CSP: Allow an option of disabling nonces

[lhc/web/wiklou.git] / includes / OutputPage.php

diff --git a/includes/OutputPage.php b/includes/OutputPage.php
index f92f4f3..948e1eb 100644 (file)
--- a/includes/OutputPage.php
+++ b/includes/OutputPage.php
@@ -24,6 +24,7 @@ use MediaWiki\Linker\LinkTarget;
 use MediaWiki\Logger\LoggerFactory;
 use MediaWiki\MediaWikiServices;
 use MediaWiki\Session\SessionManager;
+use Wikimedia\Rdbms\IResultWrapper;
 use Wikimedia\RelPath;
 use Wikimedia\WrappedString;
 use Wikimedia\WrappedStringList;
@@ -468,7 +469,7 @@ class OutputPage extends ContextSource {
         * Internal use only. Use OutputPage::addModules() if possible.
         *
         * @param string $file URL to file (absolute path, protocol-relative, or full url)
-        * @param string $unused Previously used to change the cache-busting query parameter
+        * @param string|null $unused Previously used to change the cache-busting query parameter
         */
        public function addScriptFile( $file, $unused = null ) {
                if ( substr( $file, 0, 1 ) !== '/' && !preg_match( '#^[a-z]*://#i', $file ) ) {
@@ -755,11 +756,7 @@ class OutputPage extends ContextSource {
         * @return mixed Property value or null if not found
         */
        public function getProperty( $name ) {
-               if ( isset( $this->mProperties[$name] ) ) {
-                       return $this->mProperties[$name];
-               } else {
-                       return null;
-               }
+               return $this->mProperties[$name] ?? null;
        }
 
        /**
@@ -1341,7 +1338,7 @@ class OutputPage extends ContextSource {
 
        /**
         * @param array $categories
-        * @return bool|ResultWrapper
+        * @return bool|IResultWrapper
         */
        protected function addCategoryLinksToLBAndGetResult( array $categories ) {
                # Add the links to a LinkBatch
@@ -1368,7 +1365,8 @@ class OutputPage extends ContextSource {
                );
 
                # Add the results to the link cache
-               $lb->addResultToCache( LinkCache::singleton(), $res );
+               $linkCache = MediaWikiServices::getInstance()->getLinkCache();
+               $lb->addResultToCache( $linkCache, $res );
 
                return $res;
        }
@@ -1931,7 +1929,7 @@ class OutputPage extends ContextSource {
         * @param bool $interface Use interface language ($wgLang instead of
         *   $wgContLang) while parsing language sensitive magic words like GRAMMAR and PLURAL.
         *   This also disables LanguageConverter.
-        * @param Language $language Target language object, will override $interface
+        * @param Language|null $language Target language object, will override $interface
         * @throws MWException
         * @return string HTML
         */
@@ -2535,7 +2533,7 @@ class OutputPage extends ContextSource {
         * Output a standard permission error page
         *
         * @param array $errors Error message keys or [key, param...] arrays
-        * @param string $action Action that was denied or null if unknown
+        * @param string|null $action Action that was denied or null if unknown
         */
        public function showPermissionsErrorPage( array $errors, $action = null ) {
                foreach ( $errors as $key => $error ) {
@@ -2625,7 +2623,7 @@ class OutputPage extends ContextSource {
         * Format a list of error messages
         *
         * @param array $errors Array of arrays returned by Title::getUserPermissionsErrors
-        * @param string $action Action that was denied or null if unknown
+        * @param string|null $action Action that was denied or null if unknown
         * @return string The wikitext error-messages, formatted into a list.
         */
        public function formatPermissionsErrorMessage( array $errors, $action = null ) {
@@ -2710,7 +2708,7 @@ class OutputPage extends ContextSource {
         *
         * @param Title $title Title to link
         * @param array $query Query string parameters
-        * @param string $text Text of the link (input is not escaped)
+        * @param string|null $text Text of the link (input is not escaped)
         * @param array $options Options array to pass to Linker
         */
        public function addReturnTo( $title, array $query = [], $text = null, $options = [] ) {
@@ -2725,9 +2723,9 @@ class OutputPage extends ContextSource {
         * Add a "return to" link pointing to a specified title,
         * or the title indicated in the request, or else the main page
         *
-        * @param mixed $unused
-        * @param Title|string $returnto Title or String to return to
-        * @param string $returntoquery Query string for the return to link
+        * @param mixed|null $unused
+        * @param Title|string|null $returnto Title or String to return to
+        * @param string|null $returntoquery Query string for the return to link
         */
        public function returnToMain( $unused = null, $returnto = null, $returntoquery = null ) {
                if ( $returnto == null ) {
@@ -3057,7 +3055,7 @@ class OutputPage extends ContextSource {
         * Add one or more variables to be set in mw.config in JavaScript
         *
         * @param string|array $keys Key or array of key/value pairs
-        * @param mixed $value [optional] Value of the configuration variable
+        * @param mixed|null $value [optional] Value of the configuration variable
         */
        public function addJsConfigVars( $keys, $value = null ) {
                if ( is_array( $keys ) ) {
@@ -3111,13 +3109,13 @@ class OutputPage extends ContextSource {
 
                // Pre-process information
                $separatorTransTable = $lang->separatorTransformTable();
-               $separatorTransTable = $separatorTransTable ? $separatorTransTable : [];
+               $separatorTransTable = $separatorTransTable ?: [];
                $compactSeparatorTransTable = [
                        implode( "\t", array_keys( $separatorTransTable ) ),
                        implode( "\t", $separatorTransTable ),
                ];
                $digitTransTable = $lang->digitTransformTable();
-               $digitTransTable = $digitTransTable ? $digitTransTable : [];
+               $digitTransTable = $digitTransTable ?: [];
                $compactDigitTransTable = [
                        implode( "\t", array_keys( $digitTransTable ) ),
                        implode( "\t", $digitTransTable ),
@@ -4013,13 +4011,13 @@ class OutputPage extends ContextSource {
         * @since 1.32
         */
        public function getCSPNonce() {
-               if ( !ContentSecurityPolicy::isEnabled( $this->getConfig() ) ) {
+               if ( !ContentSecurityPolicy::isNonceRequired( $this->getConfig() ) ) {
                        return false;
                }
                if ( $this->CSPNonce === null ) {
                        // XXX It might be expensive to generate randomness
-                       // on every request, on windows.
-                       $rand = MWCryptRand::generate( 15 );
+                       // on every request, on Windows.
+                       $rand = random_bytes( 15 );
                        $this->CSPNonce = base64_encode( $rand );
                }
                return $this->CSPNonce;