Commit graph

78 commits

Author SHA1 Message Date
Umherirrender
1145328459 api: Use type-declaration for string arg in ApiBase::__construct
Also for all sub-classes
Remove simple doc-blocks without further information

Change-Id: I981934efe32d44f52e5ab865a9b887be5bd0f41e
2024-10-17 20:09:15 +02:00
James D. Forrester
984076f98e Add namespace to includes/api classes
Bug: T353458
Change-Id: I3ea6b08c5018ba03ba45c5766e1f46e12f6b8597
2024-09-25 19:31:14 +00:00
Umherirrender
3fca49a1f4 api: Add missing documentation to class properties
Add doc-typehints to class properties found by the PropertyDocumentation
sniff to improve the documentation.

Once the sniff is enabled it avoids that new code is missing type
declarations. This is focused on documentation and does not change code.

Change-Id: I8b33b5f4d91c1935228e7010327dbc6ce138fc00
2024-09-07 22:22:13 +02:00
Ebrahim Byagowi
a717db8e60 Add namespace and deprecation alias to FormatJson
This patch introduces a namespace declaration for the
MediaWiki\Json to FormatJson and establishes a class
alias marked as deprecated since version 1.43.

Bug: T353458
Change-Id: I5e1311e4eb7a878a7db319b725ae262f40671c32
2024-05-16 16:28:01 +03:30
Reedy
550d897d53 ApiFormatJson: Set PARAM_HELP_MSG_PER_VALUE for formatversion
Bug: T342638
Change-Id: I180350e9df08af61c2c01360e0f4bcfd1c764a20
2023-08-03 13:05:40 +00:00
Reedy
f15a759df1 api: Minor code cleanup
Change-Id: I1f20597093448d00435158a9ac861873000bb057
2022-08-14 13:10:53 +00:00
Tim Starling
51ddd70682 Remove Flash cross-domain policy mangling
Remove Flash cross-domain policy mangling. Users who are somehow still
using Flash as a browser extension will be exposed to CSRF
vulnerabilities.

Deprecate the config since deprecation has some advantages in the new
config system over simple removal.

Bug: T279496
Change-Id: I2c0e85a430d7e6aaf8d5decd00cf1dade04cebe1
2022-07-22 11:44:49 +10:00
Reedy
0b5084f868 api: Replace numerous deprecated constants
Change-Id: I34ffcb70efbfa257da8dab6e0790aa0d697caf5b
2022-06-06 00:18:50 +01:00
Reedy
f2f8e7de08 Api: Convert php and json formatversion to use PARAM_HELP_MSG_PER_VALUE
Bug: T285545
Change-Id: I6efc1644893ae068fcb5b05c1b32f10e436b2402
2021-06-25 18:34:37 +01:00
C. Scott Ananian
afd3dbaa95 Don't silently fail if API result fails to encode
Ensure that errors encoding API results produce actionable log entries.

Part of the follow-up to T210550.

Change-Id: I6f311451e3b07b540f14352ce25af9d74a053d19
2018-12-05 13:28:33 -05:00
Aryeh Gregor
edb52e7338 Improve ApiFormatJson test coverage
The only thing missing is tests for the rawfm paths, which I don't
understand well enough to test easily.

Change-Id: I08779391798b9d2d5eeb7e19ec4764059336069c
2018-10-08 13:42:20 +03:00
Aryeh Gregor
4fe5d0dbaa Add more checks to ApiStructureTest.php
Depends-On: Ideca8903e4b529b7471ba81aa7dd3b01039ed2f9
Depends-On: I39b96ad0334a17fd50501e92b26f1d47ee4ccbba
Depends-On: Ied07ccfd7ff6db9d399eac3c8aab63993b91c1f4
Change-Id: I4a2505cfc8e86e73e46d40acffbf3cd8803458e2
2018-04-08 15:58:06 +03:00
Timo Tijhof
665e9b7bf2 Convert OutputHandler functions to a class
* Convert OutputHandler.php from global functions to a class.

  - wfOutputHandler → OutputHandler::handle
    (no alias, no usage outside core)
  - wfGzipHandler → OutputHandler::handleGzip
    (private, no usage outside class)
  - wfRequestExtension → OutputHandler::findUriExtension
    (private, no usage outside class)
  - wfMangleFlashPolicy → OutputHandler::mangleFlashPolicy
    (private, no usage outside class)
  - wfDoContentLength → OutputHandler::emitContentLength
    (private, no usage outside class)
  - wfHtmlValidationHandler → OutputHandler::validateAllHtml
    (private, no usage outside class)

* Add the class to autoload.php for exposure outside WebStart.
  Specifically, for use in ApiFormatPhpTest. This also removes the
  need to manually load the class because this code runs after
  Setup.php loads AutoLoader.php.

