Commit graph

1829 commits

Author SHA1 Message Date
jenkins-bot
8d2bdc20c2 Merge "Specify DB to query when checking if a user is blocked from a page" 2021-08-26 17:43:34 +00:00
Umherirrender
864068d000 Remove unneeded explicit true/false inside conditions
The non-strict conditions in if/while are true/false without the check.

In some situation the true/false is removed, because it is known to be a
bool (by is_bool check or type hint)

Change-Id: I5ca4c4771af25d2e785e82732df204a73653886e
2021-08-17 21:52:34 +02:00
jenkins-bot
0640586f88 Merge "Move Content::preloadTransform to ContentHandler" 2021-08-17 15:37:12 +00:00
Roman Stolar
42442e01ff Move Content::preloadTransform to ContentHandler
Update ContentTransformer to access ContentHandler::preLoadTransform through the service.
Prepare object to hold a data that required for ContentHandler::preLoadTranform params.

This is a fully backwards compatible change.
We are doing hard deprecation via MWDebug::detectDeprecatedOverride.

However, with the ContentHandler calling Content and
Content calling ContentHandler, it doesn't matter whether
callers use Content or ContentHandler. This will allow us
to naturally convert all callers.

Bug: T287157
Change-Id: I89537e1e7d24c6e15252b2b51890a0bd81ea3e6b
2021-08-17 15:17:34 +00:00
mainframe98
3bab2cc853 EditPage: load mediawiki.interface.helpers.styles
This module provides styling for span.comment, produced by
Linker::commentBlock, which EditPage calls when generating the
HTML for the edit summary.

Add a notice for that to Linker::commentBlock, like was done
in ddbf011257, and update the
comment in the stylesheet.

Bug: T288907
Change-Id: I3d929eaae54754bd3e41a9add419f1098a7f8e3a
2021-08-15 16:01:07 +02:00
jenkins-bot
9ca808f577 Merge "Support fluent interface for StatusValue" 2021-08-11 04:23:17 +00:00
Thiemo Kreuz
69242b0876 Various updates and fixes to PHPDoc documentation
Some minor updates I collected in my local dev environment the
past months.

Change-Id: I30d5339bc262d54ba76e2860a3a3e9e5f002fdc3
2021-08-09 09:26:23 +02:00
jenkins-bot
e89e7aa8b0 Merge "Revert "Use CsrfTokenSet as CSRF token source"" 2021-08-05 23:37:31 +00:00
Umherirrender
21e3caa033 Remove explicit LIMIT 1 when using IDatabase::selectRow/selectField
The limit is the reason why there is an explicit function to use

Change-Id: Ic85cb80b10f233fad4f8ffa214848d76092aee91
2021-08-06 00:54:47 +02:00
Kunal Mehta
a85f569dd1 Revert "Use CsrfTokenSet as CSRF token source"
This reverts commit 0d75fdb4f7.

Bug: T287542
Change-Id: Iedd3461869f973f8d621a39e6ad4674cbb577551
2021-08-05 15:48:26 -07:00
Umherirrender
d87dc4d99a Change Title::mNamespace to ::getNamespace() in EditPage
Change-Id: I852309cc88c2cddbd19c5c51c1f9c4be642c3ae3
2021-08-04 05:18:55 +02:00
TChin
fa5d3dba51 Support fluent interface for StatusValue
Also refactored some calls to use it.

Bug: T287485
Change-Id: If9e96ce87dc3f3641e9b3ebe093f92d8fa49b9ee
2021-08-02 15:14:11 -04:00
jenkins-bot
eb58fa9d82 Merge "Move Content::preSaveTransform to ContentHandler" 2021-07-29 19:25:28 +00:00
Petr Pchelko
b782a7e66d Move Content::preSaveTransform to ContentHandler
Create ContentTransformer to access ContentHandler::preSaveTransform through the service.
Prepare object to hold a data that required for ContentHandler::preSaveTranform params.

This will require making a semi-backwards-incompatible
change no matter what, we don't really have a great way
of hard-deprecating overriding methods.

However, with the ContentHandler calling Content and
Content calling ContentHandler, and with the ProxyContent
trick to stop infinite recursion, it doesn't matter whether
callers use Content or ContentHandler. This will allow us
to naturally convert all callers. But won't really allow
hard-deprecation.

