Commit graph

226 commits

Author SHA1 Message Date
jenkins-bot
6f3d5a5204 Merge "user: Allow "CAS update failed" exceptions to be normalised" 2018-09-20 22:31:11 +00:00
Chad Horohoe
befd48c5f7 SECURITY: Make 'newbie' limit in $wgRateLimits really override 'user' limit
The order of operations was incorrect.

Bug: T169545
Change-Id: Ia910aa2a494914d3b0017daac9ab294ea9fa8705
2018-09-20 22:26:11 +01:00
Umherirrender
a4caa4d0c6 build: Updating mediawiki/mediawiki-codesniffer to 22.0.0
Added spaces around .
Removed empty return statement which are not required
Removed return after phpunit markTestIncomplete,
which is throwing to exit the test, no need for a return

Change-Id: I2c80b965ee52ba09949e70ea9e7adfc58a1d89ce
2018-09-16 15:51:11 +00:00
Timo Tijhof
65f714e1e6 user: Allow "CAS update failed" exceptions to be normalised
Take the user_id variable out of the exception message.
To compensate and still allow one to correlate patterns relating
to a specific user (e.g. a bot), add a warning message that
still contains the variable via context. This way that warning
will also be normalised/grouped, but with the extra context.

This is separate because exceptions do not currently support
context placeholders.

Bug: T202149
Change-Id: Ic0c25f66f23fdc65821da12f949c6224bc03f9b3
2018-09-12 18:33:34 +01:00
Aryeh Gregor
90d4f56fe4 Mass conversion of $wgContLang to service
Brought to you by vim macros.

Bug: T200246
Change-Id: I79e919f4553e3bd3eb714073fed7a43051b4fb2a
2018-08-11 22:44:29 -06:00
Aryeh Gregor
115d4e2826 Return array without holes from User::getAllGroups
Change-Id: I2933ffe2cddec3d595536f93df17b609cdabab9e
2018-07-31 16:17:42 +03:00
Gergő Tisza
db888bc5ad
Segregate right to edit sitewide CSS/JS
To limit the likelihood of incidents like T189665, the ability to
edit sitewide CSS/JSON/JS is split out from editinterface, into
separate 'editsitecss', 'editsitejson' and 'editsitejs' rights.

editsitecss, editsitejs, and the right to edit another (potentially
more privileged) user's personal CSS/JS is removed from sysops, and
a new user group, interface-admin, is created specifically for that
task (along with a new grant group 'editsiteconfig').

interface-admin is granted to the first user of a new wiki, along with
sysop and bureaucrat.

Bug: T120886
Bug: T190015
Depends-On: Ia9b2ea1450aff6121dc0f3777bf029292c8aaad9
Change-Id: Ifefd872640642441e26f8b2f144ffe4b88d2eb12
2018-07-22 12:37:32 +02:00
Max Semenik
e6b4944dbf Introduce preference filters
This normalizes handling of transformations on the boundaries between
preferences and generic form controls and removes the special case
where email-blacklist is passed around as an array internally, leaking
into the API.

As a result of this normalization, meta=userinfo no longer returns an
array of users, using the internal representation like action=options.

Bug: T198935
Change-Id: Iff63da0d215585cfcf083e7f7ec8ed45d5b77301
2018-07-17 13:19:14 -07:00
Umherirrender
130ec2523d Fix PhanTypeMismatchDeclaredParam
Auto fix MediaWiki.Commenting.FunctionComment.DefaultNullTypeParam sniff

Change-Id: I865323fd0295aabd06f3e3c75e0e5043fb31069e
2018-07-07 00:34:30 +00:00
jenkins-bot
4f73259b37 Merge "Replace deprecated language codes in user options" 2018-06-14 13:56:36 +00:00
Fomafix
80f31ecac6 Replace deprecated language codes in user options
This change replaces deprecated language codes in the user options by
the new language codes when loading the user setting from database.

The database entry for the user gets updated with the new language code
when the user saves the preferences.

Bug: T131042
Change-Id: I1dd6fb1f240ce3319b132d0f29f0622fba33e655
2018-06-14 13:32:28 +00:00
daniel
e8632ab0f6 [MCR] Factor PageUpdater out of WikiPage
This introduces PageUpdater to replace WikiPage::doEditContent,
and DerivedPageDataUpdater, to replace WikiPage::doEditUpdates
and WikiPage::prepareContentForEdit.

See docs/pageupdater.txt for a description of their
functionality.

MCR migration notes:

* The interface of PageUpdater is expected to
remain mostly stable after this patch. Code that has been using
WikiPage::doEditContent can be confidently migrated to using the
new mechanism for revision creation.

