35 use Wikimedia\IPUtils;
83 private static $reqId;
126 $this->requestTime = $_SERVER[
'REQUEST_TIME_FLOAT'];
130 $this->data = $_POST + $_GET;
132 $this->queryAndPathParams = $this->queryParams = $_GET;
159 if ( isset( $_SERVER[
'REQUEST_URI'] ) ) {
161 $url = $_SERVER[
'REQUEST_URI'];
162 if ( !preg_match(
'!^https?://!', $url ) ) {
163 $url =
'http://unused' . $url;
165 $a = parse_url( $url );
169 $path = $a[
'path'] ??
'';
181 $router->
add(
"$wgScript/$1" );
191 if ( $articlePaths ) {
192 $router->add( $articlePaths, [
'action' =>
'$key' ] );
197 $services = MediaWikiServices::getInstance();
200 [
'variant' =>
'$2' ],
201 [
'$2' => $services->getLanguageConverterFactory()
202 ->getLanguageConverter( $services->getContentLanguage() )
214 if ( !empty( $_SERVER[
'ORIG_PATH_INFO'] ) ) {
218 $matches[
'title'] = substr( $_SERVER[
'ORIG_PATH_INFO'], 1 );
219 } elseif ( !empty( $_SERVER[
'PATH_INFO'] ) ) {
221 $matches[
'title'] = substr( $_SERVER[
'PATH_INFO'], 1 );
241 $basePath = rtrim( $basePath,
'/' ) .
'/';
243 $qpos = strpos( $requestUrl,
'?' );
244 if ( $qpos !==
false ) {
245 $requestPath = substr( $requestUrl, 0, $qpos );
247 $requestPath = $requestUrl;
249 if ( !str_starts_with( $requestPath, $basePath ) ) {
252 return rawurldecode( substr( $requestPath, strlen( $basePath ) ) );
266 public static function detectServer( $assumeProxiesUseDefaultProtocolPorts =
null ) {
267 $assumeProxiesUseDefaultProtocolPorts ??= $GLOBALS[
'wgAssumeProxiesUseDefaultProtocolPorts'];
270 $stdPort = $proto ===
'https' ? 443 : 80;
272 $varNames = [
'HTTP_HOST',
'SERVER_NAME',
'HOSTNAME',
'SERVER_ADDR' ];
275 foreach ( $varNames as $varName ) {
276 if ( !isset( $_SERVER[$varName] ) ) {
280 $parts = IPUtils::splitHostAndPort( $_SERVER[$varName] );
287 if ( $assumeProxiesUseDefaultProtocolPorts && isset( $_SERVER[
'HTTP_X_FORWARDED_PROTO'] ) ) {
292 } elseif ( $parts[1] ===
false ) {
293 if ( isset( $_SERVER[
'SERVER_PORT'] ) ) {
294 $port = $_SERVER[
'SERVER_PORT'];
302 return $proto .
'://' . IPUtils::combineHostAndPort( $host, $port, $stdPort );
313 if ( ( !empty( $_SERVER[
'HTTPS'] ) && $_SERVER[
'HTTPS'] !==
'off' ) ||
314 ( isset( $_SERVER[
'HTTP_X_FORWARDED_PROTO'] ) &&
315 $_SERVER[
'HTTP_X_FORWARDED_PROTO'] ===
'https' ) ) {
344 if ( !self::$reqId ) {
347 $id = $_SERVER[
'HTTP_X_REQUEST_ID'] ?? $_SERVER[
'UNIQUE_ID'] ??
wfRandomString( 24 );
386 foreach (
$matches as $key => $val ) {
387 $this->data[$key] = $this->queryAndPathParams[$key] = $val;
402 foreach ( (array)$bases as $keyValue =>
$base ) {
405 $baseLen = strlen(
$base );
406 if ( substr(
$path, 0, $baseLen ) ==
$base ) {
407 $raw = substr(
$path, $baseLen );
409 $matches = [
'title' => rawurldecode( $raw ) ];
428 if ( is_array(
$data ) ) {
429 foreach (
$data as $key => $val ) {
433 $contLang = MediaWikiServices::getInstance()->getContentLanguage();
447 private function getGPCVal( $arr, $name, $default ) {
448 # PHP is so nice to not touch input data, except sometimes:
450 # Work around PHP *feature* to avoid *bugs* elsewhere.
