Merge "Log headers sent errors more usefully in thumb.php"

diff --git a/includes/DefaultSettings.php b/includes/DefaultSettings.php
index f08f5b7..ab1afe2 100644 (file)
--- a/includes/DefaultSettings.php
+++ b/includes/DefaultSettings.php
@@ -5720,6 +5720,10 @@ $wgRateLimits = [
                'newbie' => [ 5, 86400 ],
                'user' => [ 20, 86400 ],
        ],
+       'changeemail' => [
+               'ip-all' => [ 10, 3600 ],
+               'user' => [ 4, 86400 ]
+       ],
        // Purging pages
        'purge' => [
                'ip' => [ 30, 60 ],

diff --git a/includes/HeaderCallback.php b/includes/HeaderCallback.php
index 650a3a8..30cc7f9 100644 (file)
--- a/includes/HeaderCallback.php
+++ b/includes/HeaderCallback.php
@@ -2,6 +2,9 @@
 
 namespace MediaWiki;
 
+/**
+ * @since 1.29
+ */
 class HeaderCallback {
        private static $headersSentException;
        private static $messageSent = false;
@@ -10,6 +13,8 @@ class HeaderCallback {
         * Register a callback to be called when headers are sent. There can only
         * be one of these handlers active, so all relevant actions have to be in
         * here.
+        *
+        * @since 1.29
         */
        public static function register() {
                header_register_callback( [ __CLASS__, 'callback' ] );
@@ -17,6 +22,8 @@ class HeaderCallback {
 
        /**
         * The callback, which is called by the transport
+        *
+        * @since 1.29
         */
        public static function callback() {
                // Prevent caching of responses with cookies (T127993)
@@ -57,6 +64,8 @@ class HeaderCallback {
        /**
         * Log a warning message if headers have already been sent. This can be
         * called before flushing the output.
+        *
+        * @since 1.29
         */
        public static function warnIfHeadersSent() {
                if ( headers_sent() && !self::$messageSent ) {

diff --git a/includes/api/ApiBlock.php b/includes/api/ApiBlock.php
index c71de40..4801267 100644 (file)
--- a/includes/api/ApiBlock.php
+++ b/includes/api/ApiBlock.php
@@ -129,6 +129,11 @@ class ApiBlock extends ApiBase {
                        'NamespaceRestrictions' => $namespaceRestrictions,
                ];
 
+               $status = SpecialBlock::validateTarget( $params['user'], $user );
+               if ( !$status->isOK() ) {
+                       $this->dieStatus( $status );
+               }
+
                $retval = SpecialBlock::processForm( $data, $this->getContext() );
                if ( $retval !== true ) {
                        $this->dieStatus( $this->errorArrayToStatus( $retval ) );

diff --git a/includes/api/ApiQueryRecentChanges.php b/includes/api/ApiQueryRecentChanges.php
index 4b1bf2e..8ae1b66 100644 (file)
--- a/includes/api/ApiQueryRecentChanges.php
+++ b/includes/api/ApiQueryRecentChanges.php
@@ -214,12 +214,7 @@ class ApiQueryRecentChanges extends ApiQueryGeneratorBase {
                        }
 
                        // Check permissions
-                       if ( isset( $show['patrolled'] )
-                               || isset( $show['!patrolled'] )
-                               || isset( $show['unpatrolled'] )
-                               || isset( $show['autopatrolled'] )
-                               || isset( $show['!autopatrolled'] )
-                       ) {
+                       if ( $this->includesPatrollingFlags( $show ) ) {
                                if ( !$user->useRCPatrol() && !$user->useNPPatrol() ) {
                                        $this->dieWithError( 'apierror-permissiondenied-patrolflag', 'permissiondenied' );
                                }
@@ -641,13 +636,23 @@ class ApiQueryRecentChanges extends ApiQueryGeneratorBase {
                return $vals;
        }
 
+       /**
+        * @param array $flagsArray flipped array (string flags are keys)
+        * @return bool
+        */
+       private function includesPatrollingFlags( array $flagsArray ) {
+               return isset( $flagsArray['patrolled'] ) ||
+                       isset( $flagsArray['!patrolled'] ) ||
+                       isset( $flagsArray['unpatrolled'] ) ||
+                       isset( $flagsArray['autopatrolled'] ) ||
+                       isset( $flagsArray['!autopatrolled'] );
+       }
+
        public function getCacheMode( $params ) {
-               if ( isset( $params['show'] ) ) {
-                       foreach ( $params['show'] as $show ) {
-                               if ( $show === 'patrolled' || $show === '!patrolled' ) {
-                                       return 'private';
-                               }
-                       }
+               if ( isset( $params['show'] ) &&
+                       $this->includesPatrollingFlags( array_flip( $params['show'] ) )
+               ) {
+                       return 'private';
                }
                if ( isset( $params['token'] ) ) {
                        return 'private';