* This patch keeps the code inside PageUpdater largely aligned
with the old code in WikiPage, to make review easier to to avoid
mistakes. It is intended to be refactored further, moving
application logic into stateless services.

* DerivedPageDataUpdate is intended as a stepping stone for further
refactoring. Its behavior is designed to be compatible with
callback code that currently relies on
WikiPage::prepareContentForEdit. Much of the code that currently
lives in DerivedPageDataUpdate should be factored out into
services, all behavior relevant to calling code should be exposed
via narrow interfaces.

Bug: T174038
Bug: T196653
Change-Id: If610c68f4912e89af616cdcac1d35a1be3946afa
2018-06-14 13:22:13 +00:00
Bartosz Dziewoński
485f66f174 Use PHP 7 '??' operator instead of '?:' with 'isset()' where convenient
Find: /isset\(\s*([^()]+?)\s*\)\s*\?\s*\1\s*:\s*/
Replace with: '\1 ?? '

(Everywhere except includes/PHPVersionCheck.php)
(Then, manually fix some line length and indentation issues)

Then manually reviewed the replacements for cases where confusing
operator precedence would result in incorrect results
(fixing those in I478db046a1cc162c6767003ce45c9b56270f3372).

Change-Id: I33b421c8cb11cdd4ce896488c9ff5313f03a38cf
2018-05-30 18:06:13 -07:00
Dayllan Maza
e8063a0846 Send a cookie with IP/IP-Range blocks when blocking logged-out users
A cookie will be set when ip users try to edit and their IP has been
blocked or if they try to create an account and the block prevents
account creation

This feature is disabled by default and can be enabled by
setting the new $wgCookieSetOnIpBlock config variable to true.

Note: this is meant to discourage vandals that try to avoid blocks by
switching their ip address while editing anonymously.

Bug: T152462
Change-Id: I0b78a5e174bcd882edea39e868a08f9a347f5aba
2018-05-24 00:48:05 -04:00
Brad Jorsch
d152ff76a5 User: System block reasons shouldn't expand templates
The block reasons for "system" blocks shouldn't expand wikitext
templates immediately. That should be left for the code parsing the
block reason for display.

This should only affect how these blocks are reported to API clients, as
when the block is displayed in the web UI it's passed through the parser
anyway. The main drawback, as far as the default messages go, is that
MediaWiki:sorbsreason won't have {{SITENAME}} expanded in
the API response anymore.

Bug: T191939
Change-Id: Ib2024721ea0e26358b9b50efdac16316d6d0f0b6
2018-05-12 08:13:39 -04:00
Gergő Tisza
df1c24fde8
Add equals() to UserIdentity
Change-Id: Ia2f33d551e96bd6f58ba9414049449282575a63b
2018-05-08 16:31:03 +02:00
Umherirrender
e1a203603c Replace wfGetLB
@deprecated since 1.27

Change-Id: Ibdd49fdfc0d1511503e1ed2173a592c612996c53
2018-05-02 22:30:24 +02:00
Daimona Eaytoy
4aca2af898 Fix parameter doc type for matchEditToken
I noticed it while fixing some AbuseFilter errors. matchEditToken simply
calls getEditTokenObject, which accepts string|array as $salt.

Change-Id: I36497eb8797ee60759c5109b699643635bba9174
2018-04-28 11:49:45 +00:00
Florian Schmidt
247fd2f649 Remove EDIT_TOKEN_SUFFIX constant
It isn't used anymore anywhere, according to a code search on github.

Depends-On: I56291c6a5b6c2bb359c6633748a68f4964d71923
Change-Id: I4b3f7b7bdf9bd0dbc8225bbcfb2da23016ae6bb3
2018-04-20 15:33:50 +00:00
Kunal Mehta
278d80b8a1 Update User::getOption() PHPDoc
The default value could be an array, as is used in Echo.

Change-Id: I90f1d4821ec544cfba9ad48bd1a44f8bb8275317
2018-04-12 09:43:03 -07:00
Florian Schmidt
c8ea95160a User: Remove deprecated, unused auth functions
According to a github search they're not used anywhere anymore and
already deprecated since 1.27:

 ::getEditTokenTimestamp
 ::getPasswordFactory
 ::passwordChangeInputAttribs

Change-Id: I904e46e7343baee28dc960f8fd5437ae9d17fc4b
2018-04-04 15:59:04 -07:00
James D. Forrester
2ae7d6b580 Add protection for User: JSON pages in the same manner as JS & CSS ones
Also recognise MediaWiki: JSON pages (with the existing protection of
the editinterface right).

