mediawiki-extensions-AbuseF.../includes/api/ApiAbuseFilterEvalExpression.php
Daimona Eaytoy cee8e14cf1 SECURITY: Require view-private or modify for the evalexpression API
This is consistent with the "anti-DoS" measures on other API modules.
Although this may not be a serious DoS vector, it makes sense to
restrict this module. Moreover, it's also consistent with
Special:AbuseFilter/tools (which is the corresponding web interface),
which requires the same user rights.

Bug: T238451
Change-Id: Id09fd57195d71884674ac0470f137ca30c56e13c
2019-11-21 16:33:04 +01:00

43 lines
931 B
PHP

<?php
class ApiAbuseFilterEvalExpression extends ApiBase {
/**
* @see ApiBase::execute()
*/
public function execute() {
// "Anti-DoS"
if ( !AbuseFilter::canViewPrivate( $this->getUser() ) ) {
$this->dieWithError( 'apierror-abusefilter-canteval', 'permissiondenied' );
}
$params = $this->extractRequestParams();
$result = AbuseFilter::evaluateExpression( $params['expression'] );
$this->getResult()->addValue( null, $this->getModuleName(), [ 'result' => $result ] );
}
/**
* @see ApiBase::getAllowedParams()
* @return array
*/
public function getAllowedParams() {
return [
'expression' => [
ApiBase::PARAM_REQUIRED => true,
],
];
}
/**
* @see ApiBase::getExamplesMessages()
* @return array
*/
protected function getExamplesMessages() {
return [
'action=abusefilterevalexpression&expression=lcase("FOO")'
=> 'apihelp-abusefilterevalexpression-example-1',
];
}
}