Commit graph

294 commits

Author SHA1 Message Date
Ammarpad
77165e665e ApiEditPage: Harden content model mismatch checks
Bug: T290607
Change-Id: Ibced84ae6ee1648a3b8bcf616c3c0561394a3fdc
2021-10-02 21:13:51 +01:00
Kunal Mehta
a85f569dd1 Revert "Use CsrfTokenSet as CSRF token source"
This reverts commit 0d75fdb4f7.

Bug: T287542
Change-Id: Iedd3461869f973f8d621a39e6ad4674cbb577551
2021-08-05 15:48:26 -07:00
Petr Pchelko
0d75fdb4f7 Use CsrfTokenSet as CSRF token source
Change-Id: I079d2c802d9b48d6abf7f37fa9ef7dafac631345
2021-07-12 14:19:15 -07:00
Umherirrender
773f6b6322 api: Replace deprecated User::getOption in ApiEditPage
Change-Id: Ic20c8c6402d80ca8b5a426b3d10fbe3efb0e89a4
2021-07-06 23:10:28 +02:00
Umherirrender
d146800ee8 api: Inject services into ApiWatchlistTrait
Bug: T259960
Change-Id: I73596f8c924ec4a02a7042608d19a35f82bb752a
2021-07-06 20:15:30 +00:00
Umherirrender
c9319f7b55 api: Replace deprecated WikiPage::factory in ApiEditPage
Change-Id: Ic62d9144f64c32a3d403984a0e04f590c9a67188
2021-07-02 14:35:14 +02:00
Umherirrender
576ccf392d api: Inject services into ApiEditPage
Bug: T259960
Change-Id: Idf6eee7fed14495a8ab6e05a768fcb28178a4c2f
2021-06-30 22:30:28 +02:00
Roman Stolar
6ebaa5caf6 Remove the fallback for create rights (covered in PM edit rights check).
Remove key to i18n message, no longer being used.

Bug: T272079
Change-Id: Id6566e5241b06ba377c2eca083221ee02556365f
2021-06-30 17:30:30 +03:00
Bartosz Dziewoński
2361889b78 Use the edited page's title for magic words in action=edit error messages
Allow specifying the title used for rendering error messages in
ApiErrorFormatter.

Then, specify one in ApiEditPage (and a few similar modules that deal
with single pages) once we've figured out which page is being edited.

Bug: T247661
Change-Id: Ic3d70efc23744ef6e90abc445f3babebf45c4697
2021-05-21 18:00:36 +02:00
Umherirrender
cf541752e0 Add comment to fall-through cases in switch
Fix new coming sniff
PSR2.ControlStructures.SwitchDeclaration.TerminatingComment

Bug: T182546
Change-Id: I3f8d43c730981d8faaa72910d7f3b58a14a8372f
2021-04-15 17:31:12 +00:00
DannyS712
3413868d0d Clean up some logic in ApiEditPage
Should be a no-op

Change-Id: I292aa153eb0bf4fdda099995073904c0c9c96d99
2021-04-12 05:36:10 +00:00
Petr Pchelko
ee7d3e9335 Convert ChangeTags public interface to Authority.
Bug: T275507
Change-Id: I3b7f99391ab299df2b046a2878010cf6afe7fed7
2021-02-24 14:09:16 -07:00
Thiemo Kreuz
ca56a3a1b8 Safe-guard switch possibly doing bad comparisons
Old PHP versions are fine doing a `switch` with anything, even
if the types don't match. This changed. More recent PHP versions
start to bring up notices and such when a `switch` accidentially
compares e.g. an object with an int.

Bug: T255177
Bug: T258790
Change-Id: Ib415bd2fb394b95b02737b6df50e4e1fbbc440d3
2021-02-10 19:42:25 +01:00
jenkins-bot
fab3c6ed57 Merge "ApiEditPage: Document that it is extended" 2020-10-06 18:50:01 +00:00
Ammar Abdulhamid
30b947ad5f Revert "Revert "ApiEditPage: Show existing watchlist expiry if status
is not being changed.""

This reverts commit 149e99f072.

It's not necessary to change the constructor now, the module is already
using service locator to fetch RevisionLookup and ContentHandlerFactory.

The WatchedItemStore can also be gotten from there, voiding the need for
altering the constructor now. As Daniel said in T259960#6380471 dependency
injection for API modules is good but not urgent.

