X-Git-Url: https://git.heureux-cyclage.org/?a=blobdiff_plain;f=includes%2FWebRequest.php;h=39c1b1ba3cd2e76f73aa7aca7b8bd4461e8f9a84;hb=d0d2c9bb492b7a99ea89ea4413468360c5f2637c;hp=a7e4c7c48be4a60a477c27f8120002abc57a06aa;hpb=d9c41a68190135e961bd5795f4a04d4486521231;p=lhc%2Fweb%2Fwiklou.git diff --git a/includes/WebRequest.php b/includes/WebRequest.php index a7e4c7c48b..39c1b1ba3c 100644 --- a/includes/WebRequest.php +++ b/includes/WebRequest.php @@ -44,6 +44,12 @@ class WebRequest { */ private $response; + /** + * Cached client IP address + * @var String + */ + private $ip; + public function __construct() { /// @todo FIXME: This preemptive de-quoting can interfere with other web libraries /// and increases our memory footprint. It would be cleaner to do on @@ -56,17 +62,22 @@ class WebRequest { } /** - * Extract the PATH_INFO variable even when it isn't a reasonable - * value. On some large webhosts, PATH_INFO includes the script - * path as well as everything after it. + * Extract relevant query arguments from the http request uri's path + * to be merged with the normal php provided query arguments. + * Tries to use the REQUEST_URI data if available and parses it + * according to the wiki's configuration looking for any known pattern. + * + * If the REQUEST_URI is not provided we'll fall back on the PATH_INFO + * provided by the server if any and use that to set a 'title' parameter. * * @param $want string: If this is not 'all', then the function * will return an empty array if it determines that the URL is * inside a rewrite path. * - * @return Array: 'title' key is the title of the article. + * @return Array: Any query arguments found in path matches. */ static public function getPathInfo( $want = 'all' ) { + global $wgUsePathInfo; // PATH_INFO is mangled due to http://bugs.php.net/bug.php?id=31892 // And also by Apache 2.x, double slashes are converted to single slashes. // So we will use REQUEST_URI if possible. @@ -87,43 +98,109 @@ class WebRequest { // Abort to keep from breaking... return $matches; } + + $router = new PathRouter; + // Raw PATH_INFO style - $matches = self::extractTitle( $path, "$wgScript/$1" ); + $router->add( "$wgScript/$1" ); + + if( isset( $_SERVER['SCRIPT_NAME'] ) + && preg_match( '/\.php5?/', $_SERVER['SCRIPT_NAME'] ) ) + { + # Check for SCRIPT_NAME, we handle index.php explicitly + # But we do have some other .php files such as img_auth.php + # Don't let root article paths clober the parsing for them + $router->add( $_SERVER['SCRIPT_NAME'] . "/$1" ); + } global $wgArticlePath; - if( !$matches && $wgArticlePath ) { - $matches = self::extractTitle( $path, $wgArticlePath ); + if( $wgArticlePath ) { + $router->add( $wgArticlePath ); } global $wgActionPaths; - if( !$matches && $wgActionPaths ) { - $matches = self::extractTitle( $path, $wgActionPaths, 'action' ); + if( $wgActionPaths ) { + $router->add( $wgActionPaths, array( 'action' => '$key' ) ); } global $wgVariantArticlePath, $wgContLang; - if( !$matches && $wgVariantArticlePath ) { - $variantPaths = array(); - foreach( $wgContLang->getVariants() as $variant ) { - $variantPaths[$variant] = - str_replace( '$2', $variant, $wgVariantArticlePath ); - } - $matches = self::extractTitle( $path, $variantPaths, 'variant' ); + if( $wgVariantArticlePath ) { + $router->add( $wgVariantArticlePath, + array( 'variant' => '$2'), + array( '$2' => $wgContLang->getVariants() ) + ); } + + wfRunHooks( 'WebRequestPathInfoRouter', array( $router ) ); + + $matches = $router->parse( $path ); + } + } elseif ( $wgUsePathInfo ) { + if ( isset( $_SERVER['ORIG_PATH_INFO'] ) && $_SERVER['ORIG_PATH_INFO'] != '' ) { + // Mangled PATH_INFO + // http://bugs.php.net/bug.php?id=31892 + // Also reported when ini_get('cgi.fix_pathinfo')==false + $matches['title'] = substr( $_SERVER['ORIG_PATH_INFO'], 1 ); + + } elseif ( isset( $_SERVER['PATH_INFO'] ) && ($_SERVER['PATH_INFO'] != '') ) { + // Regular old PATH_INFO yay + $matches['title'] = substr( $_SERVER['PATH_INFO'], 1 ); } - } elseif ( isset( $_SERVER['ORIG_PATH_INFO'] ) && $_SERVER['ORIG_PATH_INFO'] != '' ) { - // Mangled PATH_INFO - // http://bugs.php.net/bug.php?id=31892 - // Also reported when ini_get('cgi.fix_pathinfo')==false - $matches['title'] = substr( $_SERVER['ORIG_PATH_INFO'], 1 ); - - } elseif ( isset( $_SERVER['PATH_INFO'] ) && ($_SERVER['PATH_INFO'] != '') ) { - // Regular old PATH_INFO yay - $matches['title'] = substr( $_SERVER['PATH_INFO'], 1 ); } return $matches; } + /** + * Work out an appropriate URL prefix containing scheme and host, based on + * information detected from $_SERVER + * + * @return string + */ + public static function detectServer() { + list( $proto, $stdPort ) = self::detectProtocolAndStdPort(); + + $varNames = array( 'HTTP_HOST', 'SERVER_NAME', 'HOSTNAME', 'SERVER_ADDR' ); + $host = 'localhost'; + $port = $stdPort; + foreach ( $varNames as $varName ) { + if ( !isset( $_SERVER[$varName] ) ) { + continue; + } + $parts = IP::splitHostAndPort( $_SERVER[$varName] ); + if ( !$parts ) { + // Invalid, do not use + continue; + } + $host = $parts[0]; + if ( $parts[1] === false ) { + if ( isset( $_SERVER['SERVER_PORT'] ) ) { + $port = $_SERVER['SERVER_PORT']; + } // else leave it as $stdPort + } else { + $port = $parts[1]; + } + break; + } + + return $proto . '://' . IP::combineHostAndPort( $host, $port, $stdPort ); + } + + /** + * @return array + */ + public static function detectProtocolAndStdPort() { + return ( isset( $_SERVER['HTTPS'] ) && $_SERVER['HTTPS'] == 'on' ) ? array( 'https', 443 ) : array( 'http', 80 ); + } + + /** + * @return string + */ + public static function detectProtocol() { + list( $proto, $stdPort ) = self::detectProtocolAndStdPort(); + return $proto; + } + /** * Check for title, action, and/or variant data in the URL * and interpolate it into the GET variables. @@ -132,23 +209,19 @@ class WebRequest { * available variant URLs. */ public function interpolateTitle() { - global $wgUsePathInfo; - // bug 16019: title interpolation on API queries is useless and sometimes harmful if ( defined( 'MW_API' ) ) { return; } - if ( $wgUsePathInfo ) { - $matches = self::getPathInfo( 'title' ); - foreach( $matches as $key => $val) { - $this->data[$key] = $_GET[$key] = $_REQUEST[$key] = $val; - } + $matches = self::getPathInfo( 'title' ); + foreach( $matches as $key => $val) { + $this->data[$key] = $_GET[$key] = $_REQUEST[$key] = $val; } } /** - * Internal URL rewriting function; tries to extract page title and, + * URL rewriting function; tries to extract page title and, * optionally, one other fixed parameter value from a URL path. * * @param $path string: the URL path given from the client @@ -157,7 +230,7 @@ class WebRequest { * passed on as the value of this URL parameter * @return array of URL variables to interpolate; empty if no match */ - private static function extractTitle( $path, $bases, $key=false ) { + static function extractTitle( $path, $bases, $key = false ) { foreach( (array)$bases as $keyValue => $base ) { // Find the part after $wgArticlePath $base = str_replace( '$1', '', $base ); @@ -181,16 +254,24 @@ class WebRequest { * used for undoing the evil that is magic_quotes_gpc. * * @param $arr array: will be modified + * @param $topLevel bool Specifies if the array passed is from the top + * level of the source. In PHP5 magic_quotes only escapes the first level + * of keys that belong to an array. * @return array the original array + * @see http://www.php.net/manual/en/function.get-magic-quotes-gpc.php#49612 */ - private function &fix_magic_quotes( &$arr ) { + private function &fix_magic_quotes( &$arr, $topLevel = true ) { + $clean = array(); foreach( $arr as $key => $val ) { if( is_array( $val ) ) { - $this->fix_magic_quotes( $arr[$key] ); + $cleanKey = $topLevel ? stripslashes( $key ) : $key; + $clean[$cleanKey] = $this->fix_magic_quotes( $arr[$key], false ); } else { - $arr[$key] = stripslashes( $val ); + $cleanKey = stripslashes( $key ); + $clean[$cleanKey] = stripslashes( $val ); } } + $arr = $clean; return $arr; } @@ -216,8 +297,8 @@ class WebRequest { /** * Recursively normalizes UTF-8 strings in the given array. * - * @param $data string or array - * @return cleaned-up version of the given + * @param $data string|array + * @return array|string cleaned-up version of the given * @private */ function normalizeUnicode( $data ) { @@ -297,6 +378,23 @@ class WebRequest { return $ret; } + + /** + * Unset an arbitrary value from our