MediaWiki  1.28.1
WebRequest.php
Go to the documentation of this file.
1 <?php
30 
38 class WebRequest {
39  protected $data, $headers = [];
40 
45  const GETHEADER_LIST = 1;
46 
51  private static $reqId;
52 
57  private $response;
58 
63  private $ip;
64 
69  protected $requestTime;
70 
75  protected $protocol;
76 
82  protected $sessionId = null;
83 
85  protected $markedAsSafe = false;
86 
90  public function __construct() {
91  $this->requestTime = isset( $_SERVER['REQUEST_TIME_FLOAT'] )
92  ? $_SERVER['REQUEST_TIME_FLOAT'] : microtime( true );
93 
94  // POST overrides GET data
95  // We don't use $_REQUEST here to avoid interference from cookies...
96  $this->data = $_POST + $_GET;
97  }
98 
114  public static function getPathInfo( $want = 'all' ) {
116  // PATH_INFO is mangled due to http://bugs.php.net/bug.php?id=31892
117  // And also by Apache 2.x, double slashes are converted to single slashes.
118  // So we will use REQUEST_URI if possible.
119  $matches = [];
120  if ( !empty( $_SERVER['REQUEST_URI'] ) ) {
121  // Slurp out the path portion to examine...
122  $url = $_SERVER['REQUEST_URI'];
123  if ( !preg_match( '!^https?://!', $url ) ) {
124  $url = 'http://unused' . $url;
125  }
126  MediaWiki\suppressWarnings();
127  $a = parse_url( $url );
128  MediaWiki\restoreWarnings();
129  if ( $a ) {
130  $path = isset( $a['path'] ) ? $a['path'] : '';
131 
133  if ( $path == $wgScript && $want !== 'all' ) {
134  // Script inside a rewrite path?
135  // Abort to keep from breaking...
136  return $matches;
137  }
138 
139  $router = new PathRouter;
140 
141  // Raw PATH_INFO style
142  $router->add( "$wgScript/$1" );
143 
144  if ( isset( $_SERVER['SCRIPT_NAME'] )
145  && preg_match( '/\.php5?/', $_SERVER['SCRIPT_NAME'] )
146  ) {
147  # Check for SCRIPT_NAME, we handle index.php explicitly
148  # But we do have some other .php files such as img_auth.php
149  # Don't let root article paths clober the parsing for them
150  $router->add( $_SERVER['SCRIPT_NAME'] . "/$1" );
151  }
152 
154  if ( $wgArticlePath ) {
155  $router->add( $wgArticlePath );
156  }
157 
159  if ( $wgActionPaths ) {
160  $router->add( $wgActionPaths, [ 'action' => '$key' ] );
161  }
162 
164  if ( $wgVariantArticlePath ) {
165  $router->add( $wgVariantArticlePath,
166  [ 'variant' => '$2' ],
167  [ '$2' => $wgContLang->getVariants() ]
168  );
169  }
170 
171  Hooks::run( 'WebRequestPathInfoRouter', [ $router ] );
172 
173  $matches = $router->parse( $path );
174  }
175  } elseif ( $wgUsePathInfo ) {
176  if ( isset( $_SERVER['ORIG_PATH_INFO'] ) && $_SERVER['ORIG_PATH_INFO'] != '' ) {
177  // Mangled PATH_INFO
178  // http://bugs.php.net/bug.php?id=31892
179  // Also reported when ini_get('cgi.fix_pathinfo')==false
180  $matches['title'] = substr( $_SERVER['ORIG_PATH_INFO'], 1 );
181 
182  } elseif ( isset( $_SERVER['PATH_INFO'] ) && $_SERVER['PATH_INFO'] != '' ) {
183  // Regular old PATH_INFO yay
184  $matches['title'] = substr( $_SERVER['PATH_INFO'], 1 );
185  }
186  }
187 
188  return $matches;
189  }
190 
197  public static function detectServer() {
199 
200  $proto = self::detectProtocol();
201  $stdPort = $proto === 'https' ? 443 : 80;
202 
203  $varNames = [ 'HTTP_HOST', 'SERVER_NAME', 'HOSTNAME', 'SERVER_ADDR' ];
204  $host = 'localhost';
205  $port = $stdPort;
206  foreach ( $varNames as $varName ) {
207  if ( !isset( $_SERVER[$varName] ) ) {
208  continue;
209  }
210 
211  $parts = IP::splitHostAndPort( $_SERVER[$varName] );
212  if ( !$parts ) {
213  // Invalid, do not use
214  continue;
215  }
216 
217  $host = $parts[0];
218  if ( $wgAssumeProxiesUseDefaultProtocolPorts && isset( $_SERVER['HTTP_X_FORWARDED_PROTO'] ) ) {
219  // Bug 70021: Assume that upstream proxy is running on the default
220  // port based on the protocol. We have no reliable way to determine
221  // the actual port in use upstream.
