DifferenceEngine: Move MW_DIFF_VERSION to class constant DIFF_VERSION

[lhc/web/wiklou.git] / includes / WebRequest.php

diff --git a/includes/WebRequest.php b/includes/WebRequest.php
index b159f79..30efb3b 100644 (file)
--- a/includes/WebRequest.php
+++ b/includes/WebRequest.php
@@ -80,6 +80,9 @@ class WebRequest {
         */
        protected $sessionId = null;
 
+       /** @var bool Whether this HTTP request is "safe" (even if it is an HTTP post) */
+       protected $markedAsSafe = false;
+
        public function __construct() {
                $this->requestTime = isset( $_SERVER['REQUEST_TIME_FLOAT'] )
                        ? $_SERVER['REQUEST_TIME_FLOAT'] : microtime( true );
@@ -318,7 +321,7 @@ class WebRequest {
         *
         * @param string $path The URL path given from the client
         * @param array $bases One or more URLs, optionally with $1 at the end
-        * @param string $key If provided, the matching key in $bases will be
+        * @param string|bool $key If provided, the matching key in $bases will be
         *    passed on as the value of this URL parameter
         * @return array Array of URL variables to interpolate; empty if no match
         */
@@ -564,19 +567,16 @@ class WebRequest {
         * Fetch a text string from the given array or return $default if it's not
         * set. Carriage returns are stripped from the text, and with some language
         * modules there is an input transliteration applied. This should generally
-        * be used for form "<textarea>" and "<input>" fields. Used for
-        * user-supplied freeform text input (for which input transformations may
-        * be required - e.g.  Esperanto x-coding).
+        * be used for form "<textarea>" and "<input>" fields, and for
+        * user-supplied freeform text input.
         *
         * @param string $name
         * @param string $default Optional
         * @return string
         */
        public function getText( $name, $default = '' ) {
-               global $wgContLang;
                $val = $this->getVal( $name, $default );
-               return str_replace( "\r\n", "\n",
-                       $wgContLang->recodeInput( $val ) );
+               return str_replace( "\r\n", "\n", $val );
        }
 
        /**
@@ -1022,7 +1022,7 @@ class WebRequest {
         * @param mixed $data
         */
        public function setSessionData( $key, $data ) {
-               return $this->getSession()->set( $key, $data );
+               $this->getSession()->set( $key, $data );
        }
 
        /**
@@ -1245,4 +1245,64 @@ HTML;
        public function setIP( $ip ) {
                $this->ip = $ip;
        }
+
+       /**
+        * Check if this request uses a "safe" HTTP method
+        *
+        * Safe methods are verbs (e.g. GET/HEAD/OPTIONS) used for obtaining content. Such requests
+        * are not expected to mutate content, especially in ways attributable to the client. Verbs
+        * like POST and PUT are typical of non-safe requests which often change content.
+        *
+        * @return bool
+        * @see https://tools.ietf.org/html/rfc7231#section-4.2.1
+        * @see https://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html
+        * @since 1.28
+        */
+       public function hasSafeMethod() {
+               if ( !isset( $_SERVER['REQUEST_METHOD'] ) ) {
+                       return false; // CLI mode
+               }
+
+               return in_array( $_SERVER['REQUEST_METHOD'], [ 'GET', 'HEAD', 'OPTIONS', 'TRACE' ] );
+       }
+
+       /**
+        * Whether this request should be identified as being "safe"
+        *
+        * This means that the client is not requesting any state changes and that database writes
+        * are not inherently required. Ideally, no visible updates would happen at all. If they
+        * must, then they should not be publically attributed to the end user.
+        *
+        * In more detail:
+        *   - Cache populations and refreshes MAY occur.
+        *   - Private user session updates and private server logging MAY occur.
+        *   - Updates to private viewing activity data MAY occur via DeferredUpdates.
+        *   - Other updates SHOULD NOT occur (e.g. modifying content assets).
+        *
+        * @return bool
+        * @see https://tools.ietf.org/html/rfc7231#section-4.2.1
+        * @see https://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html
+        * @since 1.28
+        */
+       public function isSafeRequest() {
+               if ( $this->markedAsSafe && $this->wasPosted() ) {
+                       return true; // marked as a "safe" POST
+               }
+
+               return $this->hasSafeMethod();
+       }
+
+       /**
+        * Mark this request as identified as being nullipotent even if it is a POST request
+        *
+        * POST requests are often used due to the need for a client payload, even if the request
+        * is otherwise equivalent to a "safe method" request.
+        *
+        * @see https://tools.ietf.org/html/rfc7231#section-4.2.1
+        * @see https://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html
+        * @since 1.28
+        */
+       public function markAsSafeRequest() {
+               $this->markedAsSafe = true;
+       }
 }