SECURITY: API: Don't log "sensitive" parameters

[lhc/web/wiklou.git] / includes / api / ApiBase.php

diff --git a/includes/api/ApiBase.php b/includes/api/ApiBase.php
index b8dd464..b698cef 100644 (file)
--- a/includes/api/ApiBase.php
+++ b/includes/api/ApiBase.php
@@ -24,6 +24,8 @@
  * @file
  */
 
+use Wikimedia\Rdbms\IDatabase;
+
 /**
  * This abstract class implements many basic API functions, and is the base of
  * all API classes.
@@ -186,6 +188,13 @@ abstract class ApiBase extends ContextSource {
         */
        const PARAM_EXTRA_NAMESPACES = 18;
 
+       /*
+        * (boolean) Is the parameter sensitive? Note 'password'-type fields are
+        * always sensitive regardless of the value of this field.
+        * @since 1.29
+        */
+       const PARAM_SENSITIVE = 19;
+
        /**@}*/
 
        const ALL_DEFAULT_STRING = '*';
@@ -700,7 +709,7 @@ abstract class ApiBase extends ContextSource {
         * @return array
         */
        public function extractRequestParams( $parseLimit = true ) {
-               // Cache parameters, for performance and to avoid bug 24564.
+               // Cache parameters, for performance and to avoid T26564.
                if ( !isset( $this->mParamCache[$parseLimit] ) ) {
                        $params = $this->getFinalParams();
                        $results = [];
@@ -1023,6 +1032,10 @@ abstract class ApiBase extends ContextSource {
                        } else {
                                $type = 'NULL'; // allow everything
                        }
+
+                       if ( $type == 'password' || !empty( $paramSettings[self::PARAM_SENSITIVE] ) ) {
+                               $this->getMain()->markParamsSensitive( $encParamName );
+                       }
                }
 
                if ( $type == 'boolean' ) {
@@ -1326,7 +1339,7 @@ abstract class ApiBase extends ContextSource {
                }
 
                if ( !$allowMultiple && count( $valuesList ) != 1 ) {
-                       // Bug 33482 - Allow entries with | in them for non-multiple values
+                       // T35482 - Allow entries with | in them for non-multiple values
                        if ( in_array( $value, $allowedValues, true ) ) {
                                return $value;
                        }
@@ -1718,6 +1731,18 @@ abstract class ApiBase extends ContextSource {
                        $this->logFeatureUsage( $feature );
                }
                $this->addWarning( $msg, 'deprecation', $data );
+
+               // No real need to deduplicate here, ApiErrorFormatter does that for
+               // us (assuming the hook is deterministic).
+               $msgs = [ $this->msg( 'api-usage-mailinglist-ref' ) ];
+               Hooks::run( 'ApiDeprecationHelp', [ &$msgs ] );
+               if ( count( $msgs ) > 1 ) {
+                       $key = '$' . join( ' $', range( 1, count( $msgs ) ) );
+                       $msg = ( new RawMessage( $key ) )->params( $msgs );
+               } else {
+                       $msg = reset( $msgs );
+               }
+               $this->getMain()->addWarning( $msg, 'deprecation-help' );
        }
 
        /**
@@ -2016,6 +2041,7 @@ abstract class ApiBase extends ContextSource {
                        $params['token'] = [
                                ApiBase::PARAM_TYPE => 'string',
                                ApiBase::PARAM_REQUIRED => true,
+                               ApiBase::PARAM_SENSITIVE => true,
                                ApiBase::PARAM_HELP_MSG => [
                                        'api-help-param-token',
                                        $this->needsToken(),