222  $port = $stdPort;
223  } elseif ( $parts[1] === false ) {
224  if ( isset( $_SERVER['SERVER_PORT'] ) ) {
225  $port = $_SERVER['SERVER_PORT'];
226  } // else leave it as $stdPort
227  } else {
228  $port = $parts[1];
229  }
230  break;
231  }
232 
233  return $proto . '://' . IP::combineHostAndPort( $host, $port, $stdPort );
234  }
235 
243  public static function detectProtocol() {
244  if ( ( !empty( $_SERVER['HTTPS'] ) && $_SERVER['HTTPS'] !== 'off' ) ||
245  ( isset( $_SERVER['HTTP_X_FORWARDED_PROTO'] ) &&
246  $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https' ) ) {
247  return 'https';
248  } else {
249  return 'http';
250  }
251  }
252 
260  public function getElapsedTime() {
261  return microtime( true ) - $this->requestTime;
262  }
263 
272  public static function getRequestId() {
273  if ( !self::$reqId ) {
274  self::$reqId = isset( $_SERVER['UNIQUE_ID'] )
275  ? $_SERVER['UNIQUE_ID'] : wfRandomString( 24 );
276  }
277 
278  return self::$reqId;
279  }
280 
288  public static function overrideRequestId( $id ) {
289  self::$reqId = $id;
290  }
291 
296  public function getProtocol() {
297  if ( $this->protocol === null ) {
298  $this->protocol = self::detectProtocol();
299  }
300  return $this->protocol;
301  }
302 
310  public function interpolateTitle() {
311  // bug 16019: title interpolation on API queries is useless and sometimes harmful
312  if ( defined( 'MW_API' ) ) {
313  return;
314  }
315 
316  $matches = self::getPathInfo( 'title' );
317  foreach ( $matches as $key => $val ) {
318  $this->data[$key] = $_GET[$key] = $_REQUEST[$key] = $val;
319  }
320  }
321 
332  static function extractTitle( $path, $bases, $key = false ) {
333  foreach ( (array)$bases as $keyValue => $base ) {
334  // Find the part after $wgArticlePath
335  $base = str_replace( '$1', '', $base );
336  $baseLen = strlen( $base );
337  if ( substr( $path, 0, $baseLen ) == $base ) {
338  $raw = substr( $path, $baseLen );
339  if ( $raw !== '' ) {
340  $matches = [ 'title' => rawurldecode( $raw ) ];
341  if ( $key ) {
342  $matches[$key] = $keyValue;
343  }
344  return $matches;
345  }
346  }
347  }
348  return [];
349  }
350 
358  public function normalizeUnicode( $data ) {
359  if ( is_array( $data ) ) {
360  foreach ( $data as $key => $val ) {
361  $data[$key] = $this->normalizeUnicode( $val );
362  }
363  } else {
365  $data = isset( $wgContLang ) ?
366  $wgContLang->normalize( $data ) :
367  UtfNormal\Validator::cleanUp( $data );
368  }
369  return $data;
370  }
371 
380  private function getGPCVal( $arr, $name, $default ) {
381  # PHP is so nice to not touch input data, except sometimes:
382  # http://us2.php.net/variables.external#language.variables.external.dot-in-names
383  # Work around PHP *feature* to avoid *bugs* elsewhere.
384  $name = strtr( $name, '.', '_' );
385  if ( isset( $arr[$name] ) ) {
387  $data = $arr[$name];
388  if ( isset( $_GET[$name] ) && !is_array( $data ) ) {
389  # Check for alternate/legacy character encoding.
390  if ( isset( $wgContLang ) ) {
391  $data = $wgContLang->checkTitleEncoding( $data );
392  }
393  }
394  $data = $this->normalizeUnicode( $data );
395  return $data;
396  } else {
397  return $default;
398  }
399  }
400 
413  public function getRawVal( $name, $default = null ) {
414  $name = strtr( $name, '.', '_' ); // See comment in self::getGPCVal()
415  if ( isset( $this->data[$name] ) && !is_array( $this->data[$name] ) ) {
416  $val = $this->data[$name];
417  } else {
418  $val = $default;
419  }
420  if ( is_null( $val ) ) {
421  return $val;
422  } else {
423  return (string)$val;
424  }
425  }
426 
437  public function getVal( $name, $default = null ) {
438  $val = $this->getGPCVal( $this->data, $name, $default );
439  if ( is_array( $val ) ) {
440  $val = $default;
441  }
442  if ( is_null( $val ) ) {
443  return $val;
444  } else {
445  return (string)$val;
446  }
447  }
448 
456  public function setVal( $key, $value ) {
457  $ret = isset( $this->data[$key] ) ? $this->data[$key] : null;
458  $this->data[$key] = $value;
459  return $ret;
460  }
461 
468  public function unsetVal( $key ) {
469  if ( !isset( $this->data[$key] ) ) {
470  $ret = null;
471  } else {
472  $ret = $this->data[$key];
473  unset( $this->data[$key] );
474  }
475  return $ret;
476  }
477 
487  public function getArray( $name, $default = null ) {
488  $val = $this->getGPCVal( $this->data, $name, $default );
489  if ( is_null( $val ) ) {
490  return null;
491  } else {
492  return (array)$val;
493  }
494  }
495 
506  public function getIntArray( $name, $default = null ) {
507  $val = $this->getArray( $name, $default );
508  if ( is_array( $val ) ) {
509  $val = array_map( 'intval', $val );
510  }
511  return $val;
512  }
513 