Bug: T189966
Change-Id: I27a41ec0ae0ee30aeb313a616323b967605c4055
2018-03-20 21:11:32 -07:00
Umherirrender
c9d303d39e Remove "Created on" from file header comments
It is the job of git and svn to provide this information/metadata.
The form was different, some with short, some with long month name
some with leading zero at the day, some without.
The year is also present in the Copyright clause

Change-Id: If006907b82b9e45f13cfa2e45d41107a95570e1a
2018-01-26 23:12:40 +00:00
James D. Forrester
50e796e948 includes/api: Replace implicitly-Bugzilla bug numbers with Phab ones
It's unreasonable to expect newbies to know that "bug 12345" means "Task T14345"
except where it doesn't, so let's just standardise on the real numbers.

Change-Id: I49e2a10350a328a8572fcedd44012751a29e1068
2017-02-24 16:41:47 +00:00
Brad Jorsch
4e6810e4a2 API: i18n for warnings and errors
API warnings and error messages are currently hard-coded English
strings. This patch changes that.

With a few exceptions, this patch should be compatible with non-updated
extensions:
* The change to ApiBase::$messageMap will blow up anything trying to
  mess with it.
* The changes to the 'ApiCheckCanExecute' hook will cause a wrong
  (probably unparsed) error message to be emitted for extensions not
  already using an ApiMessage. Unless they're currently broken like
  Wikibase.

Bug: T37074
Bug: T47843
Depends-On: Ia2b66b57cd4eaddc30b3ffdd7b97d6ca3e02d898
Depends-On: I2e1bb975bb0045476c03ebe6cdec00259bae22ec
Depends-On: I53987bf87c48f6c00deec17a8e957d24fcc3eaa6
Depends-On: Ibf93a459eb62d30f7c70d20e91ec9faeb80d10ed
Depends-On: I3cf889811f44a15935e454dd42f081164d4a098c
Depends-On: Ieae527de86735ddcba34724730e8730fb277b99b
Depends-On: I535344c29d51521147c2a26c341dae38cec3e931
Change-Id: Iae0e2ce3bd42dd4776a9779664086119ac188412
2016-12-06 10:20:48 -05:00
Brad Jorsch
892c31ebaf API: Remove deprecated methods
All deprecated ApiResult methods are removed. These have been deprecated
since 1.24 or 1.25, and the only users remaining in Gerrit are wrapped
in backwards-compatibility checks and so should not be being called.

ApiBase, ApiFormatBase, ApiMain, and ApiQuery methods for generating the
pre-Ib14c00df help text are removed. Nothing has called these for a long
time, and only Flow implemented them in any way. Deprecated methods for
providing the text for such help, such as getDescription(), haven't been
removed yet, though, since some extensions still call some of them.

Change-Id: I3ca7c98174b4a3f6f67f2b023e0f4446637e7a84
2016-09-20 17:21:00 -04:00
Brad Jorsch
f459c1aeca SECURITY: Improve cross-domain-policy mangling
Take into account that the tag might have parameters.

Bug: T123653
Change-Id: Ie9799f5ea45badfb4e7b4be7e7fbc1c35cc86f26

Signed-off-by: Chad Horohoe <chadh@wikimedia.org>
2016-05-20 09:48:11 -07:00
Brad Jorsch
54d58ef506 API changes for AuthManager
Changes here are:
* action=login is deprecated for use other than bot passwords
* list=users will indicate if a missing user name is creatable.
* Added action=query&meta=authmanagerinfo
* Added action=clientlogin is to be used to log into the main account
* action=createaccount is changed in a non-BC manner
* Added action=linkaccount
* Added action=unlinkaccount
* Added action=changeauthenticationdata
* Added action=removeauthenticationdata
* Added action=resetpassword

Bug: T110276
Bug: T110747
Bug: T110751
Bug: T32788
Bug: T67857
Bug: T28597
Bug: T76103
Change-Id: I244fa9b1e0623247d6d9fa30990411c6df94a496
2016-05-16 15:12:52 +00:00
Kunal Mehta
6e9b4f0e9c Convert all array() syntax to []
Per wikitech-l consensus:
 https://lists.wikimedia.org/pipermail/wikitech-l/2016-February/084821.html

Notes:
* Disabled CallTimePassByReference due to false positives (T127163)

Change-Id: I2c8ce713ce6600a0bb7bf67537c87044c7a45c4b
2016-02-17 01:33:00 -08:00
Brad Jorsch
f0207e8ca6 Add Special:ApiSandbox
Like Extension:ApiSandbox, but rewritten to use OOJS-UI and to add many
long-requested features.

