SECURITY: Fix cache mode for (un)patrolled recent changes query
[lhc/web/wiklou.git] / includes / api / ApiQueryRecentChanges.php
index 517cf1f..864b182 100644 (file)
@@ -192,15 +192,15 @@ class ApiQueryRecentChanges extends ApiQueryGeneratorBase {
                                || ( isset( $show['patrolled'] ) && isset( $show['!patrolled'] ) )
                                || ( isset( $show['patrolled'] ) && isset( $show['unpatrolled'] ) )
                                || ( isset( $show['!patrolled'] ) && isset( $show['unpatrolled'] ) )
+                               || ( isset( $show['autopatrolled'] ) && isset( $show['!autopatrolled'] ) )
+                               || ( isset( $show['autopatrolled'] ) && isset( $show['unpatrolled'] ) )
+                               || ( isset( $show['autopatrolled'] ) && isset( $show['!patrolled'] ) )
                        ) {
                                $this->dieWithError( 'apierror-show' );
                        }
 
                        // Check permissions
-                       if ( isset( $show['patrolled'] )
-                               || isset( $show['!patrolled'] )
-                               || isset( $show['unpatrolled'] )
-                       ) {
+                       if ( $this->includesPatrollingFlags( $show ) ) {
                                if ( !$user->useRCPatrol() && !$user->useNPPatrol() ) {
                                        $this->dieWithError( 'apierror-permissiondenied-patrolflag', 'permissiondenied' );
                                }
@@ -211,8 +211,18 @@ class ApiQueryRecentChanges extends ApiQueryGeneratorBase {
                        $this->addWhereIf( 'rc_minor != 0', isset( $show['minor'] ) );
                        $this->addWhereIf( 'rc_bot = 0', isset( $show['!bot'] ) );
                        $this->addWhereIf( 'rc_bot != 0', isset( $show['bot'] ) );
-                       $this->addWhereIf( 'rc_user = 0', isset( $show['anon'] ) );
-                       $this->addWhereIf( 'rc_user != 0', isset( $show['!anon'] ) );
+                       if ( isset( $show['anon'] ) || isset( $show['!anon'] ) ) {
+                               $actorMigration = ActorMigration::newMigration();
+                               $actorQuery = $actorMigration->getJoin( 'rc_user' );
+                               $this->addTables( $actorQuery['tables'] );
+                               $this->addJoinConds( $actorQuery['joins'] );
+                               $this->addWhereIf(
+                                       $actorMigration->isAnon( $actorQuery['fields']['rc_user'] ), isset( $show['anon'] )
+                               );
+                               $this->addWhereIf(
+                                       $actorMigration->isNotAnon( $actorQuery['fields']['rc_user'] ), isset( $show['!anon'] )
+                               );
+                       }
                        $this->addWhereIf( 'rc_patrolled = 0', isset( $show['!patrolled'] ) );
                        $this->addWhereIf( 'rc_patrolled != 0', isset( $show['patrolled'] ) );
                        $this->addWhereIf( 'page_is_redirect = 1', isset( $show['redirect'] ) );
@@ -220,13 +230,22 @@ class ApiQueryRecentChanges extends ApiQueryGeneratorBase {
                        if ( isset( $show['unpatrolled'] ) ) {
                                // See ChangesList::isUnpatrolled
                                if ( $user->useRCPatrol() ) {
-                                       $this->addWhere( 'rc_patrolled = 0' );
+                                       $this->addWhere( 'rc_patrolled = ' . RecentChange::PRC_UNPATROLLED );
                                } elseif ( $user->useNPPatrol() ) {
-                                       $this->addWhere( 'rc_patrolled = 0' );
+                                       $this->addWhere( 'rc_patrolled = ' . RecentChange::PRC_UNPATROLLED );
                                        $this->addWhereFld( 'rc_type', RC_NEW );
                                }
                        }
 
+                       $this->addWhereIf(
+                               'rc_patrolled != ' . RecentChange::PRC_AUTOPATROLLED,
+                               isset( $show['!autopatrolled'] )
+                       );
+                       $this->addWhereIf(
+                               'rc_patrolled = ' . RecentChange::PRC_AUTOPATROLLED,
+                               isset( $show['autopatrolled'] )
+                       );
+
                        // Don't throw log entries out the window here
                        $this->addWhereIf(
                                'page_is_redirect = 0 OR page_is_redirect IS NULL',
@@ -237,14 +256,21 @@ class ApiQueryRecentChanges extends ApiQueryGeneratorBase {
                $this->requireMaxOneParameter( $params, 'user', 'excludeuser' );
 
                if ( !is_null( $params['user'] ) ) {
-                       $this->addWhereFld( 'rc_user_text', $params['user'] );
+                       // Don't query by user ID here, it might be able to use the rc_user_text index.
+                       $actorQuery = ActorMigration::newMigration()
+                               ->getWhere( $this->getDB(), 'rc_user', User::newFromName( $params['user'], false ), false );
+                       $this->addTables( $actorQuery['tables'] );
+                       $this->addJoinConds( $actorQuery['joins'] );
+                       $this->addWhere( $actorQuery['conds'] );
                }
 
                if ( !is_null( $params['excludeuser'] ) ) {
-                       // We don't use the rc_user_text index here because
-                       // * it would require us to sort by rc_user_text before rc_timestamp
-                       // * the != condition doesn't throw out too many rows anyway
-                       $this->addWhere( 'rc_user_text != ' . $this->getDB()->addQuotes( $params['excludeuser'] ) );
+                       // Here there's no chance to use the rc_user_text index, so allow ID to be used.
+                       $actorQuery = ActorMigration::newMigration()
+                               ->getWhere( $this->getDB(), 'rc_user', User::newFromName( $params['excludeuser'], false ) );
+                       $this->addTables( $actorQuery['tables'] );
+                       $this->addJoinConds( $actorQuery['joins'] );
+                       $this->addWhere( 'NOT(' . $actorQuery['conds'] . ')' );
                }
 