Bug: T261030
Bug: T264200
Change-Id: I16aa942cc800cd66a2cd538680a02b10cb0b1bfe
2020-09-30 19:28:47 +00:00
DannyS712
bd7ecc3b06 ApiEditPage: Document that it is extended
To avoid future issues like T264200

Bug: T264200
Change-Id: I0eafbad96be5037fb7795559fe6a62e69d54f0c5
2020-09-30 16:47:11 +00:00
jenkins-bot
e3d4f1db9b Merge "Revert "ApiEditPage: Show existing watchlist expiry if status is not being changed."" 2020-09-30 16:12:48 +00:00
DannyS712
149e99f072 Revert "ApiEditPage: Show existing watchlist expiry if status is not being changed."
This reverts commit 07e547f47c.

Reason for revert: LiquidThreads extends the ApiEditPage class,
even though it shouldn't, and thus fails when the dependencies
are not injected.

Bug: T261030
Bug: T264200
Change-Id: Ib14f8a04bb6c723aa502a47ef9ccde6fe96a0ac7
2020-09-30 15:29:59 +00:00
jenkins-bot
1d49ad1e5b Merge "ApiEditPage: Don't swap undo and undoafter parameters" 2020-09-30 01:45:14 +00:00
Ammar Abdulhamid
07e547f47c ApiEditPage: Show existing watchlist expiry if status is not being changed.
Bug: T261030
Change-Id: I795db12aefeffb1cfbbe2ab00fbb19444df7d37b
2020-09-29 16:20:20 +01:00
Dov Alperin
a1cd498fdf ApiEditPage: Don't swap undo and undoafter parameters
This made it impossible to correctly undo changes if revision IDs are out of
order with respect to timestamps.

Removes block of code responsible for creating this bug, and updates tests to reflect the change

Bug: T190285
Change-Id: Id5837ed958023bdbf544ae0f79e2d5e05c94cc64
2020-09-21 19:08:20 +01:00
jenkins-bot
f78bf7963d Merge "Remove requirement for ApiWatchlistTrait to be in ApiBase." 2020-09-11 00:36:58 +00:00
Ammar Abdulhamid
cf004d524d Remove requirement for ApiWatchlistTrait to be in ApiBase.
This trait is not needed in ApiBase and its presence here is
proving to be problematic. See I795db12.

In this patch, the trait usage (more precisely the 'use statement')
has been removed from ApiBase and accordingly the signatures of
ApiWatchlistTrait::getWatchlistValue() and ::setWatch() have been
altered to now require User object.

With these changes, the abstract getUser() method in the trait is no
longer needed, so it has been removed also.

All core usages of the affected functions are fixed in this patch.

The trait is used in only one extension according to codesearch tool,
the extension will be fixed in  Ic22e163.

Bug: T262175
Bug: T248512
Follow-up: Ia18627b9824dca81f44f0571e8420d89b7626cf6
Change-Id: Idabcea71edfca9e7ed42000a258c99ff407873d4
2020-09-07 01:13:57 +01:00
Ammar Abdulhamid
7af5678847 API: Handle ContentHandler exception for content model mismatch
Ensure the content we are trying to save and the base content have
identical content models before proceeding to save so as to forestall
Exception that may be thrown by ContentHandler if it founds they're not.

There are two cases where the models are allowed to differ: Edit that
undoes content model change or edit that's meant to explicitly change
the model. The logic for these is handled separately and may succeed
or fail, but exception will not be thrown.

Bug: T255700
Change-Id: I8782732bb0fc3059693cd7035b7ebb43fd71d333
2020-09-04 03:41:58 +01:00
Ed Sanders
7683f7d839 Use strict (in)equality with namespaces constants when LHS is definitely an integer
Change-Id: I8fede00dfe1270d93c5d78d3c36e788cddfc8a99
2020-07-31 18:03:28 +01:00
jenkins-bot
28f0b2cfc8 Merge "EditPage: handle undoafter param properly" 2020-07-14 13:23:04 +00:00
MusikAnimal
6a898faed2 Add watchlist expiry support to applicable APIs
This introduces an ApiWatchlistTrait that refactors out common code
across APIs that allow you to watch pages. Some methods have been
migrated from ApiBase and changed completely, but codesearch suggests
they aren't being used outside the API modules in this patch.