diff --git a/includes/parser/Sanitizer.php b/includes/parser/Sanitizer.php
index abf0714..f76e3a9 100644 (file)
--- a/includes/parser/Sanitizer.php
+++ b/includes/parser/Sanitizer.php
@@ -1073,6 +1073,7 @@ class Sanitizer {
                                | image\s*\(
                                | image-set\s*\(
                                | attr\s*\([^)]+[\s,]+url
+                               | var\s*\(
                        !ix', $value ) ) {
                        return '/* insecure input */';
                }

diff --git a/includes/specials/SpecialChangeEmail.php b/includes/specials/SpecialChangeEmail.php
index 8d5cf85..956ff77 100644 (file)
--- a/includes/specials/SpecialChangeEmail.php
+++ b/includes/specials/SpecialChangeEmail.php
@@ -55,14 +55,16 @@ class SpecialChangeEmail extends FormSpecialPage {
         * @param string $par
         */
        function execute( $par ) {
-               $this->checkLoginSecurityLevel();
-
                $out = $this->getOutput();
                $out->disallowUserJs();
 
                parent::execute( $par );
        }
 
+       protected function getLoginSecurityLevel() {
+               return $this->getName();
+       }
+
        protected function checkExecutePermissions( User $user ) {
                if ( !AuthManager::singleton()->allowsPropertyChange( 'emailaddress' ) ) {
                        throw new ErrorPageError( 'changeemail', 'cannotchangeemail' );
@@ -76,6 +78,10 @@ class SpecialChangeEmail extends FormSpecialPage {
                        throw new PermissionsError( 'viewmyprivateinfo' );
                }
 
+               if ( $user->isBlockedFromEmailuser() ) {
+                       throw new UserBlockedError( $user->getBlock() );
+               }
+
                parent::checkExecutePermissions( $user );
        }
 
@@ -160,6 +166,12 @@ class SpecialChangeEmail extends FormSpecialPage {
                        return Status::newFatal( 'changeemail-nochange' );
                }
 
+               // To prevent spam, rate limit adding a new address, but do
+               // not rate limit removing an address.
+               if ( $newaddr !== '' && $user->pingLimiter( 'changeemail' ) ) {
+                       return Status::newFatal( 'actionthrottledtext' );
+               }
+
                $oldaddr = $user->getEmail();
                $status = $user->setEmailWithConfirmation( $newaddr );
                if ( !$status->isGood() ) {

diff --git a/tests/phpunit/includes/api/ApiBlockTest.php b/tests/phpunit/includes/api/ApiBlockTest.php
index 060834f..e06f828 100644 (file)
--- a/tests/phpunit/includes/api/ApiBlockTest.php
+++ b/tests/phpunit/includes/api/ApiBlockTest.php
@@ -22,6 +22,10 @@ class ApiBlockTest extends ApiTestCase {
                );
 
                $this->mUser = $this->getMutableTestUser()->getUser();
+               $this->setMwGlobals( 'wgBlockCIDRLimit', [
+                       'IPv4' => 16,
+                       'IPv6' => 19,
+               ] );
        }
 
        protected function getTokens() {
@@ -41,7 +45,6 @@ class ApiBlockTest extends ApiTestCase {
                $tokens = $this->getTokens();
 
                $this->assertNotNull( $this->mUser, 'Sanity check' );
-               $this->assertNotSame( 0, $this->mUser->getId(), 'Sanity check' );
 
                $this->assertArrayHasKey( 'blocktoken', $tokens, 'Sanity check' );
 
@@ -332,4 +335,18 @@ class ApiBlockTest extends ApiTestCase {
                        self::$users['sysop']->getUser()
                );
        }
+
+       public function testRangeBlock() {
+               $this->mUser = User::newFromName( '128.0.0.0/16', false );
+               $this->doBlock();
+       }
+
+       /**
+        * @expectedException ApiUsageException
+        * @expectedExceptionMessage Range blocks larger than /16 are not allowed.
+        */
+       public function testVeryLargeRangeBlock() {
+               $this->mUser = User::newFromName( '128.0.0.0/1', false );
+               $this->doBlock();
+       }
 }

diff --git a/tests/phpunit/includes/parser/SanitizerTest.php b/tests/phpunit/includes/parser/SanitizerTest.php
index 1f6f4e8..1b67bbd 100644 (file)
--- a/tests/phpunit/includes/parser/SanitizerTest.php
+++ b/tests/phpunit/includes/parser/SanitizerTest.php
@@ -326,6 +326,7 @@ class SanitizerTest extends MediaWikiTestCase {
                        ],
                        [ '/* insecure input */', 'foo: attr( title, url );' ],
                        [ '/* insecure input */', 'foo: attr( title url );' ],
+                       [ '/* insecure input */', 'foo: var(--evil-attribute)' ],
                ];
        }