includes/AjaxDispatcher.php

   1 <?php
   2 /**
   3  * Handle ajax requests and send them to the proper handler.
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License as published by
   7  * the Free Software Foundation; either version 2 of the License, or
   8  * (at your option) any later version.
   9  *
  10  * This program is distributed in the hope that it will be useful,
  11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  13  * GNU General Public License for more details.
  14  *
  15  * You should have received a copy of the GNU General Public License along
  16  * with this program; if not, write to the Free Software Foundation, Inc.,
  17  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  18  * http://www.gnu.org/copyleft/gpl.html
  19  *
  20  * @file
  21  * @ingroup Ajax
  22  */
  23
  24 use MediaWiki\MediaWikiServices;
  25
  26 // Use superglobals, but since it's deprecated, it's not worth fixing
  27 // phpcs:disable MediaWiki.Usage.SuperGlobalsUsage.SuperGlobals
  28
  29 /**
  30  * @defgroup Ajax Ajax
  31  */
  32
  33 /**
  34  * Object-Oriented Ajax functions.
  35  * @ingroup Ajax
  36  */
  37 class AjaxDispatcher {
  38         /**
  39          * The way the request was made, either a 'get' or a 'post'
  40          * @var string $mode
  41          */
  42         private $mode;
  43
  44         /**
  45          * Name of the requested handler
  46          * @var string $func_name
  47          */
  48         private $func_name;
  49
  50         /** Arguments passed
  51          * @var array $args
  52          */
  53         private $args;
  54
  55         /**
  56          * @var Config
  57          */
  58         private $config;
  59
  60         /**
  61          * Load up our object with user supplied data
  62          * @param Config $config
  63          */
  64         function __construct( Config $config ) {
  65                 $this->config = $config;
  66
  67                 $this->mode = "";
  68
  69                 if ( !empty( $_GET["rs"] ) ) {
  70                         $this->mode = "get";
  71                 }
  72
  73                 if ( !empty( $_POST["rs"] ) ) {
  74                         $this->mode = "post";
  75                 }
  76
  77                 switch ( $this->mode ) {
  78                         case 'get':
  79                                 $this->func_name = $_GET["rs"] ?? '';
  80                                 if ( !empty( $_GET["rsargs"] ) ) {
  81                                         $this->args = $_GET["rsargs"];
  82                                 } else {
  83                                         $this->args = [];
  84                                 }
  85                                 break;
  86                         case 'post':
  87                                 $this->func_name = $_POST["rs"] ?? '';
  88                                 if ( !empty( $_POST["rsargs"] ) ) {
  89                                         $this->args = $_POST["rsargs"];
  90                                 } else {
  91                                         $this->args = [];
  92                                 }
  93                                 break;
  94                         default:
  95                                 return;
  96                                 # Or we could throw an exception:
  97                                 # throw new MWException( __METHOD__ . ' called without any data (mode empty).' );
  98                 }
  99         }
 100
 101         /**
 102          * Pass the request to our internal function.
 103          * BEWARE! Data are passed as they have been supplied by the user,
 104          * they should be carefully handled in the function processing the
 105          * request.
 106          *
 107          * phan-taint-check triggers as it is not smart enough to understand
 108          * the early return if func_name not in AjaxExportList.
 109          * @suppress SecurityCheck-XSS
 110          * @param User $user
 111          */
 112         function performAction( User $user ) {
 113                 if ( empty( $this->mode ) ) {
 114                         return;
 115                 }
 116
 117                 $permissionManager = MediaWikiServices::getInstance()->getPermissionManager();
 118                 if ( !in_array( $this->func_name, $this->config->get( 'AjaxExportList' ) ) ) {
 119                         wfDebug( __METHOD__ . ' Bad Request for unknown function ' . $this->func_name . "\n" );
 120                         wfHttpError(
 121                                 400,
 122                                 'Bad Request',
 123                                 "unknown function " . $this->func_name
 124                         );
 125                 } elseif ( !$permissionManager->isEveryoneAllowed( 'read' ) &&
 126                                    !$permissionManager->userHasRight( $user, 'read' ) ) {
 127                         wfHttpError(
 128                                 403,
 129                                 'Forbidden',
 130                                 'You are not allowed to view pages.' );
 131                 } else {
 132                         wfDebug( __METHOD__ . ' dispatching ' . $this->func_name . "\n" );
 133                         try {
 134                                 $result = call_user_func_array( $this->func_name, $this->args );
 135
 136                                 if ( $result === false || $result === null ) {
 137                                         wfDebug( __METHOD__ . ' ERROR while dispatching ' .
 138                                                 $this->func_name . "(" . var_export( $this->args, true ) . "): " .
 139                                                 "no data returned\n" );
 140
 141                                         wfHttpError( 500, 'Internal Error',
 142                                                 "{$this->func_name} returned no data" );
 143                                 } else {
 144                                         if ( is_string( $result ) ) {
 145                                                 $result = new AjaxResponse( $result );
 146                                         }
 147
 148                                         // Make sure DB commit succeeds before sending a response
 149                                         $lbFactory = MediaWikiServices::getInstance()->getDBLoadBalancerFactory();
 150                                         $lbFactory->commitMasterChanges( __METHOD__ );
 151
 152                                         $result->sendHeaders();
 153                                         $result->printText();
 154
 155                                         wfDebug( __METHOD__ . ' dispatch complete for ' . $this->func_name . "\n" );
 156                                 }
 157                         } catch ( Exception $e ) {
 158                                 wfDebug( __METHOD__ . ' ERROR while dispatching ' .
 159                                         $this->func_name . "(" . var_export( $this->args, true ) . "): " .
 160                                         get_class( $e ) . ": " . $e->getMessage() . "\n" );
 161
 162                                 if ( !headers_sent() ) {
 163                                         wfHttpError( 500, 'Internal Error',
 164                                                 $e->getMessage() );
 165                                 } else {
 166                                         print $e->getMessage();
 167                                 }
 168                         }
 169                 }
 170         }
 171 }