Bug: T248512
Bug: T248514
Change-Id: Ia18627b9824dca81f44f0571e8420d89b7626cf6
2020-07-13 18:18:15 -04:00
Ostrzyciel
5bf2cf380b EditPage: handle undoafter param properly
This is to fix issues with reverts being marked incorrectly,
especially when using the undoafter param which, until this patch,
wasn't really supported.

Honestly, EditPage is such a mess that I'm not sure if this is good
or not, but I did a lot of manual testing and it seems to work fine.

WikiPage::doEditContent() now checks whether the provided original
revision really has the same content as the new revision. This was
previously the task of callers, but that doesn't make much sense to
me because:
* This task would fall on EditPage otherwise and it should be more
focused on the UI side of things, without too much worrying about
backend details.
* This would require adding another parameter to WikiPage::
doEditContent(), $undoAfterId. It would be only useful for multiple-
revision undos that are not top revisions. In all other cases it
would be the same as $originalRevId.
* An extra sanity check before applying the value to the PageUpdater
won't hurt. Who knows what crazy ideas extensions might have.

The test cases are almost identical to those written for
McrUndoAction, so I decided to group them in a single file.
This should cover most undo cases.

Bug: T256915
Change-Id: I78641b3de0a012af932ea38265b695362f1f8491
2020-07-08 21:46:04 +02:00
Reedy
12a3883a7b Fix SingleSpaceBeforeSingleLineComment
Change-Id: I285af438ce484af40741489797f20455726ec110
2020-05-11 00:57:11 +00:00
ArtBaltai
8426e984f9 Soft deprecate Page interface
Additionally, use Article::getPage() instead of relying on
Page interface proxy method in ApiEditPage, forgotten before

Bug: T239975
Change-Id: I01696a1b11b2ea5c3d94fcb9a42beea68eb7b804
2020-04-09 04:00:31 +00:00
Thiemo Kreuz
854d5bcd7f Replace isset() in if() conditions with ?? if possible
The basic idea is: The sequence `$var ?? 'default'` either uses the
value from the variable (or array element) if available, or falls back
to the default value. The resulting value is then used in the if()
condition.

if ( $var ?? true ) means the variable should default to true, if not
set.

This is mostly a style change.

In ApiEditPage the $params are impossible to not be set.

Change-Id: Id67b81744fa21fe22a2d2377259e426aab67c479
2020-03-23 09:28:07 +01:00
jenkins-bot
7932a7cb52 Merge "Remove usage of deprecated Revision from ApiEditPage" 2020-03-11 22:08:20 +00:00
daniel
3ebd55ed47 ApiEditPage: add baserevid parameter
This adds a baserevid parameter for detecting edit conflicts, as an
alternative to the less precise basetimestamp parameter. This is
introduced for parity with and use by the new REST api.

Bug: T230843
Bug: T34037
Change-Id: Id7565018f66860b5c2ba688777508db1b88700ae
2020-03-11 13:29:09 +01:00
Petr Pchelko
71ea5a36a2 Remove usage of deprecated Revision from ApiEditPage
Bug: T246284
Change-Id: Iee97229d2d5e2996077f86aa8b191a4ec0cd8e36
2020-03-06 21:03:57 -08:00
Tim Starling
a06e3d06b1 Fix some PHPStorm inspection warnings in includes/api
Notably:
* In ApiManageTags, I used a switch instead of a dynamic function name,
  so that the call graph will be correct.
* In ApiImageRotate, checkTitleUserPermissions() has always returned
  void, this was an error introduced in 4e6810e4a2

Change-Id: Iea22616b8e7e2e0cc804619a54f8690898b2cb82
2020-02-18 14:17:37 -05:00
ArtBaltai
30e54b3962 Introduce ContentHandlerFactory
Added:
- ContentHandlerFactory
Tests:
- PHPUnit
Changed
- Calls of changed and deprecated
- DI for some service/api
Deprecated:
- ContentHandler::* then similar to ContentHandlerFactory
- ContentHandler::getForTitle
- ContentHandler::$handlers

Bug: T235165
Change-Id: I59246938c7ad7b3e70e46c9e698708ef9bc672c6
2020-02-07 00:53:51 +03:00
James D. Forrester
0958a0bce4 Coding style: Auto-fix MediaWiki.Usage.IsNull.IsNull
Change-Id: I90cfe8366c0245c9c67e598d17800684897a4e27
2020-01-10 14:17:13 -08:00
Bartosz Dziewoński
88a723bd87 ApiEditPage: Fix error message for edit conflicts
The 'editconflict' message is used by the normal edit form, and it
expects a parameter (page name), which was never passed.
'edit-conflict' should have been used instead.

