31 use Wikimedia\IPUtils;
122 $this->requestTime = $_SERVER[
'REQUEST_TIME_FLOAT'];
126 $this->data = $_POST + $_GET;
128 $this->queryAndPathParams = $this->queryParams = $_GET;
155 if ( isset( $_SERVER[
'REQUEST_URI'] ) ) {
157 $url = $_SERVER[
'REQUEST_URI'];
158 if ( !preg_match(
'!^https?://!', $url ) ) {
159 $url =
'http://unused' . $url;
161 $a = parse_url( $url );
165 $path = $a[
'path'] ??
'';
179 $router->
add(
"$wgScript/$1" );
189 if ( $articlePaths ) {
190 $router->add( $articlePaths, [
'action' =>
'$key' ] );
195 $services = MediaWikiServices::getInstance();
198 [
'variant' =>
'$2' ],
199 [
'$2' => $services->getLanguageConverterFactory()
200 ->getLanguageConverter( $services->getContentLanguage() )
212 if ( !empty( $_SERVER[
'ORIG_PATH_INFO'] ) ) {
216 $matches[
'title'] = substr( $_SERVER[
'ORIG_PATH_INFO'], 1 );
217 } elseif ( !empty( $_SERVER[
'PATH_INFO'] ) ) {
219 $matches[
'title'] = substr( $_SERVER[
'PATH_INFO'], 1 );
239 $basePath = rtrim( $basePath,
'/' ) .
'/';
241 $qpos = strpos( $requestUrl,
'?' );
242 if ( $qpos !==
false ) {
243 $requestPath = substr( $requestUrl, 0, $qpos );
245 $requestPath = $requestUrl;
247 if ( !str_starts_with( $requestPath, $basePath ) ) {
250 return rawurldecode( substr( $requestPath, strlen( $basePath ) ) );
264 public static function detectServer( $assumeProxiesUseDefaultProtocolPorts =
null ) {
265 if ( $assumeProxiesUseDefaultProtocolPorts ===
null ) {
266 $assumeProxiesUseDefaultProtocolPorts = $GLOBALS[
'wgAssumeProxiesUseDefaultProtocolPorts'];
270 $stdPort = $proto ===
'https' ? 443 : 80;
272 $varNames = [
'HTTP_HOST',
'SERVER_NAME',
'HOSTNAME',
'SERVER_ADDR' ];
275 foreach ( $varNames as $varName ) {
276 if ( !isset( $_SERVER[$varName] ) ) {
280 $parts = IPUtils::splitHostAndPort( $_SERVER[$varName] );
287 if ( $assumeProxiesUseDefaultProtocolPorts && isset( $_SERVER[
'HTTP_X_FORWARDED_PROTO'] ) ) {
292 } elseif ( $parts[1] ===
false ) {
293 if ( isset( $_SERVER[
'SERVER_PORT'] ) ) {
294 $port = $_SERVER[
'SERVER_PORT'];
302 return $proto .
'://' . IPUtils::combineHostAndPort( $host, $port, $stdPort );
313 if ( ( !empty( $_SERVER[
'HTTPS'] ) && $_SERVER[
'HTTPS'] !==
'off' ) ||
314 ( isset( $_SERVER[
'HTTP_X_FORWARDED_PROTO'] ) &&
315 $_SERVER[
'HTTP_X_FORWARDED_PROTO'] ===
'https' ) ) {
344 if ( !self::$reqId ) {
347 $id = $_SERVER[
'HTTP_X_REQUEST_ID'] ?? $_SERVER[
'UNIQUE_ID'] ??
wfRandomString( 24 );
373 if ( $this->protocol ===
null ) {
388 foreach (
$matches as $key => $val ) {
389 $this->data[$key] = $this->queryAndPathParams[$key] = $val;
404 foreach ( (array)$bases as $keyValue =>
$base ) {
407 $baseLen = strlen(
$base );
408 if ( substr(
$path, 0, $baseLen ) ==
$base ) {
409 $raw = substr(
$path, $baseLen );
411 $matches = [
'title' => rawurldecode( $raw ) ];
430 if ( is_array(
$data ) ) {
431 foreach (
$data as $key => $val ) {
435 $contLang = MediaWikiServices::getInstance()->getContentLanguage();
450 # PHP is so nice to not touch input data, except sometimes:
452 # Work around PHP *feature* to avoid *bugs* elsewhere.
453 $name = strtr( $name,
'.',
'_' );
455 if ( !isset( $arr[$name] ) ) {
460 # Optimisation: Skip UTF-8 normalization and legacy transcoding for simple ASCII strings.
