Commit graph

442 commits

Author SHA1 Message Date
Amir Sarabadani
1f695f0368 user: Clean up most calls to LoadBalancer in user-related services
Bug: T330641
Change-Id: Iab0b4a6fca493e003a57df2d85628118ed5ab2fe
2023-06-01 16:56:22 +00:00
Func
4d1da6f7f8 phpunit: Update @covers annotations for namespaced classes
We renamed many classes to be namespaced, but the `@covers` and
`@coversDefaultClass` annotations weren't updated properly.

PHPUnit didn't support short cover annotations with `use` statements,
these didn't trigger any errors yet, because they are class alias.

This patch is populated by a modified version of PhpunitAnnotationsSniff.

Change-Id: I6c602290a30099239b17d2dc0d67b1488b4eaeeb
2023-05-27 17:43:12 +08:00
Umherirrender
a80ba187db Merge "Revert "user: Assert wikiId in UserGroupManager"" 2023-05-21 12:28:09 +00:00
Umherirrender
99614fb88c Revert "user: Assert wikiId in UserGroupManager"
This reverts commit b565ab8404.

Reason for revert: CentralAuth not ready for this assertion

Change-Id: Ic59efaf8ea0e2807fef7ead58f27c6e03ab8913c
2023-05-21 12:26:15 +00:00
jenkins-bot
37ee7ad14e Merge "user: Assert wikiId in UserGroupManager" 2023-05-21 10:09:18 +00:00
Alexander Vorwerk
9bbf2f6023 UserIdentityValue: Always throw a deprecation warning on passed actor id
Bug: T274179
Change-Id: Ibc5bd56cd41153591b0ee701cc1f92608e7c188c
2023-05-20 11:16:18 +03:00
Tim Starling
87160074d0 In User::clearInstanceCache() mark the $reloadFrom parameter as loaded
UserTest::testUserId() was failing when run alone, because getId() was
always fetched from the database following setId(), and the test does
not write it to the database.

It passed when run with other tests since more than 7 users were present
in the database since the last truncate. Adding 'user' to tablesUsed
makes the failure reproducible.

It makes sense for setId() to mark 'id' as loaded, by analogy with
UserFactory::newFromId(). The test failure seems valid.

Fixing it in clearInstanceCache() instead of setId() seems correct to
me. There are only two callers of clearInstanceCache() with
$reloadFrom set to a field name in core and WMF deployed extensions.

So, when clearInstanceCache() is called with the name of a field to
reload from, mark that field as already loaded.

Depends-On: Iabe011bf796016b357ab2a317b810bea2568a9f5
Change-Id: Ibbf753d318a376c7c5819930dd5669d0e44eda30
2023-05-11 20:03:23 +10:00
jenkins-bot
a0fc14fe62 Merge "Update UserOptions classes to prevent temporary users having access to preferences" 2023-05-04 15:35:09 +00:00
Umherirrender
b565ab8404 user: Assert wikiId in UserGroupManager
For interwiki userright changes a UserRightsProxy instance is passed to
UserGroupManager. UserRightsProxy does not implement a check for wikiId
in getId().
Without the check for the wikiId and the extra argument to getId() it is
not possible to pass non-local instances of UserIdentityValue to
UserGroupManager.

Bug: T255309
Change-Id: Ice67ff4337165c0f022267186c88332e0e574869
2023-05-04 00:39:24 +02:00
AnaïsGueyte
3e6c366fdc Update UserOptions classes to prevent temporary users having access to preferences
Bug: T332415
Change-Id: I232a7acf870068cdc3ee3532f7ed928079863ce2
2023-05-03 18:43:19 +00:00
Amir Sarabadani
e3e329f686 user: Switch Database::delete to DeleteQueryBuilder
Change-Id: I9a3f9bae80560c56197606a46ba29ad85a5a1844
2023-04-30 00:33:24 +02:00
Tim Starling
be3018b268 Just another 80 or so PHPStorm inspection fixes (#4)
* Unnecessary regex modifier. I agree with this inspection which flags
  /s modifiers on regexes that don't use a dot.
* Property declared dynamically.
* Unused local variable. But it's acceptable for an unused local
  variable to take the return value of a method under test, when it is
  being tested for its side-effects. And it's acceptable for an unused
  local variable to document unused list expansion elements, or the
  nature of array keys in a foreach.