451 $name = strtr( $name,
'.',
'_' );
453 if ( !isset( $arr[$name] ) ) {
458 # Optimisation: Skip UTF-8 normalization and legacy transcoding for simple ASCII strings.
459 $isAsciiStr = ( is_string(
$data ) && preg_match(
'/[^\x20-\x7E]/',
$data ) === 0 );
460 if ( !$isAsciiStr ) {
461 if ( isset( $_GET[$name] ) && is_string(
$data ) ) {
462 # Check for alternate/legacy character encoding.
463 $data = MediaWikiServices::getInstance()
464 ->getContentLanguage()
465 ->checkTitleEncoding(
$data );
486 $name = strtr( $name,
'.',
'_' );
487 if ( isset( $this->data[$name] ) && !is_array( $this->data[$name] ) ) {
488 $val = $this->data[$name];
493 return $val ===
null ? null : (string)$val;
512 public function getVal( $name, $default =
null ) {
513 $val = $this->getGPCVal( $this->data, $name, $default );
514 if ( is_array( $val ) ) {
518 return $val ===
null ? null : (string)$val;
537 public function getText( $name, $default =
'' ) {
538 $val = $this->
getVal( $name, $default );
539 return str_replace(
"\r\n",
"\n", $val );
550 $ret = $this->data[$key] ??
null;
551 $this->data[$key] = $value;
562 if ( !isset( $this->data[$key] ) ) {
565 $ret = $this->data[$key];
566 unset( $this->data[$key] );
580 public function getArray( $name, $default =
null ) {
581 $val = $this->getGPCVal( $this->data, $name, $default );
582 if ( $val ===
null ) {
600 $val = $this->
getArray( $name, $default );
601 if ( is_array( $val ) ) {
602 $val = array_map(
'intval', $val );
616 public function getInt( $name, $default = 0 ) {
618 return intval( $this->
getRawVal( $name, $default ) );
631 return is_numeric( $val )
646 public function getFloat( $name, $default = 0.0 ) {
648 return floatval( $this->
getRawVal( $name, $default ) );
660 public function getBool( $name, $default =
false ) {
662 return (
bool)$this->
getRawVal( $name, $default );
675 return $this->
getBool( $name, $default )
676 && strcasecmp( $this->
getRawVal( $name ),
'false' ) !== 0;
688 # Checkboxes and buttons are only present when clicked
689 # Presence connotes truth, absence false
690 return $this->
getRawVal( $name,
null ) !==
null;
701 if ( $names === [] ) {
702 $names = array_keys( $this->data );
706 foreach ( $names as $name ) {
707 $value = $this->getGPCVal( $this->data, $name,
null );
708 if ( $value !==
null ) {
709 $retVal[$name] = $value;
722 return array_diff( array_keys( $this->
getValues() ), $exclude );
769 return $_SERVER[
'QUERY_STRING'];
793 static $input =
null;
794 $input ??= file_get_contents(
'php://input' );
804 return $_SERVER[
'REQUEST_METHOD'] ??
'GET';
831 if ( $this->sessionId !==
null ) {
832 $session = SessionManager::singleton()->getSessionById( (
string)$this->sessionId,
true, $this );
838 $session = SessionManager::singleton()->getSessionForRequest( $this );
839 $this->sessionId = $session->getSessionId();
871 public function getCookie( $key, $prefix =
null, $default =
null ) {
872 if ( $prefix ===
null ) {
876 $name = $prefix . $key;
878 $name = strtr( $name,
'.',
'_' );
879 if ( isset( $_COOKIE[$name] ) ) {
880 return $_COOKIE[$name];
896 $name = $prefix . $key;
898 $name = strtr( $name,
'.',
'_' );
899 if ( isset( $_COOKIE[$name] ) ) {
900 return $_COOKIE[$name];
903 $legacyName = $prefix .