This doesn't change the error code, which is mapped in ApiMessageTrait
and it already has a case for 'edit-conflict'/'editconflict'.

Change-Id: Ic95af27a67b95310b27ec344503d0a5cd88d79a2
2019-12-13 15:46:41 +01:00
Brad Jorsch
9084591e10 ApiEditPage: Test for bad redirect targets
Apparently everything downstream assumes callers already handled
interwiki titles.

Bug: T239428
Change-Id: Ie54f366986056c876eade0fcad6c41f70b8b8de8
2019-12-04 19:22:41 +00:00
Daimona Eaytoy
d3252fc870 Fix new phan errors, part 5
Some of the errors are suppressed because they're phan false positives.
The idea behind this is that they'll be fixed in a future version of
phan, and we'll just have to remove the suppressions.

Note: I'm disabling UnusedPluginSuppression so that we can start suppressing
issues even if they're still disabled. The sniff should be re-enabled
as soon as we upgrade phan.

Bug: T231636
Change-Id: I0f7fa06a9e03fbb86c7a5eb6e50a850bb258a7f7
2019-10-18 20:45:53 +00:00
Umherirrender
f74400487f phan: Disable enable_class_alias_support
It is enabled for b/c in extensions, but not needed in core

Change-Id: I51dca12be9c77049f77563d9bf0edd07928c2300
2019-09-15 08:26:52 +00:00
Petr Pchelko
56c21d059c Remove usages of Title::get{Previous,Next}RevisionId
The methods were deprecated since 1.34.

Change-Id: Ib95ac1ba36a8ffd6b71ed67642d8abb2e3538bae
2019-09-13 09:49:13 -07:00
Daimona Eaytoy
e2e543f7c2 Unsuppress more phan issues (part 5)
Bug: T231636
Depends-On: I6e5fba7bd273219b1206559420b5bdb78734aa84
Change-Id: I50377746f01749b058c39fd8229f9d566224cc43
2019-09-01 09:48:31 +00:00
Daimona Eaytoy
e70b5b3309 Unsuppress other phan issues (part 4)
Bug: T231636
Depends-On: I58e67c2b38389df874438deada4239510d21654f
Change-Id: I6e5fba7bd273219b1206559420b5bdb78734aa84
2019-08-31 17:13:39 +00:00
Anomie
c8fcdf5d5f Revert "Clean up ApiEditPage content handler undo logic"
This reverts commit 01564dcbf7.

Reason for revert: I find the empty case far clearer as to intention than this change, and I doubt this is such a hot path that optimization should take precedence over clarity. If we really want to get rid of the empty case, I'd have structured it somewhat clearly as

 if (
     // always allow undo via api, T230702
     !( $params['undo'] > 0 ) &&
     // [something else here to explain this clause]
     $contentHandler->supportsDirectApiEditing() === false
 ) {

But even that is IMO less clear. At the very least this seems to deserve more discussion.

Bug: T230702
Change-Id: Icc16250faad31abf7308c4af9be2e7658540346c
2019-08-19 14:49:42 +00:00
DannyS712
01564dcbf7 Clean up ApiEditPage content handler undo logic
Bug: T230702
Change-Id: I79d528866c54f40c5adcffde8410b9e2d5336ea7
2019-08-19 07:53:21 +00:00
Derick Alangi
5528af5f51 api: Avoid usage of deprecated Revision::FOR_THIS_USER constant
Change-Id: I48b302ba3ea5762e2b576e972cf85d57cd73fb15
2019-07-21 15:18:51 +01:00
Derick Alangi
339211a1ea Avoid usage of deprecated Revision::* constants, use RevisionRecord
Change-Id: I872fc89e5c02dd6a3ae9cd7e76640b95dc33f514
2019-07-21 15:03:03 +01:00
RazeSoldier
b95a76ae9e Drop APIEditBeforeSave hook
Removed the source code and the test code.

Bug: T220656
Change-Id: I3674da6d9c33c08ec2f1774cb793b3a952480571
2019-07-02 02:58:47 +08:00
Reedy
4691389fa4 Use (int) rather than intval()
Bug: T216969
Change-Id: I4c06716c83b69d128f26fa7f68736808aa2d3d64
2019-02-25 00:38:33 +00:00