Bug: T76554
Change-Id: Idba166d82ee6dd507d7345c9bdbefc8ca78ed7b4
2018-03-29 14:33:46 +00:00
Aaron Schulz
4f31afd21b Move most User::clearAllNotifications() logic to WatchedItemStore
Change-Id: Ib1b0c40e408f6fad6fc8257c5073fa1c3c264c3a
2018-03-23 10:26:13 +00:00
jenkins-bot
17e8f7d62e Merge "Add missing return types to User::getOption()" 2018-03-23 01:41:28 +00:00
Sam Wilson
12b3176d4f Add missing return types to User::getOption()
String zeros are converted to ints, and email-blacklist returns
an array of integers.

Change-Id: I2ac2a4e8effd4816e9c1e835b86241c7fe850605
2018-03-23 09:14:41 +08:00
Brad Jorsch
f34423130f User: Fully clear instance variables when loading not-blocked status
If a block is deleted and ->clearInstanceCache() is called to try to
make an existing User object reflect that fact, some methods are still
reflecting the old block.

To fix this, User::getBlockedStatus() needs to clear all the relevant
instance variables if the user is found not to be blocked.

Change-Id: I6ad8d5555a4c8519336aded3067e5034831dadf3
2018-03-22 15:01:28 -04:00
Alexia E. Smith
33e0a539b8 Fix User::idFromName() ignoring cache for non-existent users.
This fixes a database time out issue where User::idFromName()
is repeatedly called from Special:Import due to the user not existing.
The response is cached as null, but isset() will return false on a null key.

Bug: T189786
Change-Id: I78705089a25dfec84d3c75bedaf623b1e5ee82c4
2018-03-16 12:10:40 +00:00
James D. Forrester
5ab3ae0371 User: Remove ::setCookie/etc., deprecated in 1.27
Change-Id: I6b37ffd957cdeba79037dadd36f50e0a0b89e5f5
2018-03-02 10:53:15 +00:00
Brad Jorsch
73781d3816 Add a missing check of $wgActorTableSchemaMigrationStage
We shouldn't be trying to update the table when it's MIGRATION_OLD.

Bug: T188437
Change-Id: Id5aae5eaafc36bf7e65009e67fe91619fb1df295
2018-02-27 16:08:02 -05:00
Aaron Schulz
0bf48b7233 Remove redundant item loading code in User::createNew
These lines were removed in 27c61fb1 but left in when I rebased
61b0c193 due to the conflict. The load() call handles all these
fields, so there is no need to set mName and the load state flag.

Change-Id: Id751241abf8d5592309744e96493122c6bc65f2b
2018-02-23 16:25:01 -08:00
Brad Jorsch
e93841a621 Force READ_LATEST for User::newFromId() if writes had been done
The User::newFromName() case already does this, there seems to be no
reason not to do it for User::newFromId() too.

Bug: T188014
Change-Id: Ic7fdef0cc1f5750cb5e6b2a7f48f1549862b41cb
2018-02-24 00:00:17 +00:00
Brad Jorsch
61b0c19306 Have User::createNew() load the object from master
When the new User is created, it's leaving it to be lazy-loaded from a
replica. That seems to be causing attempts to add groups immediately
after creation to fail because the load-from-replica doesn't find the
just-created master row.

Bug: T188014
Change-Id: I841c434086bfaaca1cf1ce23673f32dc5a77915d
2018-02-23 15:44:19 -08:00
Brad Jorsch
27c61fb1e9 Add actor table and code to start using it
Storing the user name or IP in every row in large tables like revision
and logging takes up space and makes operations on these tables slower.
This patch begins the process of moving those into one "actor" table
which other tables can reference with a single integer field.

A subsequent patch will remove the old columns.

Bug: T167246
Depends-On: I9293fd6e0f958d87e52965de925046f1bb8f8a50
Change-Id: I8d825eb02c69cc66d90bd41325133fd3f99f0226
2018-02-23 10:06:20 -08:00
Aaron Schulz
36dfd18409 Avoid pointless DB_MASTER connections in User::clearSharedCache()
Change-Id: Ifc4f489cea4460185cb2d8317f174cabd67f5862
2018-02-09 11:28:59 -08:00
Umherirrender
3124a990a2 Use ::class to resolve class names in includes files
This helps to find renamed or misspelled classes earlier.
Phan will check the class names

Change-Id: I07a925c2a9404b0865e8a8703864ded9d14aa769
2018-01-27 20:34:29 +01:00
Reedy
86d7bd86fa Update IPSet use statements
Bug: T182273
Change-Id: I73fb52678dc56a542eccd209441557610b562d4b
2018-01-21 04:37:26 +00:00
WMDE-Fisch
a7872722b7 Replace deprecated wfGetLB() calls here and there
Change-Id: Ic7cec2dcc6b8e0d500a4c37eb134976b314c33ca
2018-01-20 19:24:24 +00:00
Max Semenik
dc89972d9c Remove User::$mGroups
Deprecated and unused. Private so nothing can possibly use it.