Change-Id: I067b5b45dd1138c00e7269b66d3d1385f202fe7f
2023-03-25 00:39:06 +00:00
Tim Starling
5e30a927bc tests: Make some PHPUnit data providers static
Just methods where adding "static" to the declaration was enough, I
didn't do anything with providers that used $this.

Initially by search and replace. There were many mistakes which I
found mostly by running the PHPStorm inspection which searches for
$this usage in a static method. Later I used the PHPStorm "make static"
action which avoids the more obvious mistakes.

Bug: T332865
Change-Id: I47ed6692945607dfa5c139d42edbd934fa4f3a36
2023-03-24 02:53:57 +00:00
libraryupgrader
7375f3a5fe build: Updating mediawiki/mediawiki-codesniffer to 41.0.0
The following sniffs are failing and were disabled:
* MediaWiki.Usage.ForbiddenFunctions.eval

Change-Id: I6fd0a9296c88a77c3abec6e5e8d568bb469c2d6e
2023-03-11 19:04:09 +00:00
James D. Forrester
ad06527fb4 Reorg: Namespace the Title class
This is moderately messy.

Process was principally:

* xargs rg --files-with-matches '^use Title;' | grep 'php$' | \
  xargs -P 1 -n 1 sed -i -z 's/use Title;/use MediaWiki\\Title\\Title;/1'
* rg --files-without-match 'MediaWiki\\Title\\Title;' . | grep 'php$' | \
  xargs rg --files-with-matches 'Title\b' | \
  xargs -P 1 -n 1 sed -i -z 's/\nuse /\nuse MediaWiki\\Title\\Title;\nuse /1'
* composer fix

Then manual fix-ups for a few files that don't have any use statements.

Bug: T166010
Follows-Up: Ia5d8cb759dc3bc9e9bbe217d0fb109e2f8c4101a
Change-Id: If8fc9d0d95fc1a114021e282a706fc3e7da3524b
2023-03-02 08:46:53 -05:00
Func
f81ab9545a Replace some use of Language::truncateForDatabase() with mb_strcut()
For MessageContent::getTextForSummary(), the behaviour is exactly
the same;
For WikiPage::insertRedirectEntry(), the trailing ellipsis would
prevent landing on the position of the anchor;
For UserOptionsManager::saveOptionsInternal(), I also found the
trailing ellipsis is unnecessary, follow-up to commit 2a51865.

Bug: T326696
Bug: T207876
Change-Id: I2ec1878147cb0447794d2404db632733f83164cd
2023-01-30 04:50:33 +00:00
Umherirrender
2a51865efe user: Truncate option value in UserOptionsManager
To avoid truncation by the database,
which can result in broken utf-8 letters and would break on strict mode.

This is just the backend part. The api should validate and provide a
better message to the user instead of hard truncation without feedback

Bug: T326696
Change-Id: Id80c81956f78f87f4a97bd03f467a194d826fb42
2023-01-18 19:24:55 +00:00
Umherirrender
dabe7242f9 Hard-deprecate User::idFromName
Bug: T325687
Change-Id: I5dc13586c11ad49cd7c2646a65e103bb52f28512
2023-01-14 13:06:23 +01:00
Umherirrender
4dcdb06a70 UserOptionsManager: Avoid DB delete queries for unchanged default values
When calling UserOptionsManager to "change" an option to a value
equal to the default, when that option wasn't overriden (inherits the
default), it still sent a delete query to the database when we knew
the row doesn't exist.

Bug: T301506
Change-Id: I9bd1f188a977d966b40c1320c105dbc9bfd0eb3c
2023-01-06 22:54:20 +00:00
Timo Tijhof
4ef0891994 rdbms: Consolidate logger channels into one
Notable changes:

* In SqlBagOStuff::getConnectionFromServerInfo, only two loggers were
  injected. The rest implicitly got a NullLogger due to being absent.
  These are now effectively unsilenced.

* Database::__construct() required almost all parameters, even the
  loggers. I've wanted to move some of DatabaseFactory into the ctor
  here for a while. In order to make this change not a breaking
  change, the new 'logger' parameter is optional with NullLogger as
  default. This allowed some of the test cases, which were simply
  passing NullLogger, to be fixed by passing nothing instead of
  passing the new option name.

  The Database class is behind a dozen layers of indirection for
  real use, so this will still be injected just fine (DBF, LB, LBF,
  MWLBF, etc.).

* In LegacyLogger, the handling for $wgDBerrorLog was previously
  limited to DBConnection and DBQuery. This now includes errors
  from other (generally, newer) parts of Rdbms as well, which were
  previously missing.

  This only affects sites (typically CI and dev setup) where
  $wgDBerrorLog is used, as opposed to the more common
  $wgDebugLogGroups by-channel configuration.

* TransactionProfiler gets its logger injected in a rather odd way,
  via entrypoints (MediaWiki.php, ApiMain.php, and MaintenanceRunner)
  as opposed to service wiring. This is kept as-is for now.

* In LBFactoryTest, in particular testInvalidSelectDBIndependent2,
  there are cases that intentionally produce failures of which
  the result is then observed. In CI we assert that dberror.log is
  empty so instead of adding the missing logger fields to that
  LBFactory instance, the only one set (replLogger) is removed.
  The alternative is to set 'logger' now, which would naturally
  cause CI failures due to unexpected entries coming through to
  non-mocked error log.

Bug: T320873
Change-Id: I7ca996618e41b93f488cb5c4de82000bb36e0dd3
2023-01-03 22:46:38 +00:00
jenkins-bot
ad0423a253 Merge "Hard-deprecate User/PermissionManager group permissions lookup functions" 2022-12-23 01:55:51 +00:00
Umherirrender
c0794e1b6e Hard-deprecate User/PermissionManager group permissions lookup functions
- User::getGroupPermissions
- User::getGroupsWithPermission
- User::groupHasPermission
- PermissionManager::getGroupPermissions
- PermissionManager::getGroupsWithPermission
- PermissionManager::groupHasPermission

Bug: T325680
Change-Id: If9ae610037f049050c21ad0eab7bcb4d6e596f29
2022-12-21 21:15:00 +01:00
Umherirrender
e942074349 user: Hard-deprecate User::incEditCount
Bug: T325682
Change-Id: I700979b54b089ced057e608591c179f639d1f8e5
2022-12-21 18:33:44 +01:00
Amir Sarabadani
cb18d1007e Reorg: Move ActorMigration and ActorMigrationBase to user/
This may seem a bit weird but anything else related to actor is already
under user/ including ActorCache, ActorNormalization, ActorStore and
ActorStoreFactory.

Bug: T321882
Change-Id: I7072b374bba7a0cd9d905e399c822bf30bd5c0d8
2022-12-16 13:44:33 +01:00
jenkins-bot
0eb7ae14be Merge "Remove unused parameter from PasswordResetTest" 2022-12-01 23:04:05 +00:00
jenkins-bot
1d045146d0 Merge "Make use of the new PageUpdateStatus" 2022-12-01 10:45:32 +00:00
daniel
166b569444 Make use of the new PageUpdateStatus
PageUpdateStatus provides clean access the the newly created
RevisionRecord.