"ss0-" . $key;
904 $legacyName = strtr( $legacyName,
'.',
'_' );
905 if ( isset( $_COOKIE[$legacyName] ) ) {
906 return $_COOKIE[$legacyName];
922 if ( isset( $_SERVER[
'REQUEST_URI'] ) && strlen( $_SERVER[
'REQUEST_URI'] ) ) {
923 $base = $_SERVER[
'REQUEST_URI'];
924 } elseif ( isset( $_SERVER[
'HTTP_X_ORIGINAL_URL'] )
925 && strlen( $_SERVER[
'HTTP_X_ORIGINAL_URL'] )
928 $base = $_SERVER[
'HTTP_X_ORIGINAL_URL'];
929 } elseif ( isset( $_SERVER[
'SCRIPT_NAME'] ) ) {
930 $base = $_SERVER[
'SCRIPT_NAME'];
931 if ( isset( $_SERVER[
'QUERY_STRING'] ) && $_SERVER[
'QUERY_STRING'] !=
'' ) {
932 $base .=
'?' . $_SERVER[
'QUERY_STRING'];
936 throw new MWException(
"Web server doesn't provide either " .
937 "REQUEST_URI, HTTP_X_ORIGINAL_URL or SCRIPT_NAME. Report details " .
938 "of your web server configuration to https://phabricator.wikimedia.org/" );
944 $hash = strpos(
$base,
'#' );
945 if ( $hash !==
false ) {
949 if (
$base[0] ==
'/' ) {
951 return preg_replace(
'!^/+!',
'/',
$base );
954 return preg_replace(
'!^[^:]+://[^/]+/+!',
'/',
$base );
1007 unset( $newquery[
'title'] );
1008 $newquery = array_merge( $newquery, $array );
1024 $limit = $this->
getInt(
'limit', 0 );
1028 if ( ( $limit == 0 ) && ( $optionname !=
'' ) ) {
1029 $limit = MediaWikiServices::getInstance()
1030 ->getUserOptionsLookup()
1031 ->getIntOption( $user, $optionname );
1033 if ( $limit <= 0 ) {
1036 if ( $limit > 5000 ) {
1037 $limit = 5000; # We have *some* limits...
1040 $offset = $this->
getInt(
'offset', 0 );
1041 if ( $offset < 0 ) {
1045 return [ $limit, $offset ];
1055 return $this->
getUpload( $key )->getTempName();
1065 return $this->
getUpload( $key )->getError();
1080 return $this->
getUpload( $key )->getName();
1101 if ( !is_object( $this->
response ) ) {
1102 $class = ( $this instanceof
FauxRequest ) ? FauxResponse::class : WebResponse::class;
1105 return $this->response;
1112 if ( count( $this->headers ) ) {
1116 $this->headers = array_change_key_case( getallheaders(), CASE_UPPER );
1143 $name = strtoupper( $name );
1144 if ( !isset( $this->headers[$name] ) ) {
1147 $value = $this->headers[$name];
1148 if ( $flags & self::GETHEADER_LIST ) {
1149 $value = array_map(
'trim', explode(
',', $value ) );
1190 $acceptLang = $this->
getHeader(
'Accept-Language' );
1191 if ( !$acceptLang ) {
1196 $acceptLang = strtolower( $acceptLang );
1199 if ( !preg_match_all(
1201 # a language code or a star is required
1202 ([a-z]{1,8}(?:-[a-z]{1,8})*|\*)
1203 # from here everything is optional
1206 # this accepts only numbers in the range ;q=0.000 to ;q=1.000
1208 (1(?:\.0{0,3})?|0(?:\.\d{0,3})?)?
