WebResponse.php

Go to the documentation of this file.

<?php
namespace MediaWiki\Request;
 
use LogicException;
use MediaWiki\HookContainer\HookRunner;
use MediaWiki\Logger\LoggerFactory;
use MediaWiki\MainConfigNames;
use MediaWiki\MediaWikiServices;
use RuntimeException;
use Wikimedia\Http\HttpStatus;
use Wikimedia\LightweightObjectStore\ExpirationAwareness;
use Wikimedia\Timestamp\ConvertibleTimestamp;
 
class WebResponse {
 
    protected static $setCookies = [];
 
    protected $disableForPostSend = false;
 
    public function disableForPostSend() {
        $this->disableForPostSend = true;
    }
 
    public function header( $string, $replace = true, $http_response_code = null ) {
        if ( $this->disableForPostSend ) {
            LoggerFactory::getInstance( 'header' )->warning( 'ignored post-send header {header}', [
                'header' => $string,
                'replace' => $replace,
                'http_response_code' => $http_response_code,
                'exception' => new RuntimeException( 'Ignored post-send header' ),
            ] );
            return;
        }
 
        \MediaWiki\Request\HeaderCallback::warnIfHeadersSent();
        if ( $http_response_code ) {
            header( $string, $replace, $http_response_code );
        } else {
            header( $string, $replace );
        }
    }
 
    public function getStatusCode() {
        return http_response_code();
    }
 
    public function getHeader( $key ) {
        foreach ( headers_list() as $header ) {
            [ $name, $val ] = explode( ':', $header, 2 );
            if ( !strcasecmp( $name, $key ) ) {
                return trim( $val );
            }
        }
        return null;
    }
 
    public function statusHeader( $code ) {
        if ( $this->disableForPostSend ) {
            LoggerFactory::getInstance( 'header' )->warning( 'ignored post-send status header {code}', [
                'code' => $code,
                'exception' => new RuntimeException( 'Ignored post-send status header' ),
            ] );
            return;
        }
 
        HttpStatus::header( $code );
    }
 
    public function headersSent() {
        return headers_sent();
    }
 
    public function setCookie( $name, $value, $expire = 0, $options = [] ) {
        $logger = LoggerFactory::getInstance( 'cookie' );
        $services = MediaWikiServices::getInstance();
        $mainConfig = $services->getMainConfig();
        $cookiePath = $mainConfig->get( MainConfigNames::CookiePath );
        $cookiePrefix = $mainConfig->get( MainConfigNames::CookiePrefix );
        $cookieDomain = $mainConfig->get( MainConfigNames::CookieDomain );
        $cookieSecure = $mainConfig->get( MainConfigNames::CookieSecure );
        $cookieExpiration = $mainConfig->get( MainConfigNames::CookieExpiration );
        $cookieHttpOnly = $mainConfig->get( MainConfigNames::CookieHttpOnly );
        $options = array_filter( $options, static fn ( $a ) => $a !== null ) + [
            'prefix' => $cookiePrefix,
            'domain' => $cookieDomain,
            'path' => $cookiePath,
            'secure' => $cookieSecure,
            'httpOnly' => $cookieHttpOnly,
            'raw' => false,
            'sameSite' => '',
        ];
 
        if ( $expire === null ) {
            $expire = 0; // Session cookie
        } elseif ( $expire == 0 && $cookieExpiration != 0 ) {
            $expire = ConvertibleTimestamp::time() + $cookieExpiration;
        }
 
        if ( $this->disableForPostSend ) {
            $prefixedName = $options['prefix'] . $name;
            $logger->warning( 'ignored post-send cookie {cookie}', [
                'cookie' => $prefixedName,
                'data' => [
                    'name' => $prefixedName,
                    'value' => (string)$value,
                    'expire' => (int)$expire,
                    'path' => (string)$options['path'],
                    'domain' => (string)$options['domain'],
                    'secure' => (bool)$options['secure'],
                    'httpOnly' => (bool)$options['httpOnly'],
                    'sameSite' => (string)$options['sameSite']
                ],
                'exception' => new RuntimeException( 'Ignored post-send cookie' ),
            ] );
            return;
        }
 
        $hookRunner = new HookRunner( $services->getHookContainer() );
        if ( !$hookRunner->onWebResponseSetCookie( $name, $value, $expire, $options ) ) {
            return;
        }
 
        // Note: Don't try to move this earlier to reuse it for $this->disableForPostSend,
        // we need to use the altered values from the hook here. (T198525)
        $prefixedName = $options['prefix'] . $name;
        $value = (string)$value;
        $func = $options['raw'] ? 'setrawcookie' : 'setcookie';
        $setOptions = [
            'expires' => (int)$expire,
            'path' => (string)$options['path'],
            'domain' => (string)$options['domain'],
            'secure' => (bool)$options['secure'],
            'httponly' => (bool)$options['httpOnly'],
            'samesite' => (string)$options['sameSite'],
        ];
 
        // Per RFC 6265, key is name + domain + path
        $key = "{$prefixedName}\n{$setOptions['domain']}\n{$setOptions['path']}";
 
        // If this cookie name was in the request, fake an entry in
        // self::$setCookies for it so the deleting check works right.
        if ( isset( $_COOKIE[$prefixedName] ) && !array_key_exists( $key, self::$setCookies ) ) {
            self::$setCookies[$key] = [];
        }
 
        // PHP deletes if value is the empty string; also, a past expiry is deleting
        $deleting = ( $value === ''
            || ( $setOptions['expires'] > 0
                 && $setOptions['expires'] <= ConvertibleTimestamp::time()
            )
        );
 
        $logDesc = "$func: \"$prefixedName\", \"$value\", \"" .
            implode( '", "', array_map( 'strval', $setOptions ) ) . '"';
        $optionsForDeduplication = [ $func, $prefixedName, $value, $setOptions ];
 
        if ( $deleting && !isset( self::$setCookies[$key] ) ) { // isset( null ) is false
            $logger->debug( "already deleted $logDesc" );
            return;
        } elseif ( !$deleting && isset( self::$setCookies[$key] ) &&
            self::$setCookies[$key] === $optionsForDeduplication
        ) {
            $logger->debug( "already set $logDesc" );
            return;
        }
 
        $logger->info( $logDesc );
        $this->actuallySetCookie( $func, $prefixedName, $value, $setOptions );
        self::$setCookies[$key] = $deleting ? null : $optionsForDeduplication;
    }
 
    public function clearCookie( $name, $options = [] ) {
        $this->setCookie( $name, '', ConvertibleTimestamp::time() - ExpirationAwareness::TTL_YEAR, $options );
    }
 
    public function hasCookies() {
        return (bool)self::$setCookies;
    }
 
    protected function actuallySetCookie( string $func, string $prefixedName, string $value, array $setOptions ): void {
        if ( $func === 'setrawcookie' ) {
            setrawcookie( $prefixedName, $value, $setOptions );
        } else {
            setcookie( $prefixedName, $value, $setOptions );
        }
    }
 
    public static function resetCookieCache(): void {
        if ( !defined( 'MW_PHPUNIT_TEST' ) ) {
            throw new LogicException( __METHOD__ . ' should not be called outside tests' );
        }
        self::$setCookies = [];
    }
}