461 $isAsciiStr = ( is_string(
$data ) && preg_match(
'/[^\x20-\x7E]/',
$data ) === 0 );
462 if ( !$isAsciiStr ) {
463 if ( isset( $_GET[$name] ) && is_string(
$data ) ) {
464 # Check for alternate/legacy character encoding.
465 $data = MediaWikiServices::getInstance()
466 ->getContentLanguage()
467 ->checkTitleEncoding(
$data );
488 $name = strtr( $name,
'.',
'_' );
489 if ( isset( $this->data[$name] ) && !is_array( $this->data[$name] ) ) {
490 $val = $this->data[$name];
495 return $val ===
null ? null : (string)$val;
514 public function getVal( $name, $default =
null ) {
515 $val = $this->
getGPCVal( $this->data, $name, $default );
516 if ( is_array( $val ) ) {
520 return $val ===
null ? null : (string)$val;
539 public function getText( $name, $default =
'' ) {
540 $val = $this->
getVal( $name, $default );
541 return str_replace(
"\r\n",
"\n", $val );
552 $ret = $this->data[$key] ??
null;
553 $this->data[$key] = $value;
564 if ( !isset( $this->data[$key] ) ) {
567 $ret = $this->data[$key];
568 unset( $this->data[$key] );
582 public function getArray( $name, $default =
null ) {
583 $val = $this->
getGPCVal( $this->data, $name, $default );
584 if ( $val ===
null ) {
602 $val = $this->
getArray( $name, $default );
603 if ( is_array( $val ) ) {
604 $val = array_map(
'intval', $val );
618 public function getInt( $name, $default = 0 ) {
620 return intval( $this->
getRawVal( $name, $default ) );
633 return is_numeric( $val )
648 public function getFloat( $name, $default = 0.0 ) {
650 return floatval( $this->
getRawVal( $name, $default ) );
662 public function getBool( $name, $default =
false ) {
664 return (
bool)$this->
getRawVal( $name, $default );
677 return $this->
getBool( $name, $default )
678 && strcasecmp( $this->
getRawVal( $name ),
'false' ) !== 0;
690 # Checkboxes and buttons are only present when clicked
691 # Presence connotes truth, absence false
692 return $this->
getRawVal( $name,
null ) !==
null;
703 if ( $names === [] ) {
704 $names = array_keys( $this->data );
708 foreach ( $names as $name ) {
709 $value = $this->
getGPCVal( $this->data, $name,
null );
710 if ( $value !==
null ) {
711 $retVal[$name] = $value;
724 return array_diff( array_keys( $this->
getValues() ), $exclude );
771 return $_SERVER[
'QUERY_STRING'];
795 static $input =
null;
796 if ( $input ===
null ) {
797 $input = file_get_contents(
'php://input' );
808 return $_SERVER[
'REQUEST_METHOD'] ??
'GET';
835 if ( $this->sessionId !==
null ) {
836 $session = SessionManager::singleton()->getSessionById( (
string)$this->sessionId,
true, $this );
842 $session = SessionManager::singleton()->getSessionForRequest( $this );
843 $this->sessionId = $session->getSessionId();
875 public function getCookie( $key, $prefix =
null, $default =
null ) {
876 if ( $prefix ===
null ) {
880 $name = $prefix . $key;
882 $name = strtr( $name,
'.',
'_' );
883 if ( isset( $_COOKIE[$name] ) ) {
884 return $_COOKIE[$name];
900 $name = $prefix . $key;
902 $name = strtr( $name,
'.',
'_' );
903 if ( isset( $_COOKIE[$name] ) ) {
904 return $_COOKIE[$name];
907 $legacyName = $prefix .
"ss0-" . $key;
908 $legacyName = strtr( $legacyName,
'.',
'_' );
909 if ( isset( $_COOKIE[$legacyName] ) ) {
910 return $_COOKIE[$legacyName];
926 if ( isset( $_SERVER[
'REQUEST_URI'] ) && strlen( $_SERVER[
'REQUEST_URI'] ) ) {
927 $base = $_SERVER[
'REQUEST_URI'];
928 } elseif ( isset( $_SERVER[
'HTTP_X_ORIGINAL_URL'] )
929 && strlen( $_SERVER[
'HTTP_X_ORIGINAL_URL'] )
932 $base = $_SERVER[
'HTTP_X_ORIGINAL_URL'];
933 } elseif ( isset( $_SERVER[
'SCRIPT_NAME'] ) ) {
934 $base = $_SERVER[
'SCRIPT_NAME'];
935 if ( isset( $_SERVER[
'QUERY_STRING'] ) && $_SERVER[
'QUERY_STRING'] !=
'' ) {
936 $base .=
'?' . $_SERVER[
'QUERY_STRING'];
940 throw new MWException(
"Web server doesn't provide either " .
