ApiUpload: Raise an error on attempts to async-upload a POSTed file

"Upload from stash" and "Upload from POST" use the same code path via
ApiUpload::performUpload(). It looks like when a31d0f8edd implemented
"async upload from stash", it was overlooked that someone might attempt
to do an unsupported "async upload from POST".

Bug: T156365
Change-Id: I6d207270af490cfc59d994a22a6406df45a9f6a2

diff --git a/includes/api/ApiUpload.php b/includes/api/ApiUpload.php
index 6b38302..af3fff6 100644 (file)
--- a/includes/api/ApiUpload.php
+++ b/includes/api/ApiUpload.php
@@ -494,6 +494,13 @@ class ApiUpload extends ApiBase {
                                $this->mParams['filekey'], $this->mParams['filename'], !$this->mParams['async']
                        );
                } elseif ( isset( $this->mParams['file'] ) ) {
+                       // Can't async upload directly from a POSTed file, we'd have to
+                       // stash the file and then queue the publish job. The user should
+                       // just submit the two API queries to perform those two steps.
+                       if ( $this->mParams['async'] ) {
+                               $this->dieWithError( 'apierror-cannot-async-upload-file' );
+                       }
+
                        $this->mUpload = new UploadFromFile();
                        $this->mUpload->initialize(
                                $this->mParams['filename'],

diff --git a/includes/api/i18n/en.json b/includes/api/i18n/en.json
index c1fefd6..c7fea8b 100644 (file)
--- a/includes/api/i18n/en.json
+++ b/includes/api/i18n/en.json
@@ -1594,6 +1594,7 @@
        "apierror-blockedfrommail": "You have been blocked from sending email.",
        "apierror-blocked": "You have been blocked from editing.",
        "apierror-botsnotsupported": "This interface is not supported for bots.",
+       "apierror-cannot-async-upload-file": "The parameters <var>async</var> and <var>file</var> cannot be combined. If you want asynchronous processing of your uploaded file, first upload it to stash (using the <var>stash</var> parameter) and then publish the stashed file asynchronously (using <var>filekey</var> and <var>async</var>).",
        "apierror-cannotreauthenticate": "This action is not available as your identity cannot be verified.",
        "apierror-cannotviewtitle": "You are not allowed to view $1.",
        "apierror-cantblock-email": "You don't have permission to block users from sending email through the wiki.",

diff --git a/includes/api/i18n/qqq.json b/includes/api/i18n/qqq.json
index ef2ba8f..e6ee8d4 100644 (file)
--- a/includes/api/i18n/qqq.json
+++ b/includes/api/i18n/qqq.json
@@ -1486,6 +1486,7 @@
        "apierror-blockedfrommail": "{{doc-apierror}}",
        "apierror-blocked": "{{doc-apierror}}",
        "apierror-botsnotsupported": "{{doc-apierror}}",
+       "apierror-cannot-async-upload-file": "{{doc-apierror}}",
        "apierror-cannotreauthenticate": "{{doc-apierror}}",
        "apierror-cannotviewtitle": "{{doc-apierror}}\n\nParameters:\n* $1 - Title.",
        "apierror-cantblock-email": "{{doc-apierror}}",