get/post data. + * + * @param $key String: key name to use + * @return Mixed: old value if one was present, null otherwise + */ + public function unsetVal( $key ) { + if ( !isset( $this->data[$key] ) ) { + $ret = null; + } else { + $ret = $this->data[$key]; + unset( $this->data[$key] ); + } + return $ret; + } + /** * Fetch an array from the input or return $default if it's not set. * If source was scalar, will return an array with a single element. @@ -425,6 +523,8 @@ class WebRequest { * Extracts the given named values into an array. * If no arguments are given, returns all input values. * No transformation is performed on the values. + * + * @return array */ public function getValues() { $names = func_get_args(); @@ -434,7 +534,7 @@ class WebRequest { $retVal = array(); foreach ( $names as $name ) { - $value = $this->getVal( $name ); + $value = $this->getGPCVal( $this->data, $name, null ); if ( !is_null( $value ) ) { $retVal[$name] = $value; } @@ -442,6 +542,16 @@ class WebRequest { return $retVal; } + /** + * Returns the names of all input values excluding those in $exclude. + * + * @param $exclude Array + * @return array + */ + public function getValueNames( $exclude = array() ) { + return array_diff( array_keys( $this->getValues() ), $exclude ); + } + /** * Get the values passed in the query string. * No transformation is performed on the values. @@ -449,7 +559,7 @@ class WebRequest { * @return Array */ public function getQueryValues() { - return $_GET; + return $_GET; } /** @@ -462,7 +572,7 @@ class WebRequest { * @return Boolean */ public function wasPosted() { - return $_SERVER['REQUEST_METHOD'] == 'POST'; + return isset( $_SERVER['REQUEST_METHOD'] ) && $_SERVER['REQUEST_METHOD'] == 'POST'; } /** @@ -497,7 +607,8 @@ class WebRequest { } /** - * Return the path portion of the request URI. + * Return the path and query string portion of the request URI. + * This will be suitable for use as a relative link in HTML output. * * @return String */ @@ -535,13 +646,17 @@ class WebRequest { } /** - * Return the request URI with the canonical service and hostname. + * Return the request URI with the canonical service and hostname, path, + * and query string. This will be suitable for use as an absolute link + * in HTML or other output. + * + * If $wgServer is protocol-relative, this will return a fully + * qualified URL with the protocol that was used for this request. * * @return String */ public function getFullRequestURL() { - global $wgServer; - return $wgServer . $this->getRequestURL(); + return wfExpandUrl( $this->getRequestURL(), PROTO_CURRENT ); } /** @@ -556,6 +671,7 @@ class WebRequest { /** * HTML-safe version of appendQuery(). + * @deprecated: Deprecated in 1.20, warnings in 1.21, remove in 1.22. * * @param $query String: query string fragment; do not include initial '?' * @return String @@ -564,6 +680,12 @@ class WebRequest { return htmlspecialchars( $this->appendQuery( $query ) ); } + /** + * @param $key + * @param $value + * @param $onlyquery bool + * @return String + */ public function appendQueryValue( $key, $value, $onlyquery = false ) { return $this->appendQueryArray( array( $key => $value ), $onlyquery ); } @@ -638,6 +760,7 @@ class WebRequest { * @return integer */ public function getFileSize( $key ) { + wfDeprecated( __METHOD__, '1.17' ); $file = new WebRequestUpload( $this, $key ); return $file->getSize(); } @@ -672,7 +795,7 @@ class WebRequest { /** * Return a WebRequestUpload object corresponding to the key * - * @param @key string + * @param $key string * @return WebRequestUpload */ public function getUpload( $key ) { @@ -707,7 +830,6 @@ class WebRequest { $this->headers[ strtoupper( $tempName ) ] = $tempValue; } } else { - $headers = $_SERVER; foreach ( $_SERVER as $name => $value ) { if ( substr( $name, 0, 5 ) === 'HTTP_' ) { $name = str_replace( '_', '-', substr( $name, 5 ) ); @@ -732,6 +854,8 @@ class WebRequest { /** * Get a request header, or false if it isn't set * @param $name String: case-insensitive header name + * + * @return string|bool False on failure */ public function getHeader( $name ) { $this->initHeaders(); @@ -767,10 +891,13 @@ class WebRequest { } /** - * Check if Internet Explorer will detect an