523  public function getInt( $name, $default = 0 ) {
524  return intval( $this->getRawVal( $name, $default ) );
525  }
526 
535  public function getIntOrNull( $name ) {
536  $val = $this->getRawVal( $name );
537  return is_numeric( $val )
538  ? intval( $val )
539  : null;
540  }
541 
552  public function getFloat( $name, $default = 0.0 ) {
553  return floatval( $this->getRawVal( $name, $default ) );
554  }
555 
565  public function getBool( $name, $default = false ) {
566  return (bool)$this->getRawVal( $name, $default );
567  }
568 
578  public function getFuzzyBool( $name, $default = false ) {
579  return $this->getBool( $name, $default )
580  && strcasecmp( $this->getRawVal( $name ), 'false' ) !== 0;
581  }
582 
591  public function getCheck( $name ) {
592  # Checkboxes and buttons are only present when clicked
593  # Presence connotes truth, absence false
594  return $this->getRawVal( $name, null ) !== null;
595  }
596 
607  public function getText( $name, $default = '' ) {
608  $val = $this->getVal( $name, $default );
609  return str_replace( "\r\n", "\n", $val );
610  }
611 
619  public function getValues() {
620  $names = func_get_args();
621  if ( count( $names ) == 0 ) {
622  $names = array_keys( $this->data );
623  }
624 
625  $retVal = [];
626  foreach ( $names as $name ) {
627  $value = $this->getGPCVal( $this->data, $name, null );
628  if ( !is_null( $value ) ) {
629  $retVal[$name] = $value;
630  }
631  }
632  return $retVal;
633  }
634 
641  public function getValueNames( $exclude = [] ) {
642  return array_diff( array_keys( $this->getValues() ), $exclude );
643  }
644 
652  public function getQueryValues() {
653  return $_GET;
654  }
655 
663  public function getRawQueryString() {
664  return $_SERVER['QUERY_STRING'];
665  }
666 
673  public function getRawPostString() {
674  if ( !$this->wasPosted() ) {
675  return '';
676  }
677  return $this->getRawInput();
678  }
679 
687  public function getRawInput() {
688  static $input = null;
689  if ( $input === null ) {
690  $input = file_get_contents( 'php://input' );
691  }
692  return $input;
693  }
694 
700  public function getMethod() {
701  return isset( $_SERVER['REQUEST_METHOD'] ) ? $_SERVER['REQUEST_METHOD'] : 'GET';
702  }
703 
713  public function wasPosted() {
714  return $this->getMethod() == 'POST';
715  }
716 
727  public function getSession() {
728  if ( $this->sessionId !== null ) {
729  $session = SessionManager::singleton()->getSessionById( (string)$this->sessionId, true, $this );
730  if ( $session ) {
731  return $session;
732  }
733  }
734 
735  $session = SessionManager::singleton()->getSessionForRequest( $this );
736  $this->sessionId = $session->getSessionId();
737  return $session;
738  }
739 
746  public function setSessionId( SessionId $sessionId ) {
747  $this->sessionId = $sessionId;
748  }
749 
756  public function getSessionId() {
757  return $this->sessionId;
758  }
759 
769  public function checkSessionCookie() {
771  wfDeprecated( __METHOD__, '1.27' );
772  return $wgInitialSessionId !== null &&
773  $this->getSession()->getId() === (string)$wgInitialSessionId;
774  }
775 
784  public function getCookie( $key, $prefix = null, $default = null ) {
785  if ( $prefix === null ) {
787  $prefix = $wgCookiePrefix;
788  }
789  return $this->getGPCVal( $_COOKIE, $prefix . $key, $default );
790  }
791 
799  public static function getGlobalRequestURL() {
800  if ( isset( $_SERVER['REQUEST_URI'] ) && strlen( $_SERVER['REQUEST_URI'] ) ) {
801  $base = $_SERVER['REQUEST_URI'];
802  } elseif ( isset( $_SERVER['HTTP_X_ORIGINAL_URL'] )
803  && strlen( $_SERVER['HTTP_X_ORIGINAL_URL'] )
804  ) {
805  // Probably IIS; doesn't set REQUEST_URI
806  $base = $_SERVER['HTTP_X_ORIGINAL_URL'];
807  } elseif ( isset( $_SERVER['SCRIPT_NAME'] ) ) {
808  $base = $_SERVER['SCRIPT_NAME'];
809  if ( isset( $_SERVER['QUERY_STRING'] ) && $_SERVER['QUERY_STRING'] != '' ) {
810  $base .= '?' . $_SERVER['QUERY_STRING'];
811  }
812  } else {
813  // This shouldn't happen!
814  throw new MWException( "Web server doesn't provide either " .
815  "REQUEST_URI, HTTP_X_ORIGINAL_URL or SCRIPT_NAME. Report details " .
816  "of your web server configuration to https://phabricator.wikimedia.org/" );
817  }
818  // User-agents should not send a fragment with the URI, but
819  // if they do, and the web server passes it on to us, we
820  // need to strip it or we get false-positive redirect loops
821  // or weird output URLs
822  $hash = strpos( $base, '#' );
823  if ( $hash !== false ) {
824  $base = substr( $base, 0, $hash );
825  }
826 
827  if ( $base[0] == '/' ) {
828  // More than one slash will look like it is protocol relative
829  return preg_replace( '!^/+!', '/', $base );
830  } else {
831  // We may get paths with a host prepended; strip it.