1221 $languageCode = $match[1];
1223 $qValue = (float)( $match[2] ?? 1.0 );
1225 $langs[$languageCode] = $qValue;
1230 arsort( $langs, SORT_NUMERIC );
1241 $remoteAddr = $_SERVER[
'REMOTE_ADDR'] ??
null;
1242 if ( !$remoteAddr ) {
1245 if ( is_array( $remoteAddr ) || str_contains( $remoteAddr,
',' ) ) {
1246 throw new MWException(
'Remote IP must not contain multiple values' );
1249 return IPUtils::canonicalize( $remoteAddr );
1262 # Return cached result
1263 if ( $this->ip !==
null ) {
1267 # collect the originating IPs
1270 throw new MWException(
'Unable to determine IP.' );
1274 $forwardedFor = $this->
getHeader(
'X-Forwarded-For' );
1275 if ( $forwardedFor !==
false ) {
1276 $proxyLookup = MediaWikiServices::getInstance()->getProxyLookup();
1277 $isConfigured = $proxyLookup->isConfiguredProxy( $ip );
1278 $ipchain = array_map(
'trim', explode(
',', $forwardedFor ) );
1279 $ipchain = array_reverse( $ipchain );
1280 array_unshift( $ipchain, $ip );
1282 # Step through XFF list and find the last address in the list which is a
1283 # trusted server. Set $ip to the IP address given by that trusted server,
1284 # unless the address is not sensible (e.g. private). However, prefer private
1285 # IP addresses over proxy servers controlled by this site (more sensible).
1286 # Note that some XFF values might be "unknown" with Squid/Varnish.
1287 foreach ( $ipchain as $i => $curIP ) {
1288 $curIP = IPUtils::sanitizeIP(
1289 IPUtils::canonicalize(
1290 self::canonicalizeIPv6LoopbackAddress( $curIP )
1293 if ( !$curIP || !isset( $ipchain[$i + 1] ) || $ipchain[$i + 1] ===
'unknown'
1294 || !$proxyLookup->isTrustedProxy( $curIP )
1299 IPUtils::isPublic( $ipchain[$i + 1] ) ||
1302 $proxyLookup->isConfiguredProxy( $curIP )
1304 $nextIP = $ipchain[$i + 1];
1307 $nextIP = IPUtils::canonicalize(
1308 self::canonicalizeIPv6LoopbackAddress( $nextIP )
1310 if ( !$nextIP && $isConfigured ) {
1313 throw new MWException(
"Invalid IP given in XFF '$forwardedFor'." );
1332 throw new MWException(
'Unable to determine IP.' );
1350 if ( preg_match(
'/^0*' . IPUtils::RE_IPV6_GAP .
'1$/', $ip, $m ) ) {
1378 if ( !isset( $_SERVER[
'REQUEST_METHOD'] ) ) {
1382 return in_array( $_SERVER[
'REQUEST_METHOD'], [
'GET',
'HEAD',
'OPTIONS',
'TRACE' ] );
1404 if ( $this->markedAsSafe && $this->
wasPosted() ) {
1422 $this->markedAsSafe =
true;
1438 $config = MediaWikiServices::getInstance()->getMainConfig();
1439 if ( $config->get( MainConfigNames::CdnMatchParameterOrder ) ) {
1441 return in_array( $reqUrl, $cdnUrls,
true );
1445 $reqUrlParts = explode(
'?', $reqUrl, 2 );
1446 $reqUrlBase = $reqUrlParts[0];
1447 $reqUrlParams = count( $reqUrlParts ) === 2 ? explode(
'&', $reqUrlParts[1] ) : [];
1452 sort( $reqUrlParams );
1453 foreach ( $cdnUrls as $cdnUrl ) {
1454 if ( strlen( $reqUrl ) !== strlen( $cdnUrl ) ) {
1457 $cdnUrlParts = explode(
'?', $cdnUrl, 2 );
1458 $cdnUrlBase = $cdnUrlParts[0];
1459 if ( $reqUrlBase !== $cdnUrlBase ) {
1462 $cdnUrlParams = count( $cdnUrlParts ) === 2 ? explode(
'&', $cdnUrlParts[1] ) : [];
1463 sort( $cdnUrlParams );
1464 if ( $reqUrlParams === $cdnUrlParams ) {
wfRandomString( $length=32)
Get a random string containing a number of pseudo-random hex characters.
