WebResponse.php

Go to the documentation of this file.

<?php
namespace MediaWiki\Request;
 
use HttpStatus;
use MediaWiki\HookContainer\HookRunner;
use MediaWiki\MainConfigNames;
use MediaWiki\MediaWikiServices;
use RuntimeException;
 
class WebResponse {
 
    protected static $setCookies = [];
 
    protected static $disableForPostSend = false;
 
    public static function disableForPostSend() {
        self::$disableForPostSend = true;
    }
 
    public function header( $string, $replace = true, $http_response_code = null ) {
        if ( self::$disableForPostSend ) {
            wfDebugLog( 'header', 'ignored post-send header {header}', 'all', [
                'header' => $string,
                'replace' => $replace,
                'http_response_code' => $http_response_code,
                'exception' => new RuntimeException( 'Ignored post-send header' ),
            ] );
            return;
        }
 
        \MediaWiki\Request\HeaderCallback::warnIfHeadersSent();
        if ( $http_response_code ) {
            header( $string, $replace, $http_response_code );
        } else {
            header( $string, $replace );
        }
    }
 
    public function getHeader( $key ) {
        foreach ( headers_list() as $header ) {
            [ $name, $val ] = explode( ':', $header, 2 );
            if ( !strcasecmp( $name, $key ) ) {
                return trim( $val );
            }
        }
        return null;
    }
 
    public function statusHeader( $code ) {
        if ( self::$disableForPostSend ) {
            wfDebugLog( 'header', 'ignored post-send status header {code}', 'all', [
                'code' => $code,
                'exception' => new RuntimeException( 'Ignored post-send status header' ),
            ] );
            return;
        }
 
        HttpStatus::header( $code );
    }
 
    public function headersSent() {
        return headers_sent();
    }
 
    public function setCookie( $name, $value, $expire = 0, $options = [] ) {
        $services = MediaWikiServices::getInstance();
        $mainConfig = $services->getMainConfig();
        $cookiePath = $mainConfig->get( MainConfigNames::CookiePath );
        $cookiePrefix = $mainConfig->get( MainConfigNames::CookiePrefix );
        $cookieDomain = $mainConfig->get( MainConfigNames::CookieDomain );
        $cookieSecure = $mainConfig->get( MainConfigNames::CookieSecure );
        $cookieExpiration = $mainConfig->get( MainConfigNames::CookieExpiration );
        $cookieHttpOnly = $mainConfig->get( MainConfigNames::CookieHttpOnly );
        $useSameSiteLegacyCookies = $mainConfig->get( MainConfigNames::UseSameSiteLegacyCookies );
        $options = array_filter( $options, static function ( $a ) {
            return $a !== null;
        } ) + [
            'prefix' => $cookiePrefix,
            'domain' => $cookieDomain,
            'path' => $cookiePath,
            'secure' => $cookieSecure,
            'httpOnly' => $cookieHttpOnly,
            'raw' => false,
            'sameSite' => '',
            'sameSiteLegacy' => $useSameSiteLegacyCookies
        ];
 
        if ( strcasecmp( $options['sameSite'], 'none' ) === 0
            && !empty( $options['sameSiteLegacy'] )
        ) {
            $legacyOptions = $options;
            $legacyOptions['sameSiteLegacy'] = false;
            $legacyOptions['sameSite'] = '';
            $this->setCookie( "ss0-$name", $value, $expire, $legacyOptions );
        }
 
        if ( $expire === null ) {
            $expire = 0; // Session cookie
        } elseif ( $expire == 0 && $cookieExpiration != 0 ) {
            $expire = time() + $cookieExpiration;
        }
 
        if ( self::$disableForPostSend ) {
            $prefixedName = $options['prefix'] . $name;
            wfDebugLog( 'cookie', 'ignored post-send cookie {cookie}', 'all', [
                'cookie' => $prefixedName,
                'data' => [
                    'name' => $prefixedName,
                    'value' => (string)$value,
                    'expire' => (int)$expire,
                    'path' => (string)$options['path'],
                    'domain' => (string)$options['domain'],
                    'secure' => (bool)$options['secure'],
                    'httpOnly' => (bool)$options['httpOnly'],
                    'sameSite' => (string)$options['sameSite']
                ],
                'exception' => new RuntimeException( 'Ignored post-send cookie' ),
            ] );
            return;
        }
 
        $hookRunner = new HookRunner( $services->getHookContainer() );
        if ( !$hookRunner->onWebResponseSetCookie( $name, $value, $expire, $options ) ) {
            return;
        }
 
        // Note: Don't try to move this earlier to reuse it for self::$disableForPostSend,
        // we need to use the altered values from the hook here. (T198525)
        $prefixedName = $options['prefix'] . $name;
        $value = (string)$value;
        $func = $options['raw'] ? 'setrawcookie' : 'setcookie';
        $setOptions = [
            'expires' => (int)$expire,
            'path' => (string)$options['path'],
            'domain' => (string)$options['domain'],
            'secure' => (bool)$options['secure'],
            'httponly' => (bool)$options['httpOnly'],
            'samesite' => (string)$options['sameSite'],
        ];
 
        // Per RFC 6265, key is name + domain + path
        $key = "{$prefixedName}\n{$setOptions['domain']}\n{$setOptions['path']}";
 
        // If this cookie name was in the request, fake an entry in
        // self::$setCookies for it so the deleting check works right.
        if ( isset( $_COOKIE[$prefixedName] ) && !array_key_exists( $key, self::$setCookies ) ) {
            self::$setCookies[$key] = [];
        }
 
        // PHP deletes if value is the empty string; also, a past expiry is deleting
        $deleting = ( $value === '' || $setOptions['expires'] > 0 && $setOptions['expires'] <= time() );
 
        $logDesc = "$func: \"$prefixedName\", \"$value\", \"" .
            implode( '", "', array_map( 'strval', $setOptions ) ) . '"';
        $optionsForDeduplication = [ $func, $prefixedName, $value, $setOptions ];
 
        if ( $deleting && !isset( self::$setCookies[$key] ) ) { // isset( null ) is false
            wfDebugLog( 'cookie', "already deleted $logDesc" );
            return;
        } elseif ( !$deleting && isset( self::$setCookies[$key] ) &&
            self::$setCookies[$key] === $optionsForDeduplication
        ) {
            wfDebugLog( 'cookie', "already set $logDesc" );
            return;
        }
 
        wfDebugLog( 'cookie', $logDesc );
        if ( $func === 'setrawcookie' ) {
            setrawcookie( $prefixedName, $value, $setOptions );
        } else {
            setcookie( $prefixedName, $value, $setOptions );
        }
        self::$setCookies[$key] = $deleting ? null : $optionsForDeduplication;
    }
 
    public function clearCookie( $name, $options = [] ) {
        $this->setCookie( $name, '', time() - 31536000 /* 1 year */, $options );
    }
 
    public function hasCookies() {
        return (bool)self::$setCookies;
    }
}
 
class_alias( WebResponse::class, 'WebResponse' );