Disable $wgServer autodetection to prevent cache poisoning attacks
[lhc/web/wiklou.git] / includes / Linker.php
index f20795d..864019d 100644 (file)
@@ -21,6 +21,7 @@
  */
 use MediaWiki\Linker\LinkTarget;
 use MediaWiki\MediaWikiServices;
+use MediaWiki\Revision\RevisionRecord;
 
 /**
  * Some internal bits split of from Skin.php. These functions are used
@@ -687,35 +688,38 @@ class Linker {
                if ( $label == '' ) {
                        $label = $title->getPrefixedText();
                }
-               $encLabel = htmlspecialchars( $label );
+               $repoGroup = MediaWikiServices::getInstance()->getRepoGroup();
                $currentExists = $time
-                       && MediaWikiServices::getInstance()->getRepoGroup()->findFile( $title ) !== false;
+                       && $repoGroup->findFile( $title ) !== false;
 
                if ( ( $wgUploadMissingFileUrl || $wgUploadNavigationUrl || $wgEnableUploads )
                        && !$currentExists
                ) {
-                       $redir = RepoGroup::singleton()->getLocalRepo()->checkRedirect( $title );
-
-                       if ( $redir ) {
-                               // We already know it's a redirect, so mark it
-                               // accordingly
+                       if ( $repoGroup->getLocalRepo()->checkRedirect( $title ) ) {
+                               // We already know it's a redirect, so mark it accordingly
                                return self::link(
                                        $title,
-                                       $encLabel,
+                                       htmlspecialchars( $label ),
                                        [ 'class' => 'mw-redirect' ],
                                        wfCgiToArray( $query ),
                                        [ 'known', 'noclasses' ]
                                );
                        }
 
-                       $href = self::getUploadUrl( $title, $query );
-
-                       return '<a href="' . htmlspecialchars( $href ) . '" class="new" title="' .
-                               htmlspecialchars( $title->getPrefixedText(), ENT_QUOTES ) . '">' .
-                               $encLabel . '</a>';
+                       return Html::element( 'a', [
+                                       'href' => self::getUploadUrl( $title, $query ),
+                                       'class' => 'new',
+                                       'title' => $title->getPrefixedText()
+                               ], $label );
                }
 
-               return self::link( $title, $encLabel, [], wfCgiToArray( $query ), [ 'known', 'noclasses' ] );
+               return self::link(
+                       $title,
+                       htmlspecialchars( $label ),
+                       [],
+                       wfCgiToArray( $query ),
+                       [ 'known', 'noclasses' ]
+               );
        }
 
        /**
@@ -887,7 +891,7 @@ class Linker {
         * Make user link (or user contributions for unregistered users)
         * @param int $userId User id in database.
         * @param string $userName User name in database.
-        * @param string $altUserName Text to display instead of the user name (optional)
+        * @param string|false $altUserName Text to display instead of the user name (optional)
         * @return string HTML fragment
         * @since 1.16.3. $altUserName was added in 1.19.
         */
@@ -977,7 +981,9 @@ class Linker {
 
                        $items[] = self::link( $contribsPage, wfMessage( 'contribslink' )->escaped(), $attribs );
                }
-               if ( $blockable && $wgUser->isAllowed( 'block' ) ) {
+               $userCanBlock = MediaWikiServices::getInstance()->getPermissionManager()
+                       ->userHasRight( $wgUser, 'block' );
+               if ( $blockable && $userCanBlock ) {
                        $items[] = self::blockLink( $userId, $userText );
                }
 
@@ -1035,7 +1041,7 @@ class Linker {
                }
 
                $userTalkPage = new TitleValue( NS_USER_TALK, strtr( $userText, ' ', '_' ) );
-               $moreLinkAttribs['class'] = 'mw-usertoollinks-talk';
+               $moreLinkAttribs = [ 'class' => 'mw-usertoollinks-talk' ];
 
                return self::link( $userTalkPage,
                        wfMessage( 'talkpagelinktext' )->escaped(),
@@ -1057,7 +1063,7 @@ class Linker {
                }
 
                $blockPage = SpecialPage::getTitleFor( 'Block', $userText );
-               $moreLinkAttribs['class'] = 'mw-usertoollinks-block';
+               $moreLinkAttribs = [ 'class' => 'mw-usertoollinks-block' ];
 
                return self::link( $blockPage,
                        wfMessage( 'blocklink' )->escaped(),
@@ -1078,7 +1084,7 @@ class Linker {
                }
 
