SECURITY: Disallow loading JS/CSS/Json subpages from unregistered users and log

[lhc/web/wiklou.git] / includes / ServiceWiring.php

diff --git a/includes/ServiceWiring.php b/includes/ServiceWiring.php
index dab9fb9..f97d60d 100644 (file)
--- a/includes/ServiceWiring.php
+++ b/includes/ServiceWiring.php
@@ -45,6 +45,7 @@ use MediaWiki\MediaWikiServices;
 use MediaWiki\Preferences\DefaultPreferencesFactory;
 use MediaWiki\Shell\CommandFactory;
 use MediaWiki\Storage\BlobStoreFactory;
+use MediaWiki\Storage\NameTableStore;
 use MediaWiki\Storage\RevisionStore;
 use MediaWiki\Storage\SqlBlobStore;
 use Wikimedia\ObjectFactory;
@@ -60,7 +61,10 @@ return [
                );
                $class = MWLBFactory::getLBFactoryClass( $lbConf );
 
-               return new $class( $lbConf );
+               $instance = new $class( $lbConf );
+               MWLBFactory::setSchemaAliases( $instance, $mainConfig );
+
+               return $instance;
        },
 
        'DBLoadBalancer' => function ( MediaWikiServices $services ) {
@@ -179,7 +183,8 @@ return [
        'WatchedItemQueryService' => function ( MediaWikiServices $services ) {
                return new WatchedItemQueryService(
                        $services->getDBLoadBalancer(),
-                       $services->getCommentStore()
+                       $services->getCommentStore(),
+                       $services->getActorMigration()
                );
        },
 
@@ -281,8 +286,14 @@ return [
 
                $detectorCmd = $mainConfig->get( 'MimeDetectorCommand' );
                if ( $detectorCmd ) {
-                       $params['detectCallback'] = function ( $file ) use ( $detectorCmd ) {
-                               return wfShellExec( "$detectorCmd " . wfEscapeShellArg( $file ) );
+                       $factory = $services->getShellCommandFactory();
+                       $params['detectCallback'] = function ( $file ) use ( $detectorCmd, $factory ) {
+                               $result = $factory->create()
+                                       // $wgMimeDetectorCommand can contain commands with parameters
+                                       ->unsafeParams( $detectorCmd )
+                                       ->params( $file )
+                                       ->execute();
+                               return $result->getStdout();
                        };
                }
 
@@ -500,7 +511,8 @@ return [
                        $services->getDBLoadBalancer(),
                        $blobStore,
                        $services->getMainWANObjectCache(),
-                       $services->getCommentStore()
+                       $services->getCommentStore(),
+                       $services->getActorMigration()
                );
 
                $store->setLogger( LoggerFactory::getInstance( 'RevisionStore' ) );
@@ -537,12 +549,44 @@ return [
                return $services->getBlobStoreFactory()->newSqlBlobStore();
        },
 
+       'ContentModelStore' => function ( MediaWikiServices $services ) {
+               return new NameTableStore(
+                       $services->getDBLoadBalancer(),
+                       $services->getMainWANObjectCache(),
+                       LoggerFactory::getInstance( 'NameTableSqlStore' ),
+                       'content_models',
+                       'model_id',
+                       'model_name'
+                       /**
+                        * No strtolower normalization is added to the service as there are examples of
+                        * extensions that do not stick to this assumption.
+                        * - extensions/examples/DataPages define( 'CONTENT_MODEL_XML_DATA','XML_DATA' );
+                        * - extensions/Scribunto define( 'CONTENT_MODEL_SCRIBUNTO', 'Scribunto' );
+                        */
+               );
+       },
+
+       'SlotRoleStore' => function ( MediaWikiServices $services ) {
+               return new NameTableStore(
+                       $services->getDBLoadBalancer(),
+                       $services->getMainWANObjectCache(),
+                       LoggerFactory::getInstance( 'NameTableSqlStore' ),
+                       'slot_roles',
+                       'role_id',
+                       'role_name',
+                       'strtolower'
+               );
+       },
+
        'PreferencesFactory' => function ( MediaWikiServices $services ) {
                global $wgContLang;
                $authManager = AuthManager::singleton();
                $linkRenderer = $services->getLinkRendererFactory()->create();
                $config = $services->getMainConfig();
-               return new DefaultPreferencesFactory( $config, $wgContLang, $authManager, $linkRenderer );
+               $factory = new DefaultPreferencesFactory( $config, $wgContLang, $authManager, $linkRenderer );
+               $factory->setLogger( LoggerFactory::getInstance( 'preferences' ) );
+
+               return $factory;
        },
 
        'HttpRequestFactory' => function ( MediaWikiServices $services ) {
@@ -555,7 +599,13 @@ return [
                        $wgContLang,
                        $services->getMainConfig()->get( 'CommentTableSchemaMigrationStage' )
                );
-       }
+       },
+
+       'ActorMigration' => function ( MediaWikiServices $services ) {
+               return new ActorMigration(
+                       $services->getMainConfig()->get( 'ActorTableSchemaMigrationStage' )
+               );
+       },
 
        ///////////////////////////////////////////////////////////////////////////
        // NOTE: When adding a service here, don't forget to add a getter function