incorrect cache extension in + * Check if Internet Explorer will detect an incorrect cache extension in * PATH_INFO or QUERY_STRING. If the request can't be allowed, show an error * message or redirect to a safer URL. Returns true if the URL is OK, and * false if an error message has been shown and the request should be aborted. + * + * @param $extWhitelist array + * @return bool */ public function checkUrlExtension( $extWhitelist = array() ) { global $wgScriptExtension; @@ -784,17 +911,18 @@ class WebRequest { return false; } } - wfHttpError( 403, 'Forbidden', + throw new HttpError( 403, 'Invalid file extension found in the path info or query string.' ); - - return false; } return true; } /** - * Attempt to redirect to a URL with a QUERY_STRING that's not dangerous in + * Attempt to redirect to a URL with a QUERY_STRING that's not dangerous in * IE 6. Returns true if it was successful, false otherwise. + * + * @param $url string + * @return bool */ protected function doSecurityRedirect( $url ) { header( 'Location: ' . $url ); @@ -808,11 +936,11 @@ class WebRequest {

Security redirect

-We can't serve non-HTML content from the URL you have requested, because +We can't serve non-HTML content from the URL you have requested, because Internet Explorer would interpret it as an incorrect and potentially dangerous content type.

-

Instead, please use this URL, which is the same as the URL you have requested, except that -"&*" is appended. This prevents Internet Explorer from seeing a bogus file +

Instead, please use this URL, which is the same as the URL you have requested, except that +"&*" is appended. This prevents Internet Explorer from seeing a bogus file extension.

@@ -838,9 +966,14 @@ HTML; * QUERY_STRING, since IE 6 and earlier will use this to get the file type * if there was no dot before the question mark (bug 28235). * - * @deprecated Use checkUrlExtension(). + * @deprecated Use checkUrlExtension(). + * + * @param $extWhitelist array + * + * @return bool */ public function isPathInfoBad( $extWhitelist = array() ) { + wfDeprecated( __METHOD__, '1.17' ); global $wgScriptExtension; $extWhitelist[] = ltrim( $wgScriptExtension, '.' ); return IEUrlExtension::areServerVarsBad( $_SERVER, $extWhitelist ); @@ -848,7 +981,7 @@ HTML; /** * Parse the Accept-Language header sent by the client into an array - * @return array( languageCode => q-value ) sorted by q-value in descending order + * @return array array( languageCode => q-value ) sorted by q-value in descending order * May contain the "language" '*', which applies to languages other than those explicitly listed. * This is aligned with rfc2616 section 14.4 */ @@ -864,7 +997,7 @@ HTML; // Break up string into pieces (languages and q factors) $lang_parse = null; - preg_match_all( '/([a-z]{1,8}(-[a-z]{1,8})?|\*)\s*(;\s*q\s*=\s*(1|0(\.[0-9]+)?)?)?/', + preg_match_all( '/([a-z]{1,8}(-[a-z]{1,8})*|\*)\s*(;\s*q\s*=\s*(1(\.0{0,3})?|0(\.[0-9]{0,3})?)?)?/', $acceptLang, $lang_parse ); if ( !count( $lang_parse[1] ) ) { @@ -877,7 +1010,7 @@ HTML; foreach ( $langs as $lang => $val ) { if ( $val === '' ) { $langs[$lang] = 1; - } else if ( $val == 0 ) { + } elseif ( $val == 0 ) { unset($langs[$lang]); } } @@ -886,6 +1019,77 @@ HTML; arsort( $langs, SORT_NUMERIC ); return $langs; } + + /** + * Fetch the raw IP from the request + * + * @since 1.19 + * + * @return String + */ + protected function getRawIP() { + if ( isset( $_SERVER['REMOTE_ADDR'] ) ) { + return IP::canonicalize( $_SERVER['REMOTE_ADDR'] ); + } else { + return null; + } + } + + /** + * Work out the IP address based on various globals + * For trusted proxies, use the XFF client IP (first of the chain) + * + * @since 1.19 + * + * @return string + */ + public function getIP() { + global $wgUsePrivateIPs; + + # Return cached result + if ( $this->ip !== null ) { + return $this->ip; + } + + # collect the originating ips + $ip = $this->getRawIP(); + + # Append XFF + $forwardedFor = $this->getHeader( 'X-Forwarded-For' ); + if ( $forwardedFor !