SECURITY: Disallow loading JS/CSS/Json subpages from unregistered users and log

[lhc/web/wiklou.git] / includes / WebRequest.php

diff --git a/includes/WebRequest.php b/includes/WebRequest.php
index 0a7f416..c6ddf81 100644 (file)
--- a/includes/WebRequest.php
+++ b/includes/WebRequest.php
@@ -88,8 +88,7 @@ class WebRequest {
         * @codeCoverageIgnore
         */
        public function __construct() {
-               $this->requestTime = isset( $_SERVER['REQUEST_TIME_FLOAT'] )
-                       ? $_SERVER['REQUEST_TIME_FLOAT'] : microtime( true );
+               $this->requestTime = $_SERVER['REQUEST_TIME_FLOAT'];
 
                // POST overrides GET data
                // We don't use $_REQUEST here to avoid interference from cookies...
@@ -142,7 +141,7 @@ class WebRequest {
                                $router->add( "$wgScript/$1" );
 
                                if ( isset( $_SERVER['SCRIPT_NAME'] )
-                                       && preg_match( '/\.php5?/', $_SERVER['SCRIPT_NAME'] )
+                                       && preg_match( '/\.php/', $_SERVER['SCRIPT_NAME'] )
                                ) {
                                        # Check for SCRIPT_NAME, we handle index.php explicitly
                                        # But we do have some other .php files such as img_auth.php
@@ -270,6 +269,8 @@ class WebRequest {
         * @since 1.27
         */
        public static function getRequestId() {
+               // This method is called from various error handlers and should be kept simple.
+
                if ( !self::$reqId ) {
                        self::$reqId = isset( $_SERVER['UNIQUE_ID'] )
                                ? $_SERVER['UNIQUE_ID'] : wfRandomString( 24 );
@@ -431,7 +432,7 @@ class WebRequest {
         * selected by a drop-down menu). For freeform input, see getText().
         *
         * @param string $name
-        * @param string $default Optional default (or null)
+        * @param string|null $default Optional default (or null)
         * @return string|null
         */
        public function getVal( $name, $default = null ) {
@@ -781,6 +782,8 @@ class WebRequest {
         * @return string
         */
        public static function getGlobalRequestURL() {
+               // This method is called on fatal errors; it should not depend on anything complex.
+
                if ( isset( $_SERVER['REQUEST_URI'] ) && strlen( $_SERVER['REQUEST_URI'] ) ) {
                        $base = $_SERVER['REQUEST_URI'];
                } elseif ( isset( $_SERVER['HTTP_X_ORIGINAL_URL'] )