wiki.techinc.nl/includes/api/ApiFormatPhp.php
Brad Jorsch f459c1aeca SECURITY: Improve cross-domain-policy mangling
Take into account that the tag might have parameters.

Bug: T123653
Change-Id: Ie9799f5ea45badfb4e7b4be7e7fbc1c35cc86f26

Signed-off-by: Chad Horohoe <chadh@wikimedia.org>
2016-05-20 09:48:11 -07:00

90 lines
2.5 KiB
PHP

<?php
/**
*
*
* Created on Oct 22, 2006
*
* Copyright © 2006 Yuri Astrakhan "<Firstname><Lastname>@gmail.com"
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License along
* with this program; if not, write to the Free Software Foundation, Inc.,
* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
* http://www.gnu.org/copyleft/gpl.html
*
* @file
*/
/**
* API Serialized PHP output formatter
* @ingroup API
*/
class ApiFormatPhp extends ApiFormatBase {
public function getMimeType() {
return 'application/vnd.php.serialized';
}
public function execute() {
$params = $this->extractRequestParams();
switch ( $params['formatversion'] ) {
case 1:
$transforms = [
'BC' => [],
'Types' => [],
'Strip' => 'all',
];
break;
case 2:
case 'latest':
$transforms = [
'Types' => [],
'Strip' => 'all',
];
break;
default:
$this->dieUsage( __METHOD__ . ': Unknown value for \'formatversion\'', 'unknownformatversion' );
}
$text = serialize( $this->getResult()->getResultData( null, $transforms ) );
// Bug 66776: wfMangleFlashPolicy() is needed to avoid a nasty bug in
// Flash, but what it does isn't friendly for the API. There's nothing
// we can do here that isn't actively broken in some manner, so let's
// just be broken in a useful manner.
if ( $this->getConfig()->get( 'MangleFlashPolicy' ) &&
in_array( 'wfOutputHandler', ob_list_handlers(), true ) &&
preg_match( '/\<\s*cross-domain-policy(?=\s|\>)/i', $text )
) {
$this->dieUsage(
'This response cannot be represented using format=php. ' .
'See https://phabricator.wikimedia.org/T68776',
'internalerror'
);
}
$this->printText( $text );
}
public function getAllowedParams() {
$ret = parent::getAllowedParams() + [
'formatversion' => [
ApiBase::PARAM_TYPE => [ 1, 2, 'latest' ],
ApiBase::PARAM_DFLT => 1,
ApiBase::PARAM_HELP_MSG => 'apihelp-php-param-formatversion',
],
];
return $ret;
}
}