Bug: T89386
Bug: T92893
Bug: T98457
Bug: T98083
Bug: T89229
Bug: T66008
Bug: T50607
Bug: T47811
Bug: T38875
Bug: T36962
Bug: T34740
Change-Id: Ic42a6c5ef54b811cd63cfef2132942b27a626fe5
Depends-On: I85c0eedcd31a0e419d8055eca0d9cb1ba872ae62
Depends-On: Ic85ff4abbbcd2076ebf5cdfaa0e95e98878e2308
2016-02-03 11:13:59 -05:00
Siebrand Mazeland
0fdb0ce284 Fix most PHP CodeSniffer warnings in includes/api
Change-Id: I01bb3e4c96d6034a5b6c18728bb0574c710ea9db
2015-09-28 14:24:52 +02:00
Brad Jorsch
f9c1bfa594 API: Finish killing "raw mode"
It was kept around in the ApiResult rewrite because Wikibase was
(mis)using it as an "XML mode" flag.

Bug: T96596
Change-Id: Ic8259649c8cb0cce0444c907607c36d96fb2eb7e
2015-09-17 13:51:45 +00:00
Brad Jorsch
14560cb1b0 API: Ignore '_' parameter in jsonp callback mode
jQuery has a misfeature where it by default appends a '_' parameter as a
cachebuster in jsonp mode. So, when in jsonp mode, mark this bogus
parameter as used to avoid an unnecessary warning.

Bug: T94015
Change-Id: I43373439a3605e4589315139c30976c6c2f68542
2015-08-05 12:26:04 -07:00
Kunal Mehta
1c234274d7 ApiFormatJson: Fix dieUsage call on unknown formatversion value
* Add missing error code
* Don't call staticly, it's not a static function

Change-Id: Ib6cee829b589f6fe0d092ebe7cca2a1d16c357fd
2015-04-20 14:57:45 +00:00
Brad Jorsch
db6a9636f1 API: Avoid warnings for parameters that don't exist in format=rawfm
As format=rawfm is intended for debugging, a recent change removed
definition of unnecessary parameters inherited from format=json. But the
inherited code was still assuming they were defined, causing PHP
warnings.

Bug: T96479
Change-Id: Id13ae541f13b6930c535d156dc5aac0a257d31e8
2015-04-20 10:16:03 -04:00
Brad Jorsch
1c57794e37 API: Overhaul ApiResult, make format=xml not throw, and add json formatversion
ApiResult was a mess: some methods could only be used with an array
reference instead of manipulating the stored data, methods that had both
array-ref and internal-data versions had names that didn't at all
correspond, some methods that worked on an array reference were
annoyingly non-static, and then the whole mess with setIndexedTagName.

ApiFormatXml is also entirely annoying to deal with, as it liked to
throw exceptions if certain metadata wasn't provided that no other
formatter required. Its legacy also means we have this silly convention
of using empty-string rather than boolean true, annoying restrictions on
keys (leading to things that should be hashes being arrays of key-value
object instead), '*' used as a key all over the place, and so on.

So, changes here:
* ApiResult is no longer an ApiBase or a ContextSource.
* Wherever sensible, ApiResult provides a static method working on an
  arrayref and a non-static method working on internal data.
* Metadata is now always added to ApiResult's internal data structure.
  Formatters are responsible for stripping it if necessary. "raw mode"
  is deprecated.
* New metadata to replace the '*' key, solve the array() => '[]' vs '{}'
  question, and so on.
* New class for formatting warnings and errors using i18n messages, and
  support for multiple errors and a more machine-readable format for
  warnings. For the moment, though, the actual output will not be changing
  yet (see T47843 for future plans).
* New formatversion parameter for format=json and format=php, to select
  between BC mode and the modern output.
* In BC mode, booleans will be converted to empty-string presence style;
  modules currently returning booleans will need to use
  ApiResult::META_BC_BOOLS to preserve their current output.

Actual changes to the API modules' output (e.g. actually returning
booleans for the new formatversion) beyond the use of
ApiResult::setContentValue() are left for a future change.

Bug: T76728
Bug: T57371
Bug: T33629
Change-Id: I7b37295e8862b188d1f3b0cd07f66ac34629678f
2015-04-10 16:57:15 -04:00
Brad Jorsch
e868f703ad API: Work around wfMangleFlashPolicy()
The things wfMangleFlashPolicy() does to the output break things in the
API. For JSON we can work around it, while for PHP we just have to error
out. XML isn't affected because <> are escaped anyway (unless something
somehow uses 'cross-domain-policy' as a tag name), and the rest are
going away soon so they're not worth the trouble.