Depends-On: Ia08c586198082ea47e8313d0d41835f9830fb29e
Change-Id: Id6963842321c4eaa3d7d029ad0b769f73433c103
2022-11-30 17:56:58 +00:00
Thalia
bdbb8cf359 Remove unused parameter from PasswordResetTest
Follow-up to 9ca7247af0

Change-Id: Ie02f5acd4156297127f278ba7f0df89e58fb60b4
2022-11-28 15:38:59 +00:00
csimiyu
9ca7247af0 Deprecate global-blocks-specific methods and hook
Bug: T317337
Change-Id: If7cfb8faaf62c1a7169b1a1cc1f344ea83857836
2022-11-28 15:33:44 +00:00
Umherirrender
c6fecd5ab0 tests: Replace assertEmpty with assertSame
assertSame avoids use of loose comparisons and
allows to check the expected type

Change-Id: If821d1be2bc1ff9f8b70968a339f33c7a8e8880a
2022-11-25 00:42:53 +01:00
Reedy
116b71452c tests: Simplify some nested ->will( $this->return assertions
Change-Id: Ic861ce5604784b7fa600844d81387b84230bc0e1
2022-11-12 11:57:12 -07:00
Amir Sarabadani
bbe704b5c1 Reorg: Move some of request related classes to MediaWiki/Request
Redoing I5ea70120d74 but without moving WebRequest that caused issues
with phan-taint-plugin.

Moving:
 - DerivativeRequest
 - FauxRequest
 - FauxRequestUpload
 - PathRouter
 - WebRequestUpload

Bug: T321882
Change-Id: I832b133aaf61ee9f6190b0227d2f3de99bd1717b
2022-10-28 10:15:31 +00:00
Zabe
f6b9381d7f Revert "Reorg: Move some of request related classes to MediaWiki/Request"
This reverts commit 2bdc0b2b72.

Reason for revert: T166010#8349431

Bug: T166010
Change-Id: Idcd3025647aec99532f5d69b9c1718c531761283
2022-10-27 13:14:16 +00:00
Amir Sarabadani
2bdc0b2b72 Reorg: Move some of request related classes to MediaWiki/Request
Moving:
 - DerivativeRequest
 - FauxRequest
 - FauxRequestUpload
 - PathRouter
 - WebRequest
 - WebRequestUpload

Bug: T166010
Change-Id: I5ea70120d745f2876ae31d039f3f8a51e49e9ad8
2022-10-26 16:49:10 +02:00
Umherirrender
f1db4bed17 tests: Use MediaWikiIntegrationTestCase::editPage for edits
Change-Id: I1db7294635bb85e03841c4f7b100e2243ddf013b
2022-09-23 22:49:59 +02:00
jenkins-bot
14308cd393 Merge "tests: Remove unused UserTest::makeEdit" 2022-09-11 11:03:23 +00:00
vladshapik
c7167284e8 Drop User methods which were deprecated since 1.38
The following User methods, deprecated in 1.38, have been removed:

* ::blockedBy
* ::getBlockId

Bug: T277511
Change-Id: I00e2fec4ababa3f9c12dee34c3d922d18e1c78d7
2022-09-05 15:29:14 -04:00
Umherirrender
9f17921627 tests: Remove unused UserTest::makeEdit
Change-Id: I6e89050fc501022a87c4625d8f22f022d2273e1d
2022-09-01 21:23:29 +00:00
Derick Alangi
d4ae3e8839 tests: Migrate away from setMwGlobals() to overrideConfigValue(s)()
Change-Id: I1b0e8e2cf4d85ae5ce8ad090cfc47f5086350702
2022-08-14 22:23:25 +01:00
jenkins-bot
9e41475b9b Merge "user: Move logic for unregistered HTTPS pref to User::requiresHTTPS()" 2022-08-06 22:11:39 +00:00
Umherirrender
a1ecd99fd3 user: Move logic for unregistered HTTPS pref to User::requiresHTTPS()
Move the User::isRegistered call into the function to let all callers
benefit from that check. This is more than an error check, it also is
business logic representing the effective default for unregistered users
which is non-obvious and benefits from being written down as part of
a central contract.