941 "REQUEST_URI, HTTP_X_ORIGINAL_URL or SCRIPT_NAME. Report details " .
942 "of your web server configuration to https://phabricator.wikimedia.org/" );
948 $hash = strpos(
$base,
'#' );
949 if ( $hash !==
false ) {
953 if (
$base[0] ==
'/' ) {
955 return preg_replace(
'!^/+!',
'/',
$base );
958 return preg_replace(
'!^[^:]+://[^/]+/+!',
'/',
$base );
1011 unset( $newquery[
'title'] );
1012 $newquery = array_merge( $newquery, $array );
1028 $limit = $this->
getInt(
'limit', 0 );
1032 if ( ( $limit == 0 ) && ( $optionname !=
'' ) ) {
1033 $limit = MediaWikiServices::getInstance()
1034 ->getUserOptionsLookup()
1035 ->getIntOption( $user, $optionname );
1037 if ( $limit <= 0 ) {
1040 if ( $limit > 5000 ) {
1041 $limit = 5000; # We have *some* limits...
1044 $offset = $this->
getInt(
'offset', 0 );
1045 if ( $offset < 0 ) {
1049 return [ $limit, $offset ];
1059 return $this->
getUpload( $key )->getTempName();
1069 return $this->
getUpload( $key )->getError();
1084 return $this->
getUpload( $key )->getName();
1105 if ( !is_object( $this->
response ) ) {
1106 $class = ( $this instanceof
FauxRequest ) ? FauxResponse::class : WebResponse::class;
1116 if ( count( $this->headers ) ) {
1120 $this->headers = array_change_key_case( getallheaders(), CASE_UPPER );
1147 $name = strtoupper( $name );
1148 if ( !isset( $this->headers[$name] ) ) {
1151 $value = $this->headers[$name];
1152 if ( $flags & self::GETHEADER_LIST ) {
1153 $value = array_map(
'trim', explode(
',', $value ) );
1194 $acceptLang = $this->
getHeader(
'Accept-Language' );
1195 if ( !$acceptLang ) {
1200 $acceptLang = strtolower( $acceptLang );
1203 if ( !preg_match_all(
1205 # a language code or a star is required
1206 ([a-z]{1,8}(?:-[a-z]{1,8})*|\*)
1207 # from here everything is optional
1210 # this accepts only numbers in the range ;q=0.000 to ;q=1.000
1212 (1(?:\.0{0,3})?|0(?:\.\d{0,3})?)?
1225 $languageCode = $match[1];
1227 $qValue = (float)( $match[2] ?? 1.0 );
1229 $langs[$languageCode] = $qValue;
1234 arsort( $langs, SORT_NUMERIC );
1245 $remoteAddr = $_SERVER[
'REMOTE_ADDR'] ??
null;
1246 if ( !$remoteAddr ) {
1249 if ( is_array( $remoteAddr ) || str_contains( $remoteAddr,
',' ) ) {
1250 throw new MWException(
'Remote IP must not contain multiple values' );
1253 return IPUtils::canonicalize( $remoteAddr );
1266 # Return cached result
1267 if ( $this->ip !==
null ) {
1271 # collect the originating IPs
1274 throw new MWException(
'Unable to determine IP.' );
1278 $forwardedFor = $this->
getHeader(
'X-Forwarded-For' );
1279 if ( $forwardedFor !==
false ) {
1280 $proxyLookup = MediaWikiServices::getInstance()->getProxyLookup();
1281 $isConfigured = $proxyLookup->isConfiguredProxy(
$ip );
1282 $ipchain = array_map(
'trim', explode(
',', $forwardedFor ) );
1283 $ipchain = array_reverse( $ipchain );
1284 array_unshift( $ipchain,
$ip );
1286 # Step through XFF list and find the last address in the list which is a
1287 # trusted server. Set $ip to the IP address given by that trusted server,
1288 # unless the address is not sensible (e.g. private). However, prefer private
1289 # IP addresses over proxy servers controlled by this site (more sensible).
1290 # Note that some XFF values might be "unknown" with Squid/Varnish.