Bug: 66776
Change-Id: Idc5f37bd778288a9cde572f081dc753d681ec354
2014-11-20 10:03:31 -05:00
Brad Jorsch
d25cb99202 API: Clean up and internationalize pretty-printed output
The syntax highlighting applied to the XML format is not all that great,
and applying it to other formats is just wrong. Instead of doing it
ourselves, let's just add a hook and let Extension:SyntaxHighlight_GeSHi
do it for us.

But for that to work, we have to add RL support to the pretty-printed
output, which means OutputPage. At the same time, lets internationalize
the header.

Bug: 65403
Change-Id: I04b1a3842abdf1fb360c54aa7164fc7cd2e50f4b
2014-10-13 16:17:37 -07:00
Brad Jorsch
df457f3809 API: HTMLize and internationalize the help, add Special:ApiHelp
The existing API help, formatted as basically a plain-text document
embedded in XML and with a little bolding and a few links
syntax-highlighted in after the fact, works ok for experienced programmers
but isn't at all newbie-friendly. Further, all the help is hard-coded in
English, which isn't very friendly to non-English speakers.

So let's rewrite it. The help text is now obtained from i18n messages
and output in HTML, with the default display consisting of help for a
single module with links to help for other modules. This, of course,
necessitates deprecating many of the existing help-related methods and
hooks and replacing them with new ones, but backwards compatibility is
maintained for almost everything.

At the same time, action=paraminfo also needs to support the
'description' and other help-related fields being output in wikitext or
HTML, and I11cb063d (to access all modules via the 'modules' parameter
instead of having 'modules', 'formatmodules', 'querymodules', and so on)
is folded in.

And we also add Special:ApiHelp. When directly accessed, it simply
redirects to api.php with appropriate parameters. But it's also
transcludable to allow up-to-date API help text to be included within
the on-wiki documentation.

Note this patch doesn't actually add i18n messages for any API modules
besides ApiMain and ApiHelp. That will come in a followup patch, but for
the moment the backwards-compatibility code handles them nicely.

While we're messing with the documentation, we may as well add the
"internal" flag requested in bug 62905 (although the 'includeinternal'
parameter it also requests doesn't make much sense anymore) and a
"deprecated" flag that's needed by several modules now.

Bug: 30936
Bug: 38126
Bug: 42343
Bug: 45641
Bug: 62905
Bug: 63211
Change-Id: Ib14c00df06d85c2f6364d83b2b10ce34c7f513cc
2014-10-10 10:46:39 -04:00
csteipp
fe32899523 SECURITY: Prepend jsonp callback with comment
Mitigate CVE-2014-4671 for unpatched flash players

Bug: 68187
Change-Id: I2f46e623c1f541dbbafb6e8333e0929055098b15
2014-07-30 20:26:39 +02:00
Thiemo Mättig
23632a4ecd Use precise ApiMain/ApiQuery type hints in all API modules
Which type is used depends on the ApiModuleManager responsible for
the API module. There are two managers, one in ApiMain and one in
ApiQuery. Both contain a list of API modules they instantiate.
Both use $this as the first parameter in the constructors of the
individual modules. There is no other regular way to instantiate the
modules, so we know the type must either be ApiMain or ApiQuery.

The lists don't intersect.

I would have prefered the naming scheme $mainModule for ApiMain
modules and $queryModule for ApiQuery modules but since this
doesn't add much I left the shorter variable names untouched.

Change-Id: Ie6bf19150f1c9b619655a06a8e051412665e54db
2014-05-16 11:07:23 -04:00
Siebrand Mazeland
ca209473d1 Remove unneeded uses of else{} in api/
Fixed a little documentation issue, removed a line of unreachable code
and fixed up two formatting issues in the process.

Change-Id: If29391ee1a0daf19973437f36c3216b8716debd0
2013-11-18 21:34:43 +01:00
Siebrand Mazeland
d026e1a403 Address errors and warnings in CodeSniffer in api/
Change-Id: I06de371393d50eada33154626874b106d814642b
2013-11-17 16:52:24 +01:00
Siebrand Mazeland
fe05f85a62 Update formatting on API classes
Change-Id: Ifd18a8de1d2580b723a5b91e8d202818fd97795a
2013-11-14 17:03:20 +00:00
Kevin Israel
79f80cc495 Combine JavaScript and JSON encoding logic
This will help with improving human readability of JS and JSON
objects encoded by both ResourceLoader and the API. This patch
also adds new "utf8" parameter to the JSON formatter of the API.