Update tests as the user must exists on the database to have
preferences.

Change-Id: Ibacdd642d03031d9659a821045788046f0187518
2022-08-06 21:50:32 +00:00
Thiemo Kreuz
61ae7504df Replace trivial usa of mock builder with createMock() shortcut
createMock() does the same, but is much easier to read.

A small difference is that some of the replacements made in this
patch didn't use disableOriginalConstructor() before. In case this
was relevant we should see the respective test fail. If not we can
save some CPU cycles and skip these constructors.

Change-Id: Ib98fb06e0fe753b7a53cb087a47e1159515a8ad5
2022-07-15 16:43:48 +00:00
daniel
c30bcd370f Move rate limiting tests into RaterLimiterTest
The test cases for the rate limiting logic should not live in
UserTest.

Change-Id: Iae056a6127787404d883ce40997fd7b66f8fe14c
2022-07-06 12:30:44 +02:00
jenkins-bot
db4a5d4e71 Merge "Extract RateLimiter from User" 2022-06-28 06:19:17 +00:00
daniel
dd2e9905cd Extract RateLimiter from User
This moves the logic for rate limiting out of the User class into a
standalone service.

Change-Id: I2881913876c855a1538bac92f0dabac3b3bddcfc
2022-06-27 13:23:24 +00:00
Matěj Suchánek
857d9d80f9 Hard deprecate User::blockedFor
Deprecated since 1.35, unused in Wikimedia code.

Change-Id: I79eb801331f4ff7d02332b9aa7c085ac0564d9d5
2022-06-21 22:49:50 +02:00
Umherirrender
770f905900 tests: Use namespaced IDatabase class
Change-Id: I7171ff26faee00d9eaabc33c2f3d91049ea0b40d
2022-05-28 00:09:55 +02:00
Umherirrender
de47d93928 Get the MainConfig from MediaWikiServices instead of RequestContext
The getConfig of a ContextSource should only be used, if the
ContextSource is available. Getting the global context just for the
config looks harder to fix/inject as using the MainConfig from
MediaWikiServices

Change-Id: Iaf14bfc7bd68cc315672e1c256887faf87e22542
2022-05-24 21:54:21 +00:00
Tim Starling
d6a3b6cfa8 TempUser EditPage and permissions
* Allow EditPage to create a user on page save. This has to be enabled
  in config and then activated by the UI/API caller.
* Add an autocreate source for temporary users.
* Allow editing by anonymous users via automatic account creation when
  $wgGroupPermisions['*']['edit'] = false. On an edit GET request, use
  an unsaved placeholder user to stand in for post-create permissions.
* On preview or aborted save, the username to be created is stashed in a
  session and restored on subsequent requests.
* On a (likely) successful page save, create the account.
* Put regular non-temporary users in a "named" group so that they can be
  given additional permissions.
* Use a different "~~~" signature for temporary users
* Show account creation warnings on edit and preview.

Change-Id: I67b23abf73cc371280bfb2b6c43b3ce0e077bfe5
2022-04-26 14:10:53 +10:00
Tim Starling
e8dbf5f80c TempUser infrastructure and services
Add services and utilities for automatic creation of temporary user
accounts on page save, in order to avoid exposing the user's IP
address.

* Add $wgAutoCreateTempUser, for configuring the system
* Add TempUserConfig service, which interprets the config.
* Add TempUserCreator service, which creates users during page save as
  requested by EditPage. With proxy methods to TempUserConfig for
  convenience.
* Add table user_autocreate_serial. Table creation is necessary before
  the feature is enabled but is not necessary before deployment of this
  commit.

Bug: T300263
Change-Id: Ib14a352490fc42039106523118e8d021844e3dfb
2022-04-14 09:23:55 +10:00