Bug: T287156
Change-Id: If6a2025868ceca3a3b6f11baec39695e47292e40
2021-07-29 18:06:02 +03:00
jenkins-bot
56a2c16e48 Merge "Add missing spaces to imploded debug strings" 2021-07-28 13:44:04 +00:00
Matěj Suchánek
d71ff53639 Add missing spaces to imploded debug strings
Change-Id: I32d921aaa3a5799777ff62b35608cbedcfff907d
2021-07-28 11:07:17 +02:00
libraryupgrader
5357695270 build: Updating dependencies
composer:
* mediawiki/mediawiki-codesniffer: 36.0.0 → 37.0.0
  The following sniffs now pass and were enabled:
  * Generic.ControlStructures.InlineControlStructure
  * MediaWiki.PHPUnit.AssertCount.NotUsed

npm:
* svgo: 2.3.0 → 2.3.1
  * https://npmjs.com/advisories/1754 (CVE-2021-33587)

Change-Id: I2a9bbee2fecbf7259876d335f565ece4b3622426
2021-07-22 03:36:05 +00:00
Petr Pchelko
0d75fdb4f7 Use CsrfTokenSet as CSRF token source
Change-Id: I079d2c802d9b48d6abf7f37fa9ef7dafac631345
2021-07-12 14:19:15 -07:00
jenkins-bot
c309a5dd25 Merge "Remove the fallback for create rights (covered in PM edit rights check). Remove key to i18n message, no longer being used." 2021-06-30 15:16:39 +00:00
Roman Stolar
6ebaa5caf6 Remove the fallback for create rights (covered in PM edit rights check).
Remove key to i18n message, no longer being used.

Bug: T272079
Change-Id: Id6566e5241b06ba377c2eca083221ee02556365f
2021-06-30 17:30:30 +03:00
jenkins-bot
9e09b85044 Merge "EditPage::displayPermissionsError always use exception if no content" 2021-06-29 02:57:34 +00:00
DannyS712
b45ddb2ab3 Use WikiPage::doUserEditContent() instead of ::doEditContent()
Results in passing a user where previously the fallback
to $wgUser was being used, mostly in tests.

Bug: T255507
Change-Id: Iabe24315b23c0ad1272353186425e71974528d23
2021-06-28 00:11:30 -07:00
DannyS712
47d70dbfba Post Revision-removal cleanup
Updates for the removal of the Revision class itself
and the various methods/hooks/variables removed in the
process, including:

- Update some documentation removing most references
to the Revision class and updating the MCR migration
notes to reflect the past tense for Revision methods.

- Change some capitalization from "Revision" to "revision"
to make it clear comments are about revisions in general,
not the Revision class in particular.

- Minor code tweaks including removing unused variables that
were around for the old hooks that were removed, and
removing the use of DeprecatablePropertyArray where no
longer needed for anything.

- Fix incorrect documentation for PageUpdater::getStatus(),
the status value changed a while ago to have revision-record
in addition to revision, and recently to only have the
revision-record, but ironically PageUpdater was never updated.

- Removed Parser::$mRevisionObject, used to be a Revision object
and was deprecated in 1.35, missed earlier because it was no
longer being set to Revision objects, always null.

- Add RevisionRecord typehints in DummyLinker to match those
in the corresponding Linker methods

This should be a no-op in terms of functionality.

Bug: T247143
Change-Id: I03bbb94fc29085855448780b1a5ad9063911ecc4
2021-06-24 00:32:39 +00:00
Thiemo Kreuz
2ba01c7ee7 Remove some more comments that literally repeat the code
… including PHPDoc tags like `@return <type> $variableName`.
A return value doesn't have a variable name. I can see that
some people do this intentionally, repeating the variable
name that was used in the final `return $var;` at the end
of a method. This can indeed be helpful. I leave a lot of
these untouched and removed them only when it's obviously
wrong, or does not provide any additional information in
addition to what the code already says.

Change-Id: Ia18cd9f25ef658b08ad25b97a744897e2a8deffc
2021-06-18 21:23:56 +00:00
Petr Pchelko
eccd347da9 Hard-deprecate User::matchEditTokenNoSuffix
This feature was added to provide a custom error message
if the edit token was present, but trailing slashes were
stripped from it by some ASCII mangling proxy. According
to metrics this has happened 5 times last month, which
IMHO doesn't justify having special handling. Giving a
regular token mismatch error message should be good enough.

Depends-On: Ieb4f6e25a74ecaa1110c59a8d8eed3ca792f2d41
Change-Id: I85759e315581f891721dfac246daaafe956ab201
2021-06-18 09:42:24 -07:00
Petr Pchelko
92564edc7c Use Message::page instead of Message::title
Also modified new APIs added to ApiErrorFormatter to
use PageReference instead of Title.