832  return preg_replace( '!^[^:]+://[^/]+/+!', '/', $base );
833  }
834  }
835 
843  public function getRequestURL() {
844  return self::getGlobalRequestURL();
845  }
846 
857  public function getFullRequestURL() {
858  return wfExpandUrl( $this->getRequestURL(), PROTO_CURRENT );
859  }
860 
866  public function appendQueryValue( $key, $value ) {
867  return $this->appendQueryArray( [ $key => $value ] );
868  }
869 
876  public function appendQueryArray( $array ) {
877  $newquery = $this->getQueryValues();
878  unset( $newquery['title'] );
879  $newquery = array_merge( $newquery, $array );
880 
881  return wfArrayToCgi( $newquery );
882  }
883 
893  public function getLimitOffset( $deflimit = 50, $optionname = 'rclimit' ) {
894  global $wgUser;
895 
896  $limit = $this->getInt( 'limit', 0 );
897  if ( $limit < 0 ) {
898  $limit = 0;
899  }
900  if ( ( $limit == 0 ) && ( $optionname != '' ) ) {
901  $limit = $wgUser->getIntOption( $optionname );
902  }
903  if ( $limit <= 0 ) {
904  $limit = $deflimit;
905  }
906  if ( $limit > 5000 ) {
907  $limit = 5000; # We have *some* limits...
908  }
909 
910  $offset = $this->getInt( 'offset', 0 );
911  if ( $offset < 0 ) {
912  $offset = 0;
913  }
914 
915  return [ $limit, $offset ];
916  }
917 
924  public function getFileTempname( $key ) {
925  $file = new WebRequestUpload( $this, $key );
926  return $file->getTempName();
927  }
928 
935  public function getUploadError( $key ) {
936  $file = new WebRequestUpload( $this, $key );
937  return $file->getError();
938  }
939 
951  public function getFileName( $key ) {
952  $file = new WebRequestUpload( $this, $key );
953  return $file->getName();
954  }
955 
962  public function getUpload( $key ) {
963  return new WebRequestUpload( $this, $key );
964  }
965 
972  public function response() {
973  /* Lazy initialization of response object for this request */
974  if ( !is_object( $this->response ) ) {
975  $class = ( $this instanceof FauxRequest ) ? 'FauxResponse' : 'WebResponse';
976  $this->response = new $class();
977  }
978  return $this->response;
979  }
980 
984  protected function initHeaders() {
985  if ( count( $this->headers ) ) {
986  return;
987  }
988 
989  $apacheHeaders = function_exists( 'apache_request_headers' ) ? apache_request_headers() : false;
990  if ( $apacheHeaders ) {
991  foreach ( $apacheHeaders as $tempName => $tempValue ) {
992  $this->headers[strtoupper( $tempName )] = $tempValue;
993  }
994  } else {
995  foreach ( $_SERVER as $name => $value ) {
996  if ( substr( $name, 0, 5 ) === 'HTTP_' ) {
997  $name = str_replace( '_', '-', substr( $name, 5 ) );
998  $this->headers[$name] = $value;
999  } elseif ( $name === 'CONTENT_LENGTH' ) {
1000  $this->headers['CONTENT-LENGTH'] = $value;
1001  }
1002  }
1003  }
1004  }
1005 
1011  public function getAllHeaders() {
1012  $this->initHeaders();
1013  return $this->headers;
1014  }
1015 
1028  public function getHeader( $name, $flags = 0 ) {
1029  $this->initHeaders();
1030  $name = strtoupper( $name );
1031  if ( !isset( $this->headers[$name] ) ) {
1032  return false;
1033  }
1034  $value = $this->headers[$name];
1035  if ( $flags & self::GETHEADER_LIST ) {
1036  $value = array_map( 'trim', explode( ',', $value ) );
1037  }
1038  return $value;
1039  }
1040 
1048  public function getSessionData( $key ) {
1049  return $this->getSession()->get( $key );
1050  }
1051 
1059  public function setSessionData( $key, $data ) {
1060  $this->getSession()->set( $key, $data );
1061  }
1062 
1073  public function checkUrlExtension( $extWhitelist = [] ) {
1074  $extWhitelist[] = 'php';
1075  if ( IEUrlExtension::areServerVarsBad( $_SERVER, $extWhitelist ) ) {
1076  if ( !$this->wasPosted() ) {
1077  $newUrl = IEUrlExtension::fixUrlForIE6(
1078  $this->getFullRequestURL(), $extWhitelist );
1079  if ( $newUrl !== false ) {
1080  $this->doSecurityRedirect( $newUrl );
1081  return false;
1082  }
1083  }
1084  throw new HttpError( 403,
1085  'Invalid file extension found in the path info or query string.' );
1086  }
1087  return true;
1088  }
1089 
1097  protected function doSecurityRedirect( $url ) {
1098  header( 'Location: ' . $url );
1099  header( 'Content-Type: text/html' );
1100  $encUrl = htmlspecialchars( $url );
1101  echo <<<HTML
1102 <html>
1103 <head>
1104 <title>Security redirect</title>
1105 </head>
1106 <body>
1107 <h1>Security redirect</h1>
1108 <p>
1109 We can't serve non-HTML content from the URL you have requested, because
1110 Internet Explorer would interpret it as an incorrect and potentially dangerous
1111 content type.</p>
1112 <p>Instead, please use <a href="$encUrl">this URL</a>, which is the same as the