Change-Id: I70a20d35222cb0571e8b401c8b4e031d0be25d6b
2018-01-19 16:33:59 -08:00
jenkins-bot
a79d012e1c Merge "Revert "Prevent new users from being sent emails"" 2018-01-16 19:44:11 +00:00
jenkins-bot
a18476eab3 Merge "Remove @param comments that literally repeat what the code says" 2018-01-11 23:48:03 +00:00
Dmaza
4182a9001e Revert "Prevent new users from being sent emails"
This reverts commit b52421dedd.

Bug: T184470
Change-Id: I2f5fe8993c6e186cd2df0841292653f8fecc0254
2018-01-10 17:59:48 -05:00
Thiemo Mättig
ef470ebf7f Remove @param comments that literally repeat what the code says
These comments do not add anything. I argue they are worse than having
no comments, because I have to read them first to understand they
actually don't explain anything. Removing them makes room for actual
improvements in the future (if needed).

Change-Id: Iee70aad681b3385e9af282d5581c10addbb91ac4
2018-01-10 14:14:26 +01:00
Sam Wilson
2e248f0bb2 Convert Preferences class into PreferencesFactory service
This deprecates the Preferences class and replaces it with
a PreferencesFactory service. Basically, all code from Preferences
is moved into DefaultPreferencesFactory. All Prefereces methods
are now either shims calling DefaultPreferencesFactory or just
throw exceptions.

Bug: T178449
Change-Id: Id0b2db0c2de0890f6e1609a9a0dca207c4600f99
2018-01-03 09:48:25 +08:00
Thiemo Mättig
2e94e4d790 Document "arrays of UserGroupMembership objects" as such
Change-Id: I3c60fb977a329e39933d50e275a738296bc17599
2017-12-27 12:53:17 +00:00
jenkins-bot
bc6ed2ba24 Merge "Prevent new users from being sent emails" 2017-12-08 23:34:49 +00:00
David Barratt
b52421dedd Prevent new users from being sent emails
This change prevents users who have no logged actions from
recieving emails from people.

Bug: T178842
Change-Id: Iedd5f082368a395766cb29ded6dad17a288bf511
2017-12-04 10:00:52 -05:00
daniel
38edb8ab30 Introduce the UserIdentity interface.
This provides a narrow view on a user identity, providing access to
ID and name.

This has been extracted from I140f43a6fb443b for re-use with Actors,
on Anomie's request.

Change-Id: Ief00db5ce382537c5bf992159eae6baf096ae4be
2017-11-18 19:47:25 +00:00
Brad Jorsch
c2f432625f Add deprecation notices for selectFields() methods deprecated in Idcfd1556
Now that WMF-deployed extensions have been updated to no longer call
them.

Change-Id: I04942ca1b95baa2126f2dcf4d0975536f4dd07c7
Depends-On: I300130c7b952a353ac28989d39d7f01366da2a37
Depends-On: Ia81bf6a655af800ce8ac19940d851e65746e1f77
Depends-On: I0d869aacaaad85cdd34361a611ac8348bdbb757d
Depends-On: I7b05a99e23da296a673eb0bd34f18344618c8be3
Depends-On: I42237e8e29497bbc56606f6ad01de3d525bf8b2a
Depends-On: If75d2e76c2f166bc40a544dd502da43171ce1e7b
Depends-On: I401809d2638b11e6c77a318fc8fbbc41fa639083
Depends-On: I5d62ad76fdb64a9c6efd228f27e9b5f512f17d5e
Depends-On: I488afaa991e3d26b638a4f588f70db455959eadf
Depends-On: Ibe82dadb0f2d1c5dbc38b96731c6e443c5469ff0
Depends-On: Id25b86dd415e2e3c6190a91faee2a3b815e50f61
2017-11-01 14:50:56 +00:00
Brad Jorsch
3488f49532 Replace selectFields() methods with getQueryInfo()
Several classes have a "selectFields()" static method to tell callers
which fields to select from the database. With the recent comment table
change and the upcoming actor table change, this pattern has become too
simplistic as a SELECT will need to join several tables to be able to
retrieve all the needed fields.

Thus, we deprecate the selectFields() methods in favor of getQueryInfo()
methods that return tables and join conditions in addition to the
fields.

Change-Id: Idcfd15568489d9f03a7ba4460e96610d33bc4089
2017-10-30 22:57:33 +00:00
Umherirrender
c1281350fc Update signature of UserGroupsChanged to match documentation
UserGroupsChanged is called in Special:UserRights with seven args
The caller in User.php only has five

Change-Id: I221da323c79bb8da0113533d01b429249d15e7de
2017-09-19 19:31:26 +02:00