from various adware to the CSP false positive list" 2016-08-25 23:01:49 +00:00
Brian Wolff
d84479c4cd Add urls from various adware to the CSP false positive list
URLs are based on spam that comes into the Wikimedia log files,
based on testing on elwiki.

Change-Id: Iee86633abaae86c55764365042681bda1f2304be
2016-08-25 22:52:28 +00:00
Translation updater bot
b6cdc88877 Localisation updates from https://translatewiki.net.
Change-Id: Ia68c69742fbb7eae69e4160e923ec7fa459f7b67
2016-08-25 21:57:21 +02:00
jenkins-bot
3ea818c42b Merge "API: Log when too many values are passed for a multi-valued parameter" 2016-08-24 23:34:04 +00:00
Translation updater bot
fb953a99ad Localisation updates from https://translatewiki.net.
Change-Id: If5f82b2d32ab93592dd54cf21cb5d36c52315936
2016-08-24 21:55:28 +02:00
Brad Jorsch
a6d6f2ee38 API: Some raw message cleanup
* Set an indexed tag name in ApiParamInfo and ApiAuthManagerHelper.
* Use 'key' instead of 'message' for the (not yet used) non-BC
  ApiErrorFormatter.

Change-Id: I07f0a690e263b34e09210673241af8bf750cbd1b
2016-08-24 13:19:52 -04:00
Brad Jorsch
fbf947941d API: Log when too many values are passed for a multi-valued parameter
Currently the API just throws away the excess values, no continuation.
This is probably not the best behavior. There is a warning, but clients
are notorious for just ignoring warnings.

We could improve the situation:
* Turn it into an error.
* Turn it into an error for most cases, but allow some to override if
  necessary.
* Allow some cases to make it an error, while keeping it a warning by
  default.

Before we can decide which option to pick, we should get an idea of how
often this is being hit and which things it's being hit for.

Bug: T41936
Change-Id: I52926f410c30d1cd7e7fcd86465b16519fb5cbd2
2016-08-24 12:16:30 -04:00
Translation updater bot
b310831700 Localisation updates from https://translatewiki.net.
Change-Id: Ib1a471eb8e9692fab1e5d66cf6711388ea2e20cc
2016-08-24 09:51:59 +02:00
Daniel Kinzler
c18cb7ed15 SECURITY: Check read permission when loading page content in ApiParse.
Prevents leaking page contents for extensions that deny read rights
to certain pages via a userCan hook, but still allow the user to
have read rights in general.

Issue originally reported by Tobias

Bug: T115333
Change-Id: I19f5c2583393794cff802a70af7ccf43c2fed85c
2016-08-22 18:13:01 -07:00
Bartosz Dziewoński
0afc3cf016 ApiUpload: Fix fatal in dieStatusWithCode()
If $extraData was null, but $moreExtraData was given, the following
fatal would occur:

  Fatal error: Unsupported operand types in
  /var/www/html/w/includes/api/ApiUpload.php on line 408

Follow-up to c9b5b3e988.

Change-Id: I613eed1f7429247fe46afa454d36f518f6a81ebe
2016-08-22 21:16:21 +02:00
Brad Jorsch
71c4454be9 API: Don't require 'users' parameter to contain all valid usernames
Instead, go back to validating the individual values so one invalid name
doesn't cause the whole module to error out. The code for that was all
still there, just unused since Ic67fb540.

Bug: T142895
Change-Id: Ia5eae51d69185580ac2c772afc198a92813e407a
2016-08-22 14:22:12 -04:00
Translation updater bot
93bca4fbe4 Localisation updates from https://translatewiki.net.
Change-Id: I28649c5ec88c05c17aeb113f10b0b27a13cc9240
2016-08-21 22:08:21 +02:00
Translation updater bot
de1635cd54 Localisation updates from https://translatewiki.net.
Change-Id: Icd414580d3aeb2aba4af16f299ec339a2d843c8e
2016-08-20 22:04:25 +02:00
Translation updater bot
ef5ef7e2ae Localisation updates from https://translatewiki.net.
Change-Id: Idd0a7553ba64610ce873c52909baa1bff5ee0b14
2016-08-19 22:00:33 +02:00
jenkins-bot
439e9bacd4 Merge "Check for warnings for assembled file after a chunked upload" 2016-08-19 02:01:26 +00:00