Commit graph

5 commits

Author SHA1 Message Date
Petr Pchelko
e2676906a8 Make REST CORS allowed headers respect site configuration.
Bug: T268791
Change-Id: I4f10e508730baf5ce276bb71dc354554eed3cfb0
2021-05-30 10:15:47 -07:00
Thiemo Kreuz
f36808dddc Use UserIdentityValue in tests where possible
… instead of PHPUnit mocks. The tiny value class is made for
this.

Change-Id: Ie04cde57126fcafabf8906f9644c6e80345d8a48
2021-04-22 09:32:43 +02:00
Thiemo Kreuz
2f66b3754f tests: Remove @param docs from test code that just repeat the signature
These are not only 100% identical to the actual code, but also:
* It's error-prone. Some are already wrong.
* These test…() functions are not meant to be called from
  anywhere. What is the target audience for this documentation?
* There is a @dataProvider. What such @param tags actually do is
  document the provider, but in an odd place. Just looking at
  the provider should give the same information.
* The MediaWiki CodeSniffer allows to skip @param when there is
  a @dataProvider, for the reasone listed.

Change-Id: I0f6f42f9a15776df944a0da48a50f9d5a2fb6349
2021-01-21 03:41:23 +00:00
Umherirrender
0347fd0631 Improve some function documentation in tests
Also fix some whitespaces

Change-Id: Ibed50a4f07442d3f299cf545c16f5dbb5f27a411
2021-01-14 22:13:55 +01:00
David Barratt
c36b320454
Handle CORS preflight request and prevent anon users from unsafe methods
Creates an OPTIONS handler that handles any OPTIONS requests that are
not already handled by a handler. CORS has no mechanism to ensure the
user is authenticated, so the Router will reject cross-origin requests
from anon users.

This change allows authenticated users to make cross-origin
requests if they authenticate with OAuth or if
$wgRestAllowCrossOriginCookieAuth is enabled.

Bug: T232176
Bug: T262712
Change-Id: I128b4bdbec4f6bea35142153c951fd7b79617106
2020-09-21 19:29:40 -04:00