wfExpandUrl( $url, $defaultProto=PROTO_CURRENT)
Expand a potentially local URL to a fully-qualified URL.
wfGetServerUrl( $proto)
Get the wiki's "server", i.e.
wfArrayToCgi( $array1, $array2=null, $prefix='')
This function takes one or two arrays as input, and returns a CGI-style string, e....
static runner()
Get a HookRunner instance for calling hooks using the new interfaces.
static isRegistered( $name)
Returns true if a hook has a function registered to it.
A class containing constants representing the names of configuration variables.
The WebRequest class encapsulates getting at data passed in the URL or via a POSTed form stripping il...
matchURLForCDN(array $cdnUrls)
Determine if the request URL matches one of a given set of canonical CDN URLs.
markAsSafeRequest()
Mark this request as identified as being nullipotent even if it is a POST request.
getIntOrNull( $name)
Fetch an integer value from the input or return null if empty.
string[] $queryParams
The parameters from $_GET only.
getLimitOffsetForUser(UserIdentity $user, $deflimit=50, $optionname='rclimit')
Check for limit and offset parameters on the input, and return sensible defaults if not given.
getValueNames( $exclude=[])
Returns the names of all input values excluding those in $exclude.
bool $markedAsSafe
Whether this HTTP request is "safe" (even if it is an HTTP post)
getUpload( $key)
Return a MediaWiki\Request\WebRequestUpload object corresponding to the key.
string $protocol
Cached URL protocol.
getArray( $name, $default=null)
Fetch an array from the input or return $default if it's not set.
interpolateTitle()
Check for title, action, and/or variant data in the URL and interpolate it into the GET variables.
getPostValues()
Get the values passed via POST.
static detectProtocol()
Detect the protocol from $_SERVER.
isSafeRequest()
Whether this request should be identified as being "safe".
getSession()
Return the session for this request.
getRawInput()
Return the raw request body, with no processing.
getValues(... $names)
Extracts the (given) named values into an array.
getRawQueryString()
Return the contents of the Query with no decoding.
getFileTempname( $key)
Return the path to the temporary file where PHP has stored the upload.
getVal( $name, $default=null)
Fetch a text string and partially normalized it.
getFloat( $name, $default=0.0)
Fetch a floating point value from the input or return $default if not set.
getUploadError( $key)
Return the upload error or 0.
getAllHeaders()
Get an array containing all request headers.
getFuzzyBool( $name, $default=false)
Fetch a boolean value from the input or return $default if not set.
static getRequestId()
Get the current request ID.
getProtocol()
Get the current URL protocol (http or https)
getMethod()
Get the HTTP method used for this request.
initHeaders()
Initialise the header list.
getBool( $name, $default=false)
Fetch a boolean value from the input or return $default if not set.
static getRequestPathSuffix( $basePath)
If the request URL matches a given base path, extract the path part of the request URL after that bas...
static getGlobalRequestURL()
Return the path and query string portion of the main request URI.
setVal( $key, $value)
Set an arbitrary value into our get/post data.
getFullRequestURL()
Return the request URI with the canonical service and hostname, path, and query string.
getElapsedTime()
Get the number of seconds to have elapsed since request start, in fractional seconds,...
float $requestTime
The timestamp of the start of the request, with microsecond precision.
string[] $headers
Lazy-initialized request headers indexed by upper-case header name.