                $emailPage = SpecialPage::getTitleFor( 'Emailuser', $userText );
-               $moreLinkAttribs['class'] = 'mw-usertoollinks-mail';
+               $moreLinkAttribs = [ 'class' => 'mw-usertoollinks-mail' ];
                return self::link( $emailPage,
                        wfMessage( 'emaillink' )->escaped(),
                        $moreLinkAttribs
@@ -1093,15 +1099,15 @@ class Linker {
         * @return string HTML fragment
         */
        public static function revUserLink( $rev, $isPublic = false ) {
-               if ( $rev->isDeleted( Revision::DELETED_USER ) && $isPublic ) {
+               if ( $rev->isDeleted( RevisionRecord::DELETED_USER ) && $isPublic ) {
                        $link = wfMessage( 'rev-deleted-user' )->escaped();
-               } elseif ( $rev->userCan( Revision::DELETED_USER ) ) {
-                       $link = self::userLink( $rev->getUser( Revision::FOR_THIS_USER ),
-                               $rev->getUserText( Revision::FOR_THIS_USER ) );
+               } elseif ( $rev->userCan( RevisionRecord::DELETED_USER ) ) {
+                       $link = self::userLink( $rev->getUser( RevisionRecord::FOR_THIS_USER ),
+                               $rev->getUserText( RevisionRecord::FOR_THIS_USER ) );
                } else {
                        $link = wfMessage( 'rev-deleted-user' )->escaped();
                }
-               if ( $rev->isDeleted( Revision::DELETED_USER ) ) {
+               if ( $rev->isDeleted( RevisionRecord::DELETED_USER ) ) {
                        return '<span class="history-deleted">' . $link . '</span>';
                }
                return $link;
@@ -1116,11 +1122,11 @@ class Linker {
         * @return string HTML
         */
        public static function revUserTools( $rev, $isPublic = false, $useParentheses = true ) {
-               if ( $rev->userCan( Revision::DELETED_USER ) &&
-                       ( !$rev->isDeleted( Revision::DELETED_USER ) || !$isPublic )
+               if ( $rev->userCan( RevisionRecord::DELETED_USER ) &&
+                       ( !$rev->isDeleted( RevisionRecord::DELETED_USER ) || !$isPublic )
                ) {
-                       $userId = $rev->getUser( Revision::FOR_THIS_USER );
-                       $userText = $rev->getUserText( Revision::FOR_THIS_USER );
+                       $userId = $rev->getUser( RevisionRecord::FOR_THIS_USER );
+                       $userText = $rev->getUserText( RevisionRecord::FOR_THIS_USER );
                        if ( $userId || (string)$userText !== '' ) {
                                $link = self::userLink( $userId, $userText )
                                        . self::userToolLinks( $userId, $userText, false, 0, null,
@@ -1132,7 +1138,7 @@ class Linker {
                        $link = wfMessage( 'rev-deleted-user' )->escaped();
                }
 
-               if ( $rev->isDeleted( Revision::DELETED_USER ) ) {
+               if ( $rev->isDeleted( RevisionRecord::DELETED_USER ) ) {
                        return ' <span class="history-deleted mw-userlink">' . $link . '</span>';
                }
                return $link;
@@ -1319,7 +1325,7 @@ class Linker {
                                        $services->getNamespaceInfo()->getCanonicalName( NS_MEDIA ), '/' );
                                $medians .= '|';
                                $medians .= preg_quote(
-                                       MediaWikiServices::getInstance()->getContentLanguage()->getNsText( NS_MEDIA ),
+                                       $services->getContentLanguage()->getNsText( NS_MEDIA ),
                                        '/'
                                ) . '):';
 
@@ -1356,7 +1362,7 @@ class Linker {
                                        }
                                        if ( $match[1] !== false && $match[1] !== '' ) {
                                                if ( preg_match(
-                                                       MediaWikiServices::getInstance()->getContentLanguage()->linkTrail(),
+                                                       $services->getContentLanguage()->linkTrail(),
                                                        $match[3],
                                                        $submatch
                                                ) ) {
@@ -1372,7 +1378,7 @@ class Linker {
 
                                                Title::newFromText( $linkTarget );
                                                try {
-                                                       $target = MediaWikiServices::getInstance()->getTitleParser()->
+                                                       $target = $services->getTitleParser()->
                                                                parseTitle( $linkTarget );
 