Changes to FormatJson class:

* Added escaping of '<', '>', and '&' by default to protect against XSS.
* Removed unnecessary escaping of '/' and added an additional option to
  unescape non-ASCII characters (those above U+007F) as well.
* Added PHP 5.3 pretty printing code (to replace Services_JSON) that
  uses a four-space indent as PHP 5.4 does.

Changes to Xml class:

* Defined Xml::encodeJsVar() in terms of FormatJson::encode()
  and added a pretty printing option. Also added a pretty printing
  option to Xml::encodeJsCall() as well.
* Deprecated Xml::escapeJsString() and QuickTemplate::jstext();
  callers have to add quotes themselves, hence the escaping of
  both double quotes and apostrophes.

Bug: 26818
Change-Id: I1987190f1ba5bf41738e7bd611209706c1f6bb5c
2013-03-27 20:22:45 -04:00
Yuri Astrakhan
0aa24ae558 Fixed many small spelling mistakes and php docs, var decl.
Change-Id: I1508ed7eb77e5e4f700fb63955d626c4f5915840
2013-03-10 23:45:51 -04:00
Yuri Astrakhan
503cd2f4ae (bug 35885) remove api version string and parameter
API was using SVN's version keyword which GIT does not support.
All related methods were either removed, or for those that
could have been used from extensions, emptied out.
api.php?version now shows unrecognized param warning.

Change-Id: I910ca1448ed2ed697ac19b17c486d130aa1d7e03
2013-01-18 12:41:18 -05:00
Antoine Musso
4f5d2386f3 escape HTML elements in docblock with double quotes
Doxygen choke on text enclosed by '<' and '>' since it tries to
interpret them as HTML or XML elements. This patch adds double quotes
in includes/api/*.php files around the two following strings:

 <Firstname>.<Lastname>@gmail.com
 <Firstname><Lastname>@gmail.com

Which becomes:

 "<Firstname>.<Lastname>@gmail.com"
 "<Firstname><Lastname>@gmail.com"

Tested locally, it prevents doxygen 1.8.0 related warnings.

Change-Id: I36d82eb3fd4989ee3ffc65b0b527b83711d1ba69
2012-07-15 22:15:45 +02:00
John Du Hart
2e7d867478 Removed the 'eclipse helper' bit on top of every API module
It's a parctice that dates back to 2006 when the API was first written, and frankly isn't covered by the coding conventions. Same thing with the docblocks, they're all copypasted with some bits changed and don't even make sense if you look at them in the genereated code docs.
I don't feel that any of us depend on this anymore (get a better IDE), so in the inerest of consistancy it's time we said goodbye to it.
2011-11-16 00:17:26 +00:00
Sam Reed
6309c920dd Delete all the "API for MediaWiki 1.8+" comments
Add since to ApiQueryQueryPage
2010-12-22 20:52:06 +00:00
Alexandre Emsenhuber
457eb73b61 Standardised file description headers, added @file 2010-08-07 19:59:42 +00:00
Niklas Laxström
b63099ec13 Whitespace fix 2010-07-08 09:28:31 +00:00
Derk-Jan Hartman
921619b119 Correct the address of the FSF in some of the GPL headers
59 Temple Place -> 51 Franklin Street
2010-06-21 13:13:32 +00:00
Sam Reed
e55ed729c4 Mixture of things.
Couple of class comments

Normalisation of "." usage at end of lines (removed)

Normalisation of {prefix}parameter as per bug 23461
2010-05-11 22:30:18 +00:00
Jack Phoenix
604906deb5 API: coding style cleanup, fix copyright symbol, more braces 2010-02-23 12:30:23 +00:00
Mark A. Hershberger
8b36a2b969 various eol whitespace now instead of when someone needs to do CR 2010-02-12 06:44:16 +00:00
Aryeh Gregor
3758769f0d stylize.php on API code
"I wouldn't object to stylizing the API code to bring it in line with
the rest of MW on principle, but I'm not gonna bother myself." --Roan
<http://www.mediawiki.org/wiki/Special:Code/MediaWiki/60657#c5108>

If you're seeing this commit in blames, tell your blame tool to ignore
whitespace, e.g., git blame -w or svn blame -x -w.
2010-01-11 15:55:52 +00:00
Tim Starling
7b7f9f0d4d Comments and whitespace fixes only. 2009-09-10 06:43:01 +00:00
Michael Dale
7efc871cba * (bug 20336) changed json_decode json_encode to static class in global functions
** we should update extensions as well
* added config for fileCheckModify date check to scriptLoader unique script id generation
2009-09-09 22:26:16 +00:00