Merge "Add test for bracketed external links with invalid template-generated target"

[lhc/web/wiklou.git] / includes / api / ApiQueryAllLinks.php

diff --git a/includes/api/ApiQueryAllLinks.php b/includes/api/ApiQueryAllLinks.php
index 6b8fe57..da4840f 100644 (file)
--- a/includes/api/ApiQueryAllLinks.php
+++ b/includes/api/ApiQueryAllLinks.php
@@ -4,7 +4,7 @@
  *
  * Created on July 7, 2007
  *
- * Copyright © 2006 Yuri Astrakhan <Firstname><Lastname>@gmail.com
+ * Copyright © 2006 Yuri Astrakhan "<Firstname><Lastname>@gmail.com"
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -77,16 +77,25 @@ class ApiQueryAllLinks extends ApiQueryGeneratorBase {
                }
                if ( !is_null( $params['continue'] ) ) {
                        $continueArr = explode( '|', $params['continue'] );
-                       if ( count( $continueArr ) != 2 ) {
-                               $this->dieUsage( 'Invalid continue parameter', 'badcontinue' );
+                       $op = $params['dir'] == 'descending' ? '<' : '>';
+                       if ( $params['unique'] ) {
+                               if ( count( $continueArr ) != 1 ) {
+                                       $this->dieUsage( 'Invalid continue parameter', 'badcontinue' );
+                               }
+                               $continueTitle = $db->addQuotes( $continueArr[0] );
+                               $this->addWhere( "pl_title $op= $continueTitle" );
+                       } else {
+                               if ( count( $continueArr ) != 2 ) {
+                                       $this->dieUsage( 'Invalid continue parameter', 'badcontinue' );
+                               }
+                               $continueTitle = $db->addQuotes( $continueArr[0] );
+                               $continueFrom = intval( $continueArr[1] );
+                               $this->addWhere(
+                                       "pl_title $op $continueTitle OR " .
+                                       "(pl_title = $continueTitle AND " .
+                                       "pl_from $op= $continueFrom)"
+                               );
                        }
-                       $continueTitle = $db->addQuotes( $this->titleToKey( $continueArr[0] ) );
-                       $continueFrom = intval( $continueArr[1] );
-                       $this->addWhere(
-                               "pl_title > $continueTitle OR " .
-                               "(pl_title = $continueTitle AND " .
-                               "pl_from > $continueFrom)"
-                       );
                }
 
                $from = ( is_null( $params['from'] ) ? null : $this->titlePartToKey( $params['from'] ) );
@@ -104,12 +113,13 @@ class ApiQueryAllLinks extends ApiQueryGeneratorBase {
                $limit = $params['limit'];
                $this->addOption( 'LIMIT', $limit + 1 );
 
+               $sort = ( $params['dir'] == 'descending' ? ' DESC' : '' );
+               $orderBy = array();
+               $orderBy[] = 'pl_title' . $sort;
                if ( !$params['unique'] ) {
-                       $this->addOption( 'ORDER BY', array(
-                               'pl_title',
-                               'pl_from'
-                       ));
+                       $orderBy[] = 'pl_from' . $sort;
                }
+               $this->addOption( 'ORDER BY', $orderBy );
 
                $res = $this->select( __METHOD__ );
 
@@ -119,11 +129,10 @@ class ApiQueryAllLinks extends ApiQueryGeneratorBase {
                foreach ( $res as $row ) {
                        if ( ++ $count > $limit ) {
                                // We've reached the one extra which shows that there are additional pages to be had. Stop here...
-                               // TODO: Security issue - if the user has no right to view next title, it will still be shown
                                if ( $params['unique'] ) {
-                                       $this->setContinueEnumParameter( 'from', $this->keyToTitle( $row->pl_title ) );
+                                       $this->setContinueEnumParameter( 'continue', $row->pl_title );
                                } else {
-                                       $this->setContinueEnumParameter( 'continue', $this->keyToTitle( $row->pl_title ) . "|" . $row->pl_from );
+                                       $this->setContinueEnumParameter( 'continue', $row->pl_title . "|" . $row->pl_from );
                                }
                                break;
                        }
@@ -140,9 +149,9 @@ class ApiQueryAllLinks extends ApiQueryGeneratorBase {
                                $fit = $result->addValue( array( 'query', $this->getModuleName() ), null, $vals );
                                if ( !$fit ) {
                                        if ( $params['unique'] ) {
-                                               $this->setContinueEnumParameter( 'from', $this->keyToTitle( $row->pl_title ) );
+                                               $this->setContinueEnumParameter( 'continue', $row->pl_title );
                                        } else {
-                                               $this->setContinueEnumParameter( 'continue', $this->keyToTitle( $row->pl_title ) . "|" . $row->pl_from );
+                                               $this->setContinueEnumParameter( 'continue', $row->pl_title . "|" . $row->pl_from );
                                        }
                                        break;
                                }
@@ -183,7 +192,14 @@ class ApiQueryAllLinks extends ApiQueryGeneratorBase {
                                ApiBase::PARAM_MIN => 1,
                                ApiBase::PARAM_MAX => ApiBase::LIMIT_BIG1,
                                ApiBase::PARAM_MAX2 => ApiBase::LIMIT_BIG2
-                       )
+                       ),
+                       'dir' => array(
+                               ApiBase::PARAM_DFLT => 'ascending',
+                               ApiBase::PARAM_TYPE => array(
+                                       'ascending',
+                                       'descending'
+                               )
+                       ),
                );
        }
 
@@ -202,6 +218,7 @@ class ApiQueryAllLinks extends ApiQueryGeneratorBase {
                        'namespace' => 'The namespace to enumerate',
                        'limit' => 'How many total links to return',
                        'continue' => 'When more results are available, use this to continue',
+                       'dir' => 'The direction in which to list',
                );
        }