SECURITY: API: Avoid some silliness with browser-guessed filenames

[lhc/web/wiklou.git] / api.php

diff --git a/api.php b/api.php
index af7c452..d9a69db 100644 (file)
--- a/api.php
+++ b/api.php
@@ -35,11 +35,6 @@ use MediaWiki\Logger\LegacyLogger;
 // So extensions (and other code) can check whether they're running in API mode
 define( 'MW_API', true );
 
-// Bail on old versions of PHP, or if composer has not been run yet to install
-// dependencies. Using dirname( __FILE__ ) here because __DIR__ is PHP5.3+.
-require_once dirname( __FILE__ ) . '/includes/PHPVersionCheck.php';
-wfEntryPointCheck( 'api.php' );
-
 require __DIR__ . '/includes/WebStart.php';
 
 $starttime = microtime( true );
@@ -49,6 +44,17 @@ if ( !$wgRequest->checkUrlExtension() ) {
        return;
 }
 
+// Pathinfo can be used for stupid things. We don't support it for api.php at
+// all, so error out if it's present.
+if ( isset( $_SERVER['PATH_INFO'] ) && $_SERVER['PATH_INFO'] != '' ) {
+       $correctUrl = wfAppendQuery( wfScript( 'api' ), $wgRequest->getQueryValues() );
+       $correctUrl = wfExpandUrl( $correctUrl, PROTO_CANONICAL );
+       header( "Location: $correctUrl", true, 301 );
+       echo 'This endpoint does not support "path info", i.e. extra text between "api.php"'
+               . 'and the "?". Remove any such text and try again.';
+       die( 1 );
+}
+
 // Verify that the API has not been disabled
 if ( !$wgEnableAPI ) {
        header( $_SERVER['SERVER_PROTOCOL'] . ' 500 MediaWiki configuration Error', true, 500 );
@@ -68,12 +74,12 @@ RequestContext::getMain()->setTitle( $wgTitle );
 try {
        /* Construct an ApiMain with the arguments passed via the URL. What we get back
         * is some form of an ApiMain, possibly even one that produces an error message,
-        * but we don't care here, as that is handled by the ctor.
+        * but we don't care here, as that is handled by the constructor.
         */
        $processor = new ApiMain( RequestContext::getMain(), $wgEnableWriteAPI );
 
        // Last chance hook before executing the API
-       Hooks::run( 'ApiBeforeMain', array( &$processor ) );
+       Hooks::run( 'ApiBeforeMain', [ &$processor ] );
        if ( !$processor instanceof ApiMain ) {
                throw new MWException( 'ApiBeforeMain hook set $processor to a non-ApiMain class' );
        }
@@ -93,12 +99,12 @@ $endtime = microtime( true );
 
 // Log the request
 if ( $wgAPIRequestLog ) {
-       $items = array(
+       $items = [
                wfTimestamp( TS_MW ),
                $endtime - $starttime,
                $wgRequest->getIP(),
                $wgRequest->getHeader( 'User-agent' )
-       );
+       ];
        $items[] = $wgRequest->wasPosted() ? 'POST' : 'GET';
        if ( $processor ) {
                try {