Merge "Make DBAccessBase use DBConnRef, rename $wiki, and hide getLoadBalancer()"

[lhc/web/wiklou.git] / includes / Rest / Router.php

diff --git a/includes/Rest/Router.php b/includes/Rest/Router.php
index 5ba3d08..a520130 100644 (file)
--- a/includes/Rest/Router.php
+++ b/includes/Rest/Router.php
@@ -4,7 +4,9 @@ namespace MediaWiki\Rest;
 
 use AppendIterator;
 use BagOStuff;
+use MediaWiki\Rest\BasicAccess\BasicAuthorizerInterface;
 use MediaWiki\Rest\PathTemplateMatcher\PathMatcher;
+use MediaWiki\Rest\Validator\Validator;
 use Wikimedia\ObjectFactory;
 
 /**
@@ -40,21 +42,38 @@ class Router {
        /** @var ResponseFactory */
        private $responseFactory;
 
+       /** @var BasicAuthorizerInterface */
+       private $basicAuth;
+
+       /** @var ObjectFactory */
+       private $objectFactory;
+
+       /** @var Validator */
+       private $restValidator;
+
        /**
         * @param string[] $routeFiles List of names of JSON files containing routes
         * @param array $extraRoutes Extension route array
         * @param string $rootPath The base URL path
         * @param BagOStuff $cacheBag A cache in which to store the matcher trees
         * @param ResponseFactory $responseFactory
+        * @param BasicAuthorizerInterface $basicAuth
+        * @param ObjectFactory $objectFactory
+        * @param Validator $restValidator
         */
        public function __construct( $routeFiles, $extraRoutes, $rootPath,
-               BagOStuff $cacheBag, ResponseFactory $responseFactory
+               BagOStuff $cacheBag, ResponseFactory $responseFactory,
+               BasicAuthorizerInterface $basicAuth, ObjectFactory $objectFactory,
+               Validator $restValidator
        ) {
                $this->routeFiles = $routeFiles;
                $this->extraRoutes = $extraRoutes;
                $this->rootPath = $rootPath;
                $this->cacheBag = $cacheBag;
                $this->responseFactory = $responseFactory;
+               $this->basicAuth = $basicAuth;
+               $this->objectFactory = $objectFactory;
+               $this->restValidator = $restValidator;
        }
 
        /**
@@ -189,7 +208,9 @@ class Router {
         * @return false|string
         */
        private function getRelativePath( $path ) {
-               if ( substr_compare( $path, $this->rootPath, 0, strlen( $this->rootPath ) ) !== 0 ) {
+               if ( strlen( $this->rootPath ) > strlen( $path ) ||
+                       substr_compare( $path, $this->rootPath, 0, strlen( $this->rootPath ) ) !== 0
+               ) {
                        return false;
                }
                return substr( $path, strlen( $this->rootPath ) );
@@ -236,9 +257,10 @@ class Router {
                $request->setPathParams( array_map( 'rawurldecode', $match['params'] ) );
                $spec = $match['userData'];
                $objectFactorySpec = array_intersect_key( $spec,
+                       // @todo ObjectFactory supports more keys than this.
                        [ 'factory' => true, 'class' => true, 'args' => true ] );
                /** @var $handler Handler (annotation for PHPStorm) */
-               $handler = ObjectFactory::getObjectFromSpec( $objectFactorySpec );
+               $handler = $this->objectFactory->createObject( $objectFactorySpec );
                $handler->init( $this, $request, $spec, $this->responseFactory );
 
                try {
@@ -254,6 +276,14 @@ class Router {
         * @return ResponseInterface
         */
        private function executeHandler( $handler ): ResponseInterface {
+               // @phan-suppress-next-line PhanAccessMethodInternal
+               $authResult = $this->basicAuth->authorize( $handler->getRequest(), $handler );
+               if ( $authResult ) {
+                       return $this->responseFactory->createHttpError( 403, [ 'error' => $authResult ] );
+               }
+
+               $handler->validate( $this->restValidator );
+
                $response = $handler->execute();
                if ( !( $response instanceof ResponseInterface ) ) {
                        $response = $this->responseFactory->createFromReturnValue( $response );