Log user-agents that are using HTTP when HTTPS is preferred

[lhc/web/wiklou.git] / includes / api / ApiMain.php

diff --git a/includes/api/ApiMain.php b/includes/api/ApiMain.php
index ca5e1bb..458fd18 100644 (file)
--- a/includes/api/ApiMain.php
+++ b/includes/api/ApiMain.php
@@ -434,6 +434,9 @@ class ApiMain extends ApiBase {
                // Log the request whether or not there was an error
                $this->logRequest( microtime( true ) - $t );
 
+               // Commit DBs and send any related cookies and headers
+               MediaWiki::preOutputCommit( $this->getContext() );
+
                // Send cache headers after any code which might generate an error, to
                // avoid sending public cache headers for errors.
                $this->sendCacheHeaders( $isError );
@@ -766,7 +769,7 @@ class ApiMain extends ApiBase {
                                        return;
                                }
                                // Logged out, send normal public headers below
-                       } elseif ( session_id() != '' ) {
+                       } elseif ( MediaWiki\Session\SessionManager::getGlobalSession()->isPersistent() ) {
                                // Logged in or otherwise has session (e.g. anonymous users who have edited)
                                // Mark request private
                                $response->header( "Cache-Control: $privateCache" );
@@ -1228,7 +1231,8 @@ class ApiMain extends ApiBase {
         * @param array $params An array with the request parameters
         */
        protected function setupExternalResponse( $module, $params ) {
-               if ( !$this->getRequest()->wasPosted() && $module->mustBePosted() ) {
+               $request = $this->getRequest();
+               if ( !$request->wasPosted() && $module->mustBePosted() ) {
                        // Module requires POST. GET request might still be allowed
                        // if $wgDebugApi is true, otherwise fail.
                        $this->dieUsageMsgOrDebug( array( 'mustbeposted', $this->mAction ) );
@@ -1240,6 +1244,15 @@ class ApiMain extends ApiBase {
                        // Create an appropriate printer
                        $this->mPrinter = $this->createPrinterByName( $params['format'] );
                }
+
+               if ( $request->getProtocol() === 'http' && (
+                       $request->getSession()->shouldForceHTTPS() ||
+                       ( $this->getUser()->isLoggedIn() &&
+                               $this->getUser()->requiresHTTPS() )
+               ) ) {
+                       $this->logFeatureUsage( 'https-expected' );
+                       $this->setWarning( 'HTTP used when HTTPS was expected' );
+               }
        }
 
        /**
@@ -1250,6 +1263,8 @@ class ApiMain extends ApiBase {
                $module = $this->setupModule();
                $this->mModule = $module;
 
+               $this->setRequestExpectations( $module );
+
                $this->checkExecutePermissions( $module );
 
                if ( !$this->checkMaxLag( $module, $params ) ) {
@@ -1281,6 +1296,24 @@ class ApiMain extends ApiBase {
                }
        }
 
+       /**
+        * Set database connection, query, and write expectations given this module request
+        * @param ApiBase $module
+        */
+       protected function setRequestExpectations( ApiBase $module ) {
+               $limits = $this->getConfig()->get( 'TrxProfilerLimits' );
+               $trxProfiler = Profiler::instance()->getTransactionProfiler();
+               if ( $this->getRequest()->wasPosted() ) {
+                       if ( $module->isWriteMode() ) {
+                               $trxProfiler->setExpectations( $limits['POST'], __METHOD__ );
+                       } else {
+                               $trxProfiler->setExpectations( $limits['POST-nonwrite'], __METHOD__ );
+                       }
+               } else {
+                       $trxProfiler->setExpectations( $limits['GET'], __METHOD__ );
+               }
+       }
+
        /**
         * Log the preceding request
         * @param float $time Time in seconds
@@ -1291,7 +1324,7 @@ class ApiMain extends ApiBase {
                        'dt' => date( 'c' ),
                        'client_ip' