Commit graph

1706 commits

Author SHA1 Message Date
jenkins-bot df88b1b4b7 Merge "Revert "Remove unused SecurityCheck-ReDoS suppression"" 2023-09-25 20:19:36 +00:00
Daimona Eaytoy 7896e8f2c4 Revert "Remove unused SecurityCheck-ReDoS suppression"
This reverts commit 2107ee4f38.

Reason for revert: T347220

Change-Id: If76c4d0d7564d48bf231173d1d8f5177127fc5fa
2023-09-25 16:07:21 +00:00
C. Scott Ananian 0ff282dcc3 Use OutputPage::setPageTitleMsg() instead of ::setPageTitle()
The new method formats the message with Message::escaped() which
better protects from bad HTML in the message.

The ::setPageTitleMsg() method was added in 1.41 and this extension
already requires MW >= 1.41.

Bug: T343994
Change-Id: Ic07cde3bafeaa0325024fe89b4948680d04c4820
2023-09-22 21:18:03 +00:00
C. Scott Ananian 2107ee4f38 Remove unused SecurityCheck-ReDoS suppression
Change-Id: I7809c29e1150ea6770f3aa70a3fb790f3e4ce32f
2023-09-22 21:17:31 +00:00
jenkins-bot 1f1c5e477b Merge "When testing against a page creation in RC, set page_id to 0 as in the real filtering" 2023-09-11 09:28:33 +00:00
Matěj Suchánek 9beeca3752 Fix various typos and documentation issues
Change-Id: I1e9d297f665282d251343598e102e1d342488965
2023-09-04 12:55:17 +02:00
Amir Sarabadani ead29fc0fe Re-enable skipped test
Depends-On: I04c1dcf5129df437589149f0f3e284974d7c98fa
Change-Id: Ib071cd62d21090d28088729d2b2850363b750dae
2023-08-25 17:06:15 +02:00
Derick Alangi 623b9dbea3
Migrate DeferredUpdatesManager to use DeferredUpdates directly
Reverts part of Id9056528a433faf0, to switch to DeferredUpdates in
CirrusSearch back from DeferredUpdatesManager.

Bug: T265749
Change-Id: I8126cc76440724753c356c48ba4e0fcc9be5b41a
2023-08-21 12:59:28 +01:00
Umherirrender 62127964b7 Use namespaced MediaWiki\User\ActorMigrationBase
Bug: T321681
Change-Id: If3940c982d55643a685e2dedccab0540f86b9ae9
2023-08-20 01:08:09 +02:00
jenkins-bot e23b4bf8ef Merge "Use namespaced Title" 2023-08-19 18:33:50 +00:00
Umherirrender cd7e9d31a7 Use namespaced Title
Bug: T321681
Change-Id: I66fd9b70a5de06ac3c81bdf6a2a5bca64ed094c2
2023-08-19 19:49:36 +02:00
jenkins-bot 96f6e1961f Merge "Clean up AbuseFilterConsequencesTest a bit" 2023-08-19 17:29:27 +00:00
Daimona Eaytoy 85f8f90531 Clean up AbuseFilterConsequencesTest a bit
Most notably, make it not use additional DB tables to test global
filters. Instead, just pretend that the local database is not local (via
config) and "hide" local filters with a simple test-only flag in
FilterLookup.

Change-Id: Ib431dbf6c9d84978ee84e7f0671cfcbf8a54d7a2
2023-08-19 15:31:41 +00:00
gerritbot f5258d16bc Replace some moved Title class uses, now MediaWiki\Title\Title
Bug: T321681
Change-Id: I0402e835b5c05bac0a890b6fe0036516751c411b
2023-08-19 04:13:30 +00:00
Umherirrender 8e6d820154 Use HookHandlers for UserMerge hook
Bug: T254306
Depends-On: Ib78dae49854863af1a37a00636737c94694776ae
Change-Id: If2bc517fb612199f4d744efbfa261ee5c556b6a5
2023-08-16 09:44:30 +02:00
jenkins-bot e80a4337c0 Merge "Use HookHandlers for Echo hook" 2023-08-16 05:26:14 +00:00
gerritbot ae1262fb68 Replace some moved Title class uses, now MediaWiki\Title\Title
Bug: T321681
Change-Id: I505b97ffbb74f1b1a12bf141b73b1414c60c5020
2023-08-16 01:54:05 +00:00
Umherirrender a328477b8d Use HookHandlers for Echo hook
Bug: T254306
Depends-On: Iffa2b409502b4269c9746e0304feb4aaee37a86e
Change-Id: I0e27c535367b37b7038a54955e43ff96d9c81d32
2023-08-16 00:18:02 +02:00
jenkins-bot e566cb1327 Merge "Avoid TestUser in non-database tests" 2023-08-07 13:13:25 +00:00
Daimona Eaytoy 2a6b7edecb Avoid TestUser in non-database tests
TestUser requires a DB connection, so avoid using it in database-less
tests. Add to the Database group tests that are making DB writes (e.g.,
for log entries).

Change-Id: I211cb60296e5c2446128fcdf2caaadc728a8c272
2023-08-06 22:18:49 +00:00
Amir Sarabadani 049e602b07 BlockedDomains: Move filtering logic to a dedicated class
I'm planning to add support for bypass and regex-based blocking which
means it'll grow a bit. So let's give it a dedicated class.

Bug: T337431
Change-Id: I5a6fe2fd2f1efdebd8cada0ba6c481341f830e27
2023-08-06 16:27:23 +02:00
jenkins-bot a3ffaba341 Merge "Replace userNameUtils with UserIdentityUtils" 2023-08-06 10:00:04 +00:00
gerritbot 806ac5285d Migrate ILB::getConnectionRef() calls to ILB::getConnection()
Deprecated since 1.39 (I6e7544763bd)

Bug: T343277
Change-Id: I1d6d8d8bee8b39a5d364d8bb65f5f9a85194114d
2023-08-03 22:28:51 +00:00
Umherirrender c72b6a20f0 Pass ParserFactory to LazyVariableComputer
Make the init of Parser lazy

Bug: T343070
Change-Id: If0f0ca3c4aa2136c85903289f7f80b95dc5132c8
2023-07-29 14:20:07 +02:00
AnaïsGueyte 2efd6d9ac9 Replace userNameUtils with UserIdentityUtils
Where UserIdentity is available and where it's necessary to check ::isNamed

Bug: T342741
Change-Id: I5b52686f1c072282e76874f3863962345ca8097e
2023-07-27 10:29:31 -03:00
Matěj Suchánek 82ff324ae9 Remove faulty phan suppression
Change-Id: I5928d14f92d2bf7e8ceae9b40086533d7e0d0061
2023-07-21 21:47:34 +02:00
jenkins-bot ad37cd8725 Merge "Get parsed content from PreparedUpdate" 2023-07-18 14:15:40 +00:00
jenkins-bot 78c7334d6a Merge "Split VariableGenerator::addEditVars" 2023-07-17 23:26:53 +00:00
Matěj Suchánek 1e93f8b674 Get parsed content from PreparedUpdate
This finally makes new_html work for non-wikitext contents.

Bug: T264104
Change-Id: I1174b63a8e3a96e83ee7472dd086bfc91636316c
2023-07-16 14:48:30 +02:00
jenkins-bot 9aa87e9234 Merge "Clean up AbuseFilterViewTestBatch" 2023-07-12 13:12:47 +00:00
Matěj Suchánek 49edc86a78 Split VariableGenerator::addEditVars
This method actually consists of two: add derived vars, and initialize
content vars. The former part depends on no parameters of this method.
On the other hand, the latter part combines multiple implementations
for some of the content variables using branching.

The branching is a dirty workaround and inferior to the GRASP principle:
"When related alternatives or behaviors vary by type, assign
responsibility for the behavior to the types for which the behavior
varies."
In other words, the callers (extensions) should be responsible for
choosing the initialization strategy themselves, instead of letting
VariableGenerator figure it out.

As the first step, split the former part to a separate method.
For now, it will be implicitly called by ::addEditVars.

Change-Id: I5ff00dbdbf29ec54eabfd95c44a4fd7f713969f5
2023-07-05 14:58:32 +00:00
Tim Starling fe592746b7 Use the new Wikimedia\Diff namespace
Bug: T339184
Change-Id: I381686678524868c85466bdafde3856a73a8cb1c
2023-06-29 11:56:13 +10:00
Abijeet b1e404fc79 ConsequencesFactory: Avoid creating Session object during service wiring
Service wiring should only depend on config, not on request state.

Creating a session object during service wiring causes issues with entry
points such as opensearch_desc.php that disable the session.

Bug: T340113
Change-Id: I2450b0b6821ff0b097e283ff660a0b8aeea9590a
2023-06-27 20:11:38 +05:30
Matěj Suchánek c2a40fb0ff Clean up AbuseFilterViewTestBatch
Inject dependencies, use implicit form validation.

Change-Id: I74afeeceb39ada93cf3c20d5d3fc417ab4e3bf4b
2023-06-27 10:53:45 +02:00
jenkins-bot c897335bd7 Merge "Various code style clean-ups" 2023-06-23 18:43:58 +00:00
jenkins-bot 0c33716f5b Merge "Mark protected stuff in classes with no subclasses as private" 2023-06-23 18:35:48 +00:00
thiemowmde 9316a7d65f Mark some unused public class features as private
These are not used anywhere outside of these classes.

Change-Id: I0a0a5cf1e84133bae69b95da771c285ee27f926c
2023-06-23 12:32:38 +02:00
thiemowmde d9bca83ec6 Various code style clean-ups
For example:
* Use the more meaningful str_contains().
* Add missing type hints.
* Make use of early returns/guard clauses.

Change-Id: Id150d1b17a80ea637a0639a8f2fd7fd017ad23b1
2023-06-23 12:32:12 +02:00
thiemowmde 24888bea15 Mark protected stuff in classes with no subclasses as private
Protected effectively means "public to subclasses" and should be
avoided for the same reasons as marking everything as public should
be avoided.

Change-Id: Iba674b486ce53fd1f94f70163d47824e969abb77
2023-06-23 12:28:06 +02:00
thiemowmde 0bb3aa38ed Fix removing a domain when the page doesn't exist
This was an unfortunate mistake in the refactoring in I2ccb587,
caused by incomplete documentation and a confusing mixture of
possible return types.

I9166c2b fixed one of the two places already. The situation in this
patch here cannot really happen in reality (there is nothing to
remove when the page is empty). Still I think the code is easier to
read when the two places behave the same.

Change-Id: Iea51c3a7a8185cbc3771143353f4795dde712ec4
2023-06-22 11:54:53 +02:00
Amir Sarabadani 8f216a6030 Fix adding a domain when the page doesn't exist
It should fail on null but it should create the page if it doesn't
exist or doesn't have any content yet.
This is breaking the special page, see:
[[de:234828092#New_special_page_to_fight_spam_//_Neue_Spezialseite_zur_Spam-Bekämpfung]]

Change-Id: I9166c2bdcfacb4b19706d246fbf99b2f24ca4cc6
2023-06-22 08:36:49 +00:00
Timo Tijhof 110484b6a0 BlockedExternalDomains: De-duplicate validateDomain logic
Bug: T337431
Change-Id: Icbedf750f6ecaa9caf7bb900e8ad0bc2124e8743
2023-06-19 13:36:32 +00:00
Timo Tijhof 203d54be11 BlockedExternalDomains: Optimize host extraction by using parse_url
Unlike what the 20-year old source comments in UrlUtils.php would
have you believe, parse_url() works fine nowadays, including for
protocol-relative URLs and indeed lots of prod code uses it directly.

The class still has some convenience value for case where you need to
expand or manipulate URLs, but for the common case of extracting a part
of it, you really don't need it.

Test plan:
$ php phpunit.php ../../extensions/AbuseFilter/tests/phpunit/integration/FilteredActionsHandlerTest.php

Bug: T337431
Change-Id: I1e76d2f5aef65365743214530faba656325b965a
2023-06-19 13:36:27 +00:00
Timo Tijhof ee238e79b9 BlockedExternalDomains: Minor code clean up and docs improvement
* Remove stray `@ingroup` from file blocks, move to class block.

* Fix mention of "WAN" cache where actually APCU is used.

* Document that the storage class takes a local-server cache.
  This is an important requirement since the class has no
  coordination for purging or other invalidation. It expects
  an uncoordinated cache.

* Rename "load" to "loadConfig" as it's ambigious what it means among
  the half dozen other "load*" methods in this class. Also inline
  loadFromConfig and loadComputedUncached while at it to further
  reduce this.

* Rename "loadConfigContent" to "fetchLatestConfig" to match
  the existing fetchConfig, which does the same thing except it queries
  the primary db using READ_LATEST.

* Use Html.php when building HTML, instead of legacy Xml.php.
  While at it, also switch a few to Html::element instead of
  Html::rawElement (aka Xml::tags) by using Message->text() for
  messages that are not expected to contain rich wikitext.

Change-Id: Ic74d1597aa9201b371894e7a4bf9361752d9db21
2023-06-19 13:36:23 +00:00
Amir Sarabadani 9dc1a601ac Blocked domains: Fix removing a domain via the special page
Doing unset on array leads to the final array turning into associative array
and gets blocked by the validator.

You can check that it's broken in Persian Wikipedia, beta cluster or
localhost. Tested locally, fixes the issue.

Bug: T337431
Change-Id: Ib1be294bae1ae057dfb9a4445a8e13ac72b333b9
2023-06-18 00:35:21 +02:00
Amir Sarabadani 8b67de5bc1 blocked domains: Make sure users can't bypass the list by using uppercase
Added tests too

Bug: T337431
Change-Id: Ie3406d0b3c7d82ba44c11865e493375453555664
2023-06-16 01:22:48 +02:00
jenkins-bot 596a36866b Merge "Add missing AbuseFilterServices::getHookRunner()" 2023-06-15 18:06:28 +00:00
jenkins-bot 12d6d204ce Merge "BlockedDomains: Add logging in case of hit" 2023-06-15 16:33:37 +00:00
Amir Sarabadani da53cfe9dd BlockedDomains: Add logging in case of hit
This is basically copy paste of SpamBlacklist logging with the added
extra bit of what triggered the hit.

Bug: T337431
Change-Id: Ieb9e3ca615af88ab56735b56e24c80c42a68d478
2023-06-14 22:23:50 +02:00
thiemowmde b63d5c138e Use much more narrow IReadableDatabase and related where possible
Much more narrow interfaces. This code doesn't need more.

Change-Id: Iab0f1da27968246333a4a555b02bfb750cf9eedb
2023-06-14 19:42:01 +00:00