1113 URL you have requested, except that "&amp;*" is appended. This prevents Internet
1114 Explorer from seeing a bogus file extension.
1115 </p>
1116 </body>
1117 </html>
1118 HTML;
1119  echo "\n";
1120  return true;
1121  }
1122 
1132  public function getAcceptLang() {
1133  // Modified version of code found at
1134  // http://www.thefutureoftheweb.com/blog/use-accept-language-header
1135  $acceptLang = $this->getHeader( 'Accept-Language' );
1136  if ( !$acceptLang ) {
1137  return [];
1138  }
1139 
1140  // Return the language codes in lower case
1141  $acceptLang = strtolower( $acceptLang );
1142 
1143  // Break up string into pieces (languages and q factors)
1144  $lang_parse = null;
1145  preg_match_all(
1146  '/([a-z]{1,8}(-[a-z]{1,8})*|\*)\s*(;\s*q\s*=\s*(1(\.0{0,3})?|0(\.[0-9]{0,3})?)?)?/',
1147  $acceptLang,
1148  $lang_parse
1149  );
1150 
1151  if ( !count( $lang_parse[1] ) ) {
1152  return [];
1153  }
1154 
1155  $langcodes = $lang_parse[1];
1156  $qvalues = $lang_parse[4];
1157  $indices = range( 0, count( $lang_parse[1] ) - 1 );
1158 
1159  // Set default q factor to 1
1160  foreach ( $indices as $index ) {
1161  if ( $qvalues[$index] === '' ) {
1162  $qvalues[$index] = 1;
1163  } elseif ( $qvalues[$index] == 0 ) {
1164  unset( $langcodes[$index], $qvalues[$index], $indices[$index] );
1165  }
1166  }
1167 
1168  // Sort list. First by $qvalues, then by order. Reorder $langcodes the same way
1169  array_multisort( $qvalues, SORT_DESC, SORT_NUMERIC, $indices, $langcodes );
1170 
1171  // Create a list like "en" => 0.8
1172  $langs = array_combine( $langcodes, $qvalues );
1173 
1174  return $langs;
1175  }
1176 
1185  protected function getRawIP() {
1186  if ( !isset( $_SERVER['REMOTE_ADDR'] ) ) {
1187  return null;
1188  }
1189 
1190  if ( is_array( $_SERVER['REMOTE_ADDR'] ) || strpos( $_SERVER['REMOTE_ADDR'], ',' ) !== false ) {
1191  throw new MWException( __METHOD__
1192  . " : Could not determine the remote IP address due to multiple values." );
1193  } else {
1194  $ipchain = $_SERVER['REMOTE_ADDR'];
1195  }
1196 
1197  return IP::canonicalize( $ipchain );
1198  }
1199 
1209  public function getIP() {
1210  global $wgUsePrivateIPs;
1211 
1212  # Return cached result
1213  if ( $this->ip !== null ) {
1214  return $this->ip;
1215  }
1216 
1217  # collect the originating ips
1218  $ip = $this->getRawIP();
1219  if ( !$ip ) {
1220  throw new MWException( 'Unable to determine IP.' );
1221  }
1222 
1223  # Append XFF
1224  $forwardedFor = $this->getHeader( 'X-Forwarded-For' );
1225  if ( $forwardedFor !== false ) {
1226  $proxyLookup = MediaWikiServices::getInstance()->getProxyLookup();
1227  $isConfigured = $proxyLookup->isConfiguredProxy( $ip );
1228  $ipchain = array_map( 'trim', explode( ',', $forwardedFor ) );
1229  $ipchain = array_reverse( $ipchain );
1230  array_unshift( $ipchain, $ip );
1231 
1232  # Step through XFF list and find the last address in the list which is a
1233  # trusted server. Set $ip to the IP address given by that trusted server,
1234  # unless the address is not sensible (e.g. private). However, prefer private
1235  # IP addresses over proxy servers controlled by this site (more sensible).
1236  # Note that some XFF values might be "unknown" with Squid/Varnish.
1237  foreach ( $ipchain as $i => $curIP ) {
1238  $curIP = IP::sanitizeIP( IP::canonicalize( $curIP ) );
1239  if ( !$curIP || !isset( $ipchain[$i + 1] ) || $ipchain[$i + 1] === 'unknown'
1240  || !$proxyLookup->isTrustedProxy( $curIP )
1241  ) {
1242  break; // IP is not valid/trusted or does not point to anything
1243  }
1244  if (
1245  IP::isPublic( $ipchain[$i + 1] ) ||
1246  $wgUsePrivateIPs ||
1247  $proxyLookup->isConfiguredProxy( $curIP ) // bug 48919; treat IP as sane
1248  ) {
1249  // Follow the next IP according to the proxy
1250  $nextIP = IP::canonicalize( $ipchain[$i + 1] );
1251  if ( !$nextIP && $isConfigured ) {
1252  // We have not yet made it past CDN/proxy servers of this site,
1253  // so either they are misconfigured or there is some IP spoofing.