                /* Add the fields we're concerned with to our query. */
@@ -272,8 +298,12 @@ class ApiQueryRecentChanges extends ApiQueryGeneratorBase {
 
                        /* Add fields to our query if they are specified as a needed parameter. */
                        $this->addFieldsIf( [ 'rc_this_oldid', 'rc_last_oldid' ], $this->fld_ids );
-                       $this->addFieldsIf( 'rc_user', $this->fld_user || $this->fld_userid );
-                       $this->addFieldsIf( 'rc_user_text', $this->fld_user );
+                       if ( $this->fld_user || $this->fld_userid ) {
+                               $actorQuery = ActorMigration::newMigration()->getJoin( 'rc_user' );
+                               $this->addTables( $actorQuery['tables'] );
+                               $this->addFields( $actorQuery['fields'] );
+                               $this->addJoinConds( $actorQuery['joins'] );
+                       }
                        $this->addFieldsIf( [ 'rc_minor', 'rc_type', 'rc_bot' ], $this->fld_flags );
                        $this->addFieldsIf( [ 'rc_old_len', 'rc_new_len' ], $this->fld_sizes );
                        $this->addFieldsIf( [ 'rc_patrolled', 'rc_log_type' ], $this->fld_patrolled );
@@ -350,8 +380,8 @@ class ApiQueryRecentChanges extends ApiQueryGeneratorBase {
                $this->token = $params['token'];
 
                if ( $this->fld_comment || $this->fld_parsedcomment || $this->token ) {
-                       $this->commentStore = new CommentStore( 'rc_comment' );
-                       $commentQuery = $this->commentStore->getJoin();
+                       $this->commentStore = CommentStore::getStore();
+                       $commentQuery = $this->commentStore->getJoin( 'rc_comment' );
                        $this->addTables( $commentQuery['tables'] );
                        $this->addFields( $commentQuery['fields'] );
                        $this->addJoinConds( $commentQuery['joins'] );
@@ -506,7 +536,7 @@ class ApiQueryRecentChanges extends ApiQueryGeneratorBase {
                                $anyHidden = true;
                        }
                        if ( Revision::userCanBitfield( $row->rc_deleted, Revision::DELETED_COMMENT, $user ) ) {
-                               $comment = $this->commentStore->getComment( $row )->text;
+                               $comment = $this->commentStore->getComment( 'rc_comment', $row )->text;
                                if ( $this->fld_comment ) {
                                        $vals['comment'] = $comment;
                                }
@@ -523,8 +553,9 @@ class ApiQueryRecentChanges extends ApiQueryGeneratorBase {
 
                /* Add the patrolled flag */
                if ( $this->fld_patrolled ) {
-                       $vals['patrolled'] = $row->rc_patrolled == 1;
+                       $vals['patrolled'] = $row->rc_patrolled != RecentChange::PRC_UNPATROLLED;
                        $vals['unpatrolled'] = ChangesList::isUnpatrolled( $row, $user );
+                       $vals['autopatrolled'] = $row->rc_patrolled == RecentChange::PRC_AUTOPATROLLED;
                }
 
                if ( $this->fld_loginfo && $row->rc_type == RC_LOG ) {
@@ -584,13 +615,23 @@ class ApiQueryRecentChanges extends ApiQueryGeneratorBase {
                return $vals;
        }
 
+       /**
+        * @param array $flagsArray flipped array (string flags are keys)
+        * @return bool
+        */
+       private function includesPatrollingFlags( array $flagsArray ) {
+               return isset( $flagsArray['patrolled'] ) ||
+                       isset( $flagsArray['!patrolled'] ) ||
+                       isset( $flagsArray['unpatrolled'] ) ||
+                       isset( $flagsArray['autopatrolled'] ) ||
+                       isset( $flagsArray['!autopatrolled'] );
+       }
+
        public function getCacheMode( $params ) {
-               if ( isset( $params['show'] ) ) {
-                       foreach ( $params['show'] as $show ) {
-                               if ( $show === 'patrolled' || $show === '!patrolled' ) {
-                                       return 'private';
-                               }
-                       }
+               if ( isset( $params['show'] ) &&
+                       $this->includesPatrollingFlags( array_flip( $params['show'] ) )
+               ) {
+                       return 'private';
                }
                if ( isset( $params['token'] ) ) {
                        return 'private';
@@ -673,7 +714,9 @@ class ApiQueryRecentChanges extends ApiQueryGeneratorBase {
                                        '!redirect',
                                        'patrolled',
                                        '!patrolled',
-                                       'unpatrolled'
+                                       'unpatrolled',
+                                       'autopatrolled',
+                                       '!autopatrolled',
                                ]
                        ],
                        'limit' => [