Change-Id: I093c89f8e1e6d383603f887358be6ece70f23a02
2021-06-09 13:18:22 +00:00
jenkins-bot
96c6af6878 Merge "Use null coalecing operators everywhere consistenctly." 2021-06-04 15:31:52 +00:00
Bartek Łukawski
e712f75cb8 EditPage: Fix raw asterisk in multi-error message box
A status object may return multiple error messages, encoded as a
wikilist of *-items by `getWikiText`. Without a leading newline, the
first asterisk is not parsed and therefore displayed as-is in the
resulting HTML.

See also: 9b530b2b5a

Bug: T282810
Change-Id: Ifc0a3ae32598ea4f8738cd13798ea4cdf4c0cd98
2021-06-04 11:45:10 +00:00
Petr Pchelko
0dfa846653 Use null coalecing operators everywhere consistenctly.
Auto-generated with rector.

Change-Id: I4f27e10cf029bb067b7bc57d82f7a64e21ea8d42
2021-06-03 21:42:06 -07:00
Petr Pchelko
dbc198e303 Remove EditPage::buildTextboxAttribs, protected and unused
Change-Id: I104ea008d1e4038e49eaaa63298e71ee204e3b61
2021-06-02 18:41:33 -07:00
DannyS712
c80841f58b Remove comments that repeat the code
Don't provide any addition information

Change-Id: I4f474537056e34bac74b0d0cd5b4beb800664f90
2021-06-02 08:03:09 +00:00
Thalia
23b9b9c61b Specify DB to query when checking if a user is blocked from a page
When calling PermissionManager::isBlockedFrom, don't query the
primary database when only showing UI elements.

Bug: T283268
Change-Id: I9a79badf8a7cfb6afc7b4d12e4f1fbb5c24b6a86
2021-05-24 16:22:17 +01:00
James D. Forrester
f2f9345e39 Replace uses of DB_MASTER with DB_PRIMARY in documentation and local variables
This is just a start.

Bug: T254646
Change-Id: I9213aad4660e27afe7ff9e5d2e730cbf03911068
2021-05-14 12:40:34 -07:00
Thiemo Kreuz
6805f39a30 Remove unused default values from class properties
In all these cases the property is unconditionally set in
the constructor. The extra initialisation is effectively
dead code and an extra source of errors and confusion.

Change-Id: Icae13390d5ca5c14e2754f3be4eb956dd7f54ac4
2021-05-12 13:44:28 +02:00
daniel
753b1bcaff Introduce Block interface and replace AbstractBlock.
In order to allow Authority to know about user blocks,
we need a narrow interface to represent such blocks.

This deprecates some methods on AbstractBlocks in favor
of new methods on the Block interface that avoid binding to
the User class.

Bug: T271494
Change-Id: I7bb950533970984a014de0434518fbbefb695131
2021-05-11 11:36:11 +02:00
Tim Starling
7430e278c6 EditPage::getExpectedParentRevision(): guard against null edittime
Document the fact that EditPage::$edittime can be null, and guard
against a type mismatch error in getExpectedParentRevision() which is
hit if EditPage::$edittime is null and EditPage::$editRevId is a value
that is false when converted to boolean.

Bug: T277204
Change-Id: Ibc9500a314ddfd99452d6c03d8906f69cdebc0e4
2021-05-06 11:38:30 +10:00
mainframe98
23cc232837 SECURITY: Fix XSS vulnerability in EditPage and ProtectionForm
The documentation of OutputPage::wrapWikiMsg says it is
equivalent to OutputPage::addWikitextAsInterface called
with wfMessage()->plain(). This is correct, as it parses
it in addWikitextAsInterface. If used with addHtml, no
parsing/escaping is done automatically.

Follow-up to I83f2828bcde160c98a1d97e783a869e64fb4c6ea.

(NOTE: the above, related change set is NOT currently
on a wmf production release branch.  So this issue only
exists on master for now.  This should all be resolved
when both are part of the cut for wmf.4 next week.)