1254  throw new MWException( "Invalid IP given in XFF '$forwardedFor'." );
1255  }
1256  $ip = $nextIP;
1257  // keep traversing the chain
1258  continue;
1259  }
1260  break;
1261  }
1262  }
1263 
1264  # Allow extensions to improve our guess
1265  Hooks::run( 'GetIP', [ &$ip ] );
1266 
1267  if ( !$ip ) {
1268  throw new MWException( "Unable to determine IP." );
1269  }
1270 
1271  wfDebug( "IP: $ip\n" );
1272  $this->ip = $ip;
1273  return $ip;
1274  }
1275 
1281  public function setIP( $ip ) {
1282  $this->ip = $ip;
1283  }
1284 
1297  public function hasSafeMethod() {
1298  if ( !isset( $_SERVER['REQUEST_METHOD'] ) ) {
1299  return false; // CLI mode
1300  }
1301 
1302  return in_array( $_SERVER['REQUEST_METHOD'], [ 'GET', 'HEAD', 'OPTIONS', 'TRACE' ] );
1303  }
1304 
1323  public function isSafeRequest() {
1324  if ( $this->markedAsSafe && $this->wasPosted() ) {
1325  return true; // marked as a "safe" POST
1326  }
1327 
1328  return $this->hasSafeMethod();
1329  }
1330 
1341  public function markAsSafeRequest() {
1342  $this->markedAsSafe = true;
1343  }
1344 }
$wgInitialSessionId
Definition: Setup.php:742
and how to run hooks for an and one after Each event has a preferably in CamelCase For ArticleDelete hook A clump of code and data that should be run when an event happens This can be either a function and a chunk of data
Definition: hooks.txt:6
float $requestTime
The timestamp of the start of the request, with microsecond precision.
Definition: WebRequest.php:69
the array() calling protocol came about after MediaWiki 1.4rc1.
getUploadError($key)
Return the upload error or 0.
Definition: WebRequest.php:935
getRawPostString()
Return the contents of the POST with no decoding.
Definition: WebRequest.php:673
$wgScript
The URL path to index.php.
I won t presume to tell you how to I m just describing the methods I chose to use for myself If you do choose to follow these it will probably be easier for you to collaborate with others on the but if you want to contribute without by all means do which work well I also use K &R brace matching style I know that s a religious issue for some
Definition: design.txt:79
static getRequestId()
Get the unique request ID.
Definition: WebRequest.php:272
getFileTempname($key)
Return the path to the temporary file where PHP has stored the upload.
Definition: WebRequest.php:924
getFullRequestURL()
Return the request URI with the canonical service and hostname, path, and query string.
Definition: WebRequest.php:857
null means default in associative array with keys and values unescaped Should be merged with default with a value of false meaning to suppress the attribute in associative array with keys and values unescaped noclasses & $ret
Definition: hooks.txt:1936
Apache License January AND DISTRIBUTION Definitions License shall mean the terms and conditions for use
$wgActionPaths
Definition: img_auth.php:46
static areServerVarsBad($vars, $extWhitelist=[])
Check a subset of $_SERVER (or the whole of $_SERVER if you like) to see if it indicates that the req...
response()
Return a handle to WebResponse style object, for setting cookies, headers and other stuff...
Definition: WebRequest.php:972
getUpload($key)
Return a WebRequestUpload object corresponding to the key.
Definition: WebRequest.php:962
getIntOrNull($name)
Fetch an integer value from the input or return null if empty.
Definition: WebRequest.php:535
string $protocol
Cached URL protocol.
Definition: WebRequest.php:75
getFuzzyBool($name, $default=false)
Fetch a boolean value from the input or return $default if not set.
Definition: WebRequest.php:578
getRawVal($name, $default=null)
Fetch a scalar from the input without normalization, or return $default if it's not set...
Definition: WebRequest.php:413
This code would result in ircNotify being run twice when an article is and once for brion Hooks can return three possible true was required This is the default since MediaWiki *some string
Definition: hooks.txt:177
$value
getBool($name, $default=false)
Fetch a boolean value from the input or return $default if not set.
Definition: WebRequest.php:565
getGPCVal($arr, $name, $default)
Fetch a value from the given array or return $default if it's not set.
Definition: WebRequest.php:380
const PROTO_CURRENT
Definition: Defines.php:226
injection txt This is an overview of how MediaWiki makes use of dependency injection The design described here grew from the discussion of RFC T384 The term dependency this means that anything an object needs to operate should be injected from the the object itself should only know narrow no concrete implementation of the logic it relies on The requirement to inject everything typically results in an architecture that based on two main types of and essentially stateless service objects that use other service objects to operate on the value objects As of the beginning MediaWiki is only starting to use the DI approach Much of the code still relies on global state or direct resulting in a highly cyclical dependency MediaWikiServices
Definition: injection.txt:23
it s the revision text itself In either if gzip is the revision text is gzipped $flags
Definition: hooks.txt:2703
const GETHEADER_LIST
Flag to make WebRequest::getHeader return an array of values.