== false ) { + $ipchain = array_map( 'trim', explode( ',', $forwardedFor ) ); + $ipchain = array_reverse( $ipchain ); + if ( $ip ) { + array_unshift( $ipchain, $ip ); + } + + # Step through XFF list and find the last address in the list which is a trusted server + # Set $ip to the IP address given by that trusted server, unless the address is not sensible (e.g. private) + foreach ( $ipchain as $i => $curIP ) { + $curIP = IP::canonicalize( $curIP ); + if ( wfIsTrustedProxy( $curIP ) ) { + if ( isset( $ipchain[$i + 1] ) ) { + if ( $wgUsePrivateIPs || IP::isPublic( $ipchain[$i + 1 ] ) ) { + $ip = $ipchain[$i + 1]; + } + } + } else { + break; + } + } + } + + # Allow extensions to improve our guess + wfRunHooks( 'GetIP', array( &$ip ) ); + + if ( !$ip ) { + throw new MWException( "Unable to determine IP" ); + } + + wfDebug( "IP: $ip\n" ); + $this->ip = $ip; + return $ip; + } } /** @@ -1017,7 +1221,7 @@ class FauxRequest extends WebRequest { * @param $wasPosted Bool: whether to treat the data as POST * @param $session Mixed: session array or null */ - public function __construct( $data, $wasPosted = false, $session = null ) { + public function __construct( $data = array(), $wasPosted = false, $session = null ) { if( is_array( $data ) ) { $this->data = $data; } else { @@ -1028,19 +1232,34 @@ class FauxRequest extends WebRequest { $this->session = $session; } + /** + * @param $method string + * @throws MWException + */ private function notImplemented( $method ) { throw new MWException( "{$method}() not implemented" ); } + /** + * @param $name string + * @param $default string + * @return string + */ public function getText( $name, $default = '' ) { # Override; don't recode since we're using internal data return (string)$this->getVal( $name, $default ); } + /** + * @return Array + */ public function getValues() { return $this->data; } + /** + * @return array + */ public function getQueryValues() { if ( $this->wasPosted ) { return array(); @@ -1049,6 +1268,9 @@ class FauxRequest extends WebRequest { } } + /** + * @return bool + */ public function wasPosted() { return $this->wasPosted; } @@ -1061,32 +1283,115 @@ class FauxRequest extends WebRequest { $this->notImplemented( __METHOD__ ); } + /** + * @param $name + * @return bool|string + */ public function getHeader( $name ) { return isset( $this->headers[$name] ) ? $this->headers[$name] : false; } + /** + * @param $name string + * @param $val string + */ public function setHeader( $name, $val ) { $this->headers[$name] = $val; } + /** + * @param $key + * @return mixed + */ public function getSessionData( $key ) { if( isset( $this->session[$key] ) ) return $this->session[$key]; } + /** + * @param $key + * @param $data + */ public function setSessionData( $key, $data ) { $this->session[$key] = $data; } + /** + * @return array|Mixed|null + */ public function getSessionArray() { return $this->session; } + /** + * @param array $extWhitelist + * @return bool + */ public function isPathInfoBad( $extWhitelist = array() ) { return false; } + /** + * @param array $extWhitelist + * @return bool + */ public function checkUrlExtension( $extWhitelist = array() ) { return true; } + + /** + * @return string + */ + protected function getRawIP() { + return '127.0.0.1'; + } +} + +/** + * Similar to FauxRequest, but only fakes URL parameters and method + * (POST or GET) and use the base request for the remaining stuff + * (cookies, session and headers). + * + * @ingroup HTTP + * @since 1.19 + */ +class DerivativeRequest extends FauxRequest { + private $base; + + public function __construct( WebRequest $base, $data, $wasPosted = false ) { + $this->base = $base; + parent::__construct( $data, $wasPosted ); + } + + public function getCookie( $key, $prefix = null, $default = null ) { + return $this->base->getCookie( $key, $prefix, $default ); + } + + public function checkSessionCookie() { + return $this->base->checkSessionCookie(); + } + + public function getHeader( $name ) { + return $this->base->getHeader( $name ); + } + + public function getAllHeaders() { + return $this->base->getAllHeaders(); + } + + public function getSessionData( $key ) { + return $this->base->getSessionData( $key ); + } + + public function setSessionData( $key, $data ) { + $this->base->setSessionData( $key, $data ); + } + + public function getAcceptLang() { + return $this->base->getAcceptLang(); + } + + public function getIP() { + return $this->base->getIP(); + } }