Bug: T281595
Change-Id: Ia6c7a7447e5cea903be9f5d9e76320ea56fedd4c
2021-05-01 01:16:35 +00:00
DannyS712
c0dd682544 Start removing places using Revision objects
- EditPage::$mBaseRevision
- EditPage::getBaseRevision()
- Title::getFirstRevision()
- LinksUpdate::setRevision()
- LinksUpdate::getRevision()
- Article::$mRevision
- Article::getRevisionFetched()
- WikiPage::getOldestRevision()
- WikiPage::getRevision()
- ContribsPager::tryToCreateValidRevision()

To make things easier, instead of rewritting
the Revision tests that were using WikiPage::getRevision,
just delete them, its not worth the effort to rewrite
them since the class is going away. For the WikiPage
tests, replace uses of getRevision with getRevisionRecord,
manually converting to a Revision object where needed

Bug: T247143
Change-Id: I52bc1f49649f8bd25797e3f7a090bec9c63ac2d1
2021-04-30 12:33:15 -07:00
James D. Forrester
df5eb22f83 Replace uses of DB_MASTER with DB_PRIMARY
Just an auto-replace from codesniffer for now.

Change-Id: I5240dc9ac5929d291b0ef1c743ea2bfd3f428266
2021-04-29 09:24:31 -07:00
DannyS712
440e2b35d4 EditPage::displayPermissionsError always use exception if no content
Bug: T281400
Change-Id: Ia6ef0fcc6344a94961eaaf57f7effbbabd6e4660
2021-04-28 18:46:45 +00:00
Tim Starling
83e184670c Stop using legacy ActorMigration field "log_user"
Bug: T278917
Change-Id: I1b78bad7e1fa43f5f82908567a7daad9c6cc79b9
2021-04-28 16:29:04 +10:00
mainframe98
c87462097c Don't use classes error, success and warning outside parser
Bug: T280766
Change-Id: I83f2828bcde160c98a1d97e783a869e64fb4c6ea
2021-04-27 17:11:14 +02:00
Petr Pchelko
61599cd74a Clean up hard-deprecated Parser methods returning Revision
Bug: T278376
Change-Id: Ia4b5ab71c1df20e07dbfa3465be022225e8b44c1
2021-04-26 13:59:53 -07:00
vladshapik
9cc797695b Hard deprecate User ::isIP, ::getOptions
Bug: T275602
Change-Id: Id4be13751ca0a900e51214c1855a4624077a5a62
2021-04-26 16:10:24 +00:00
Cindy Cicalese
fb6b6e058c Fix parameter order of setWatch to match add/removeWatch
Change-Id: I0ea63482a5cab24c23b49b8bbe6c80bdbe8b102b
2021-04-21 04:41:38 +00:00
Cindy Cicalese
a384acffa7 Use WatchlistManager in several classes
Change-Id: I720629e08373736b5fc1e12563b5059311b113e1
2021-04-21 00:37:40 -04:00
Petr Pchelko
021206c232 User: use ActorNormalization to insert actor
While creating users, we have several interesting corner cases:

- When creating a new User, we actually rely on the 'unique'
constraint on actor_name. This is important if something calls
'User::createNew' with a name that is already occupied by an
existing anon actor with no user. This is quite a weird corner case,
but there's a test for that. We could probably assimilate this
nicly in actor store by checking whether the user id in the database
for the actor we found is the same as user id in the passed in user identity.
- Even more interesting use-case is 'subsuming' existing actors with
reserved user names. When we call User::newSystemUser, and there is
already an actor with the same reserved name, we 'subsume' that actor
and take over it's actor_id for our new system user. This can now be
done with an upsert. This state of having reserved actor with no user
is not easy to cause, but imports or updating from old MW versions
seem to be able to produce this state. Archeology revealed that
'subsuming' existing actor was added for installer.

Change-Id: I16b2f088217db0283215fc2ef5fb04a3742e1626
2021-04-15 13:42:39 -07:00
DannyS712
d24f7ad8be Remove hard deprecated EditPage spam regex methods
::matchSpamRegex and ::matchSummarySpamRegex,
hard deprecated in favor of the SpamChecker service

Change-Id: I90dca38abf1ef3411dd06138fdec198724de31fe
2021-03-29 17:38:55 +00:00
DannyS712
8b7c992235 Add WatchedItemStore::maybeEnqueueWatchlistExpiryJob
Replaces ::enqueueWatchlistExpiryJob which is hard deprecated
New method checks if watchlist expiration is enabled, and if
so enqueues the job based on the $wgWatchlistPurgeRate,
instead of forcing calls to handle that logic

Change-Id: I07a96941efd1a240846284d5c86db66c6ba45156
2021-03-25 15:57:03 -04:00
Petr Pchelko
cf763fe116 Drop most hard-deprecated methods in Article
Bug: T239975
Change-Id: I6ca9fbaa699d0465a59e86abbf2bca6bbdb69c01
2021-03-24 19:34:41 +00:00