Definition: WebRequest.php:45
getSession()
Return the session for this request.
Definition: WebRequest.php:727
when a variable name is used in a it is silently declared as a new local masking the global
Definition: design.txt:93
wfExpandUrl($url, $defaultProto=PROTO_CURRENT)
Expand a potentially local URL to a fully-qualified URL.
$wgArticlePath
Definition: img_auth.php:45
add($path, $params=[], $options=[])
Add a new path pattern to the path router.
Definition: PathRouter.php:160
initHeaders()
Initialise the header list.
Definition: WebRequest.php:984
title
string $ip
Cached client IP address.
Definition: WebRequest.php:63
wfRandomString($length=32)
Get a random string containing a number of pseudo-random hex characters.
doSecurityRedirect($url)
Attempt to redirect to a URL with a QUERY_STRING that's not dangerous in IE 6.
getArray($name, $default=null)
Fetch an array from the input or return $default if it's not set.
Definition: WebRequest.php:487
Show an error that looks like an HTTP server error.
Definition: HttpError.php:30
getAllHeaders()
Get an array containing all request headers.
static detectServer()
Work out an appropriate URL prefix containing scheme and host, based on information detected from $_S...
Definition: WebRequest.php:197
setVal($key, $value)
Set an arbitrary value into our get/post data.
Definition: WebRequest.php:456
getHeader($name, $flags=0)
Get a request header, or false if it isn't set.
design txt This is a brief overview of the new design More thorough and up to date information is available on the documentation wiki at etc Handles the details of getting and saving to the user table of the and dealing with sessions and cookies OutputPage Encapsulates the entire HTML page that will be sent in response to any server request It is used by calling its functions to add headers
Definition: design.txt:12
getFloat($name, $default=0.0)
Fetch a floating point value from the input or return $default if not set.
Definition: WebRequest.php:552
getProtocol()
Get the current URL protocol (http or https)
Definition: WebRequest.php:296
wasPosted()
Returns true if the present request was reached by a POST operation, false otherwise (GET...
Definition: WebRequest.php:713
getRequestURL()
Return the path and query string portion of the request URI.
Definition: WebRequest.php:843
PathRouter class.
Definition: PathRouter.php:73
static combineHostAndPort($host, $port, $defaultPort=false)
Given a host name and a port, combine them into host/port string like you might find in a URL...
Definition: IP.php:303
getSessionData($key)
Get data from the session.
getQueryValues()
Get the values passed in the query string.
Definition: WebRequest.php:652
unsetVal($key)
Unset an arbitrary value from our get/post data.
Definition: WebRequest.php:468
getCheck($name)
Return true if the named value is set in the input, whatever that value is (even "0").
Definition: WebRequest.php:591
$wgUsePathInfo
Whether to support URLs like index.php/Page_title These often break when PHP is set up in CGI mode...
getFileName($key)
Return the original filename of the uploaded file, as reported by the submitting user agent...
Definition: WebRequest.php:951
bool $wgAssumeProxiesUseDefaultProtocolPorts
When the wiki is running behind a proxy and this is set to true, assumes that the proxy exposes the w...
wfDeprecated($function, $version=false, $component=false, $callerOffset=2)
Throws a warning that $function is deprecated.
static run($event, array $args=[], $deprecatedVersion=null)
Call hook functions defined in Hooks::register and $wgHooks.
Definition: Hooks.php:131
static overrideRequestId($id)
Override the unique request ID.
Definition: WebRequest.php:288
getValueNames($exclude=[])
Returns the names of all input values excluding those in $exclude.
Definition: WebRequest.php:641
static detectProtocol()
Detect the protocol from $_SERVER.
Definition: WebRequest.php:243
getSessionId()
Get the session id for this request, if any.
Definition: WebRequest.php:756
This document is intended to provide useful advice for parties seeking to redistribute MediaWiki to end users It s targeted particularly at maintainers for Linux since it s been observed that distribution packages of MediaWiki often break We ve consistently had to recommend that users seeking support use official tarballs instead of their distribution s and this often solves whatever problem the user is having It would be nice if this could such as
Definition: distributors.txt:9
getIntArray($name, $default=null)
Fetch an array of integers, or return $default if it's not set.
Definition: WebRequest.php:506
getValues()
Extracts the given named values into an array.
Definition: WebRequest.php:619
setSessionId(SessionId $sessionId)
Set the session for this request.
Definition: WebRequest.php:746
WebResponse $response
Lazy-init response object.
Definition: WebRequest.php:57
getVal($name, $default=null)
Fetch a scalar from the input or return $default if it's not set.
Definition: WebRequest.php:437
static splitHostAndPort($both)
Given a host/port string, like one might find in the host part of a URL per RFC 2732, split the hostname part and the port part and return an array with an element for each.
Definition: IP.php:254
SessionId null $sessionId
Session ID to use for this request.
Definition: WebRequest.php:82
A collection of public static functions to play with IP address and IP blocks.
Definition: IP.php:67
static getGlobalRequestURL()
Return the path and query string portion of the main request URI.