1291 foreach ( $ipchain as $i => $curIP ) {
1292 $curIP = IPUtils::sanitizeIP(
1293 IPUtils::canonicalize(
1294 self::canonicalizeIPv6LoopbackAddress( $curIP )
1297 if ( !$curIP || !isset( $ipchain[$i + 1] ) || $ipchain[$i + 1] ===
'unknown'
1298 || !$proxyLookup->isTrustedProxy( $curIP )
1303 IPUtils::isPublic( $ipchain[$i + 1] ) ||
1306 $proxyLookup->isConfiguredProxy( $curIP )
1308 $nextIP = $ipchain[$i + 1];
1311 $nextIP = IPUtils::canonicalize(
1312 self::canonicalizeIPv6LoopbackAddress( $nextIP )
1314 if ( !$nextIP && $isConfigured ) {
1317 throw new MWException(
"Invalid IP given in XFF '$forwardedFor'." );
1336 throw new MWException(
'Unable to determine IP.' );
1354 if ( preg_match(
'/^0*' . IPUtils::RE_IPV6_GAP .
'1$/',
$ip, $m ) ) {
1382 if ( !isset( $_SERVER[
'REQUEST_METHOD'] ) ) {
1386 return in_array( $_SERVER[
'REQUEST_METHOD'], [
'GET',
'HEAD',
'OPTIONS',
'TRACE' ] );
1408 if ( $this->markedAsSafe && $this->
wasPosted() ) {
1426 $this->markedAsSafe =
true;
wfRandomString( $length=32)
Get a random string containing a number of pseudo-random hex characters.
wfGetServerUrl( $proto)
Get the wiki's "server", i.e.
wfArrayToCgi( $array1, $array2=null, $prefix='')
This function takes one or two arrays as input, and returns a CGI-style string, e....
WebRequest clone which takes values from a provided array.
static runner()
Get a HookRunner instance for calling hooks using the new interfaces.
static isRegistered( $name)
Returns true if a hook has a function registered to it.
static getActionPaths(array $actionPaths, $articlePath)
add( $path, $params=[], $options=[])
Add a new path pattern to the path router.
Object to access the $_FILES array.
The WebRequest class encapsulates getting at data passed in the URL or via a POSTed form stripping il...
markAsSafeRequest()
Mark this request as identified as being nullipotent even if it is a POST request.
getIntOrNull( $name)
Fetch an integer value from the input or return null if empty.
string[] $queryParams
The parameters from $_GET only.
getLimitOffsetForUser(UserIdentity $user, $deflimit=50, $optionname='rclimit')
Check for limit and offset parameters on the input, and return sensible defaults if not given.
getValueNames( $exclude=[])
Returns the names of all input values excluding those in $exclude.
bool $markedAsSafe
Whether this HTTP request is "safe" (even if it is an HTTP post)
getUpload( $key)
Return a WebRequestUpload object corresponding to the key.
string $protocol
Cached URL protocol.
getArray( $name, $default=null)
Fetch an array from the input or return $default if it's not set.
interpolateTitle()
Check for title, action, and/or variant data in the URL and interpolate it into the GET variables.
getPostValues()
Get the values passed via POST.
static detectProtocol()
Detect the protocol from $_SERVER.
isSafeRequest()
Whether this request should be identified as being "safe".
getSession()
Return the session for this request.
getRawInput()
Return the raw request body, with no processing.
getValues(... $names)
Extracts the (given) named values into an array.
getRawQueryString()
Return the contents of the Query with no decoding.
getFileTempname( $key)
Return the path to the temporary file where PHP has stored the upload.
getVal( $name, $default=null)
Fetch a text string and partially normalized it.
getFloat( $name, $default=0.0)
Fetch a floating point value from the input or return $default if not set.
WebResponse $response
Lazy-init response object.
getUploadError( $key)
Return the upload error or 0.
getAllHeaders()
Get an array containing all request headers.
getFuzzyBool( $name, $default=false)
Fetch a boolean value from the input or return $default if not set.
getGPCVal( $arr, $name, $default)
Fetch a value from the given array or return $default if it's not set.
static getRequestId()
Get the current request ID.
getProtocol()
Get the current URL protocol (http or https)
getMethod()
Get the HTTP method used for this request.
initHeaders()
Initialise the header list.
getBool( $name, $default=false)
Fetch a boolean value from the input or return $default if not set.
static getRequestPathSuffix( $basePath)
If the request URL matches a given base path, extract the path part of the request URL after that bas...
string $ip
Cached client IP address.
static getGlobalRequestURL()
Return the path and query string portion of the main request URI.
setVal( $key, $value)
Set an arbitrary value into our get/post data.
static string $reqId
The unique request ID.
getFullRequestURL()
Return the request URI with the canonical service and hostname, path, and query string.
getElapsedTime()
Get the number of seconds to have elapsed since request start, in fractional seconds,...
float $requestTime
The timestamp of the start of the request, with microsecond precision.
string[] $headers
Lazy-initialized request headers indexed by upper-case header name.
getCrossSiteCookie( $key, $prefix='', $default=null)
Get a cookie set with SameSite=None possibly with a legacy fallback cookie.
getCheck( $name)
Return true if the named value is set in the input, whatever that value is (even "0").
appendQueryArray( $array)
Appends or replaces value of query variables.
getSessionId()
Get the session id for this request, if any.
getAcceptLang()
Parse the Accept-Language header sent by the client into an array.
static canonicalizeIPv6LoopbackAddress( $ip)
Converts ::1 (IPv6 loopback address) to 127.0.0.1 (IPv4 loopback address); assists in matching truste...
getRawPostString()
Return the contents of the POST with no decoding.
getQueryValues()
Get the values passed in the query string and the path router parameters.
response()
Return a handle to WebResponse style object, for setting cookies, headers and other stuff,...
getIP()
Work out the IP address based on various globals For trusted proxies, use the XFF client IP (first of...
static detectServer( $assumeProxiesUseDefaultProtocolPorts=null)
Work out an appropriate URL prefix containing scheme and host, based on information detected from $_S...
getInt( $name, $default=0)
Fetch an integer value from the input or return $default if not set.
wasPosted()
Returns true if the present request was reached by a POST operation, false otherwise (GET,...
setSessionData( $key, $data)
getFileName( $key)
Return the original filename of the uploaded file, as reported by the submitting user agent.
const GETHEADER_LIST
Flag to make WebRequest::getHeader return an array of values.
hasSafeMethod()
Check if this request uses a "safe" HTTP method.
getRawVal( $name, $default=null)
Fetch a string WITHOUT any Unicode or line break normalization.
getIntArray( $name, $default=null)
Fetch an array of integers, or return $default if it's not set.
appendQueryValue( $key, $value)
normalizeUnicode( $data)
Recursively normalizes UTF-8 strings in the given array.
static overrideRequestId( $id)
Override the unique request ID.
unsetVal( $key)
Unset an arbitrary value from our get/post data.
static getPathInfo( $want='all')
Extract relevant query arguments from the http request uri's path to be merged with the normal php pr...
SessionId null $sessionId
Session ID to use for this request.
getRawIP()
Fetch the raw IP from the request.
setSessionId(SessionId $sessionId)
Set the session for this request.
getCookie( $key, $prefix=null, $default=null)
Get a cookie from the $_COOKIE jar.
array $data
The parameters from $_GET, $_POST and the path router.
static extractTitle( $path, $bases, $key=false)
URL rewriting function; tries to extract page title and, optionally, one other fixed parameter value ...
getText( $name, $default='')
Fetch a text string and return it in normalized form.
getRequestURL()
Return the path and query string portion of the request URI.
getHeader( $name, $flags=0)
Get a request header, or false if it isn't set.
getSessionData( $key)
Get data from the session.
string[] $queryAndPathParams
The parameters from $_GET.
getQueryValuesOnly()
Get the values passed in the query string only, not including the path router parameters.
$wgUsePathInfo
Config variable stub for the UsePathInfo setting, for use by phpdoc and IDEs.
$wgUseSameSiteLegacyCookies
Config variable stub for the UseSameSiteLegacyCookies setting, for use by phpdoc and IDEs.
$wgScript
Config variable stub for the Script setting, for use by phpdoc and IDEs.
$wgActionPaths
Config variable stub for the ActionPaths setting, for use by phpdoc and IDEs.
$wgArticlePath
Config variable stub for the ArticlePath setting, for use by phpdoc and IDEs.
$wgAllowExternalReqID
Config variable stub for the AllowExternalReqID setting, for use by phpdoc and IDEs.
$wgVariantArticlePath
Config variable stub for the VariantArticlePath setting, for use by phpdoc and IDEs.
$wgCookiePrefix
Config variable stub for the CookiePrefix setting, for use by phpdoc and IDEs.
$wgUsePrivateIPs
Config variable stub for the UsePrivateIPs setting, for use by phpdoc and IDEs.