                                                        if ( $target->getText() == '' && !$target->isExternal()
@@ -1571,18 +1577,18 @@ class Linker {
        public static function revComment( Revision $rev, $local = false, $isPublic = false,
                $useParentheses = true
        ) {
-               if ( $rev->getComment( Revision::RAW ) == "" ) {
+               if ( $rev->getComment( RevisionRecord::RAW ) == "" ) {
                        return "";
                }
-               if ( $rev->isDeleted( Revision::DELETED_COMMENT ) && $isPublic ) {
+               if ( $rev->isDeleted( RevisionRecord::DELETED_COMMENT ) && $isPublic ) {
                        $block = " <span class=\"comment\">" . wfMessage( 'rev-deleted-comment' )->escaped() . "</span>";
-               } elseif ( $rev->userCan( Revision::DELETED_COMMENT ) ) {
-                       $block = self::commentBlock( $rev->getComment( Revision::FOR_THIS_USER ),
+               } elseif ( $rev->userCan( RevisionRecord::DELETED_COMMENT ) ) {
+                       $block = self::commentBlock( $rev->getComment( RevisionRecord::FOR_THIS_USER ),
                                $rev->getTitle(), $local, null, $useParentheses );
                } else {
                        $block = " <span class=\"comment\">" . wfMessage( 'rev-deleted-comment' )->escaped() . "</span>";
                }
-               if ( $rev->isDeleted( Revision::DELETED_COMMENT ) ) {
+               if ( $rev->isDeleted( RevisionRecord::DELETED_COMMENT ) ) {
                        return " <span class=\"history-deleted comment\">$block</span>";
                }
                return $block;
@@ -1875,10 +1881,10 @@ class Linker {
                $editCount = 0;
                $moreRevs = false;
                foreach ( $res as $row ) {
-                       if ( $rev->getUserText( Revision::RAW ) != $row->rev_user_text ) {
+                       if ( $rev->getUserText( RevisionRecord::RAW ) != $row->rev_user_text ) {
                                if ( $verify &&
-                                       ( $row->rev_deleted & Revision::DELETED_TEXT
-                                               || $row->rev_deleted & Revision::DELETED_USER
+                                       ( $row->rev_deleted & RevisionRecord::DELETED_TEXT
+                                               || $row->rev_deleted & RevisionRecord::DELETED_USER
                                ) ) {
                                        // If the user or the text of the revision we might rollback
                                        // to is deleted in some way we can't rollback. Similar to
@@ -1906,7 +1912,7 @@ class Linker {
         * @since 1.16.3. $context added in 1.20. $editCount added in 1.21
         * @param Revision $rev
         * @param IContextSource|null $context Context to use or null for the main context.
-        * @param int $editCount Number of edits that would be reverted
+        * @param int|false $editCount Number of edits that would be reverted
         * @return string HTML fragment
         */
        public static function buildRollbackLink( $rev, IContextSource $context = null,
@@ -2102,12 +2108,14 @@ class Linker {
         * @return string HTML fragment
         */
        public static function getRevDeleteLink( User $user, Revision $rev, LinkTarget $title ) {
-               $canHide = $user->isAllowed( 'deleterevision' );
-               if ( !$canHide && !( $rev->getVisibility() && $user->isAllowed( 'deletedhistory' ) ) ) {
+               $permissionManager = MediaWikiServices::getInstance()->getPermissionManager();
+               $canHide = $permissionManager->userHasRight( $user, 'deleterevision' );
+               $canHideHistory = $permissionManager->userHasRight( $user, 'deletedhistory' );
+               if ( !$canHide && !( $rev->getVisibility() && $canHideHistory ) ) {
                        return '';
                }
 
-               if ( !$rev->userCan( Revision::DELETED_RESTRICTED, $user ) ) {
+               if ( !$rev->userCan( RevisionRecord::DELETED_RESTRICTED, $user ) ) {
                        return self::revDeleteLinkDisabled( $canHide ); // revision was hidden from sysops
                }
                $prefixedDbKey = MediaWikiServices::getInstance()->getTitleFormatter()->
@@ -2130,7 +2138,7 @@ class Linker {
                        ];
                }
                return self::revDeleteLink( $query,
-                       $rev->isDeleted( Revision::DELETED_RESTRICTED ), $canHide );
+                       $rev->isDeleted( RevisionRecord::DELETED_RESTRICTED ), $canHide );
        }
 
        /**