getCrossSiteCookie( $key, $prefix='', $default=null)
Get a cookie set with SameSite=None possibly with a legacy fallback cookie.
getCheck( $name)
Return true if the named value is set in the input, whatever that value is (even "0").
appendQueryArray( $array)
Appends or replaces value of query variables.
getSessionId()
Get the session id for this request, if any.
getAcceptLang()
Parse the Accept-Language header sent by the client into an array.
static canonicalizeIPv6LoopbackAddress( $ip)
Converts ::1 (IPv6 loopback address) to 127.0.0.1 (IPv4 loopback address); assists in matching truste...
getRawPostString()
Return the contents of the POST with no decoding.
getQueryValues()
Get the values passed in the query string and the path router parameters.
response()
Return a handle to WebResponse style object, for setting cookies, headers and other stuff,...
getIP()
Work out the IP address based on various globals For trusted proxies, use the XFF client IP (first of...
static detectServer( $assumeProxiesUseDefaultProtocolPorts=null)
Work out an appropriate URL prefix containing scheme and host, based on information detected from $_S...
getInt( $name, $default=0)
Fetch an integer value from the input or return $default if not set.
wasPosted()
Returns true if the present request was reached by a POST operation, false otherwise (GET,...
setSessionData( $key, $data)
getFileName( $key)
Return the original filename of the uploaded file, as reported by the submitting user agent.
const GETHEADER_LIST
Flag to make WebRequest::getHeader return an array of values.
hasSafeMethod()
Check if this request uses a "safe" HTTP method.
getRawVal( $name, $default=null)
Fetch a string WITHOUT any Unicode or line break normalization.
getIntArray( $name, $default=null)
Fetch an array of integers, or return $default if it's not set.
appendQueryValue( $key, $value)
normalizeUnicode( $data)
Recursively normalizes UTF-8 strings in the given array.
static overrideRequestId( $id)
Override the unique request ID.
unsetVal( $key)
Unset an arbitrary value from our get/post data.
static getPathInfo( $want='all')
Extract relevant query arguments from the http request uri's path to be merged with the normal php pr...
SessionId null $sessionId
Session ID to use for this request.
getRawIP()
Fetch the raw IP from the request.
setSessionId(SessionId $sessionId)
Set the session for this request.
getCookie( $key, $prefix=null, $default=null)
Get a cookie from the $_COOKIE jar.
array $data
The parameters from $_GET, $_POST and the path router.
static extractTitle( $path, $bases, $key=false)
URL rewriting function; tries to extract page title and, optionally, one other fixed parameter value ...
getText( $name, $default='')
Fetch a text string and return it in normalized form.
getRequestURL()
Return the path and query string portion of the request URI.
getHeader( $name, $flags=0)
Get a request header, or false if it isn't set.
getSessionData( $key)
Get data from the session.
string[] $queryAndPathParams
The parameters from $_GET.
getQueryValuesOnly()
Get the values passed in the query string only, not including the path router parameters.
$wgUsePathInfo
Config variable stub for the UsePathInfo setting, for use by phpdoc and IDEs.
$wgUseSameSiteLegacyCookies
Config variable stub for the UseSameSiteLegacyCookies setting, for use by phpdoc and IDEs.
$wgScript
Config variable stub for the Script setting, for use by phpdoc and IDEs.
$wgActionPaths
Config variable stub for the ActionPaths setting, for use by phpdoc and IDEs.
$wgArticlePath
Config variable stub for the ArticlePath setting, for use by phpdoc and IDEs.
$wgAllowExternalReqID
Config variable stub for the AllowExternalReqID setting, for use by phpdoc and IDEs.
$wgVariantArticlePath
Config variable stub for the VariantArticlePath setting, for use by phpdoc and IDEs.
$wgCookiePrefix
Config variable stub for the CookiePrefix setting, for use by phpdoc and IDEs.
$wgUsePrivateIPs
Config variable stub for the UsePrivateIPs setting, for use by phpdoc and IDEs.