Definition: WebRequest.php:799
injection txt This is an overview of how MediaWiki makes use of dependency injection The design described here grew from the discussion of RFC T384 The term dependency this means that anything an object needs to operate should be injected from the the object itself should only know narrow no concrete implementation of the logic it relies on The requirement to inject everything typically results in an architecture that based on two main types of and essentially stateless service objects that use other service objects to operate on the value objects As of the beginning MediaWiki is only starting to use the DI approach Much of the code still relies on global state or direct resulting in a highly cyclical dependency which acts as the top level factory for services in MediaWiki which can be used to gain access to default instances of various services MediaWikiServices however also allows new services to be defined and default services to be redefined Services are defined or redefined by providing a callback the instantiator that will return a new instance of the service When it will create an instance of MediaWikiServices and populate it with the services defined in the files listed by thereby bootstrapping the DI framework Per $wgServiceWiringFiles lists includes ServiceWiring php
Definition: injection.txt:35
if($wgLocalInterwiki) if($wgSharedPrefix===false) if($wgSharedSchema===false) if(!$wgCookiePrefix) $wgCookiePrefix
Definition: Setup.php:324
getMethod()
Get the HTTP method used for this request.
Definition: WebRequest.php:700
appendQueryValue($key, $value)
Definition: WebRequest.php:866
Value object holding the session ID in a manner that can be globally updated.
Definition: SessionId.php:38
wfArrayToCgi($array1, $array2=null, $prefix= '')
This function takes one or two arrays as input, and returns a CGI-style string, e.g.
static extractTitle($path, $bases, $key=false)
URL rewriting function; tries to extract page title and, optionally, one other fixed parameter value ...
Definition: WebRequest.php:332
this hook is for auditing only RecentChangesLinked and Watchlist RecentChangesLinked and Watchlist e g Watchlist removed from all revisions and log entries to which it was applied This gives extensions a chance to take it off their books as the deletion has already been partly carried out by this point or something similar the user will be unable to create the tag set and then return false from the hook function Ensure you consume the ChangeTagAfterDelete hook to carry out custom deletion actions as context called by AbstractContent::getParserOutput May be used to override the normal model specific rendering of page content as context as context the output can only depend on parameters provided to this hook not on global state indicating whether full HTML should be generated If generation of HTML may be but other information should still be present in the ParserOutput object to manipulate or replace but no entry for that model exists in $wgContentHandlers if desired whether it is OK to use $contentModel on $title Handler functions that modify $ok should generally return false to prevent further hooks from further modifying $ok inclusive $limit
Definition: hooks.txt:1046
this class mediates it Skin Encapsulates a look and feel for the wiki All of the functions that render HTML and make choices about how to render it are here and are called from various other places when and is meant to be subclassed with other skins that may override some of its functions The User object contains a reference to a and so rather than having a global skin object we just rely on the global User and get the skin with $wgUser and also has some character encoding functions and other locale stuff The current user interface language is instantiated as and the local content language as $wgContLang
Definition: design.txt:56
getRawInput()
Return the raw request body, with no processing.
Definition: WebRequest.php:687
interpolateTitle()
Check for title, action, and/or variant data in the URL and interpolate it into the GET variables...
Definition: WebRequest.php:310
This list may contain false positives That usually means there is additional text with links below the first Each row contains links to the first and second redirect
checkSessionCookie()
Returns true if the request has a persistent session.
Definition: WebRequest.php:769
getCookie($key, $prefix=null, $default=null)
Get a cookie from the $_COOKIE jar.
Definition: WebRequest.php:784
static getPathInfo($want= 'all')
Extract relevant query arguments from the http request uri's path to be merged with the normal php pr...
Definition: WebRequest.php:114
checkUrlExtension($extWhitelist=[])
Check if Internet Explorer will detect an incorrect cache extension in PATH_INFO or QUERY_STRING...
setSessionData($key, $data)
Set session data.
static string $reqId
The unique request ID.
Definition: WebRequest.php:51
getInt($name, $default=0)
Fetch an integer value from the input or return $default if not set.
Definition: WebRequest.php:523
appendQueryArray($array)
Appends or replaces value of query variables.
Definition: WebRequest.php:876
getElapsedTime()
Get the number of seconds to have elapsed since request start, in fractional seconds, with microsecond resolution.
Definition: WebRequest.php:260
$wgVariantArticlePath
Like $wgArticlePath, but on multi-variant wikis, this provides a path format that describes which par...
getLimitOffset($deflimit=50, $optionname= 'rclimit')
Check for limit and offset parameters on the input, and return sensible defaults if not given...
Definition: WebRequest.php:893
normalizeUnicode($data)
Recursively normalizes UTF-8 strings in the given array.
Definition: WebRequest.php:358
Object to access the $_FILES array.
getText($name, $default= '')
Fetch a text string from the given array or return $default if it's not set.
Definition: WebRequest.php:607
getRawQueryString()
Return the contents of the Query with no decoding.
Definition: WebRequest.php:663
$wgUser
Definition: Setup.php:806
$matches
static fixUrlForIE6($url, $extWhitelist=[])
Returns a variant of $url which will pass isUrlExtensionBad() but has the same GET parameters...
Allows to change the fields on the form that will be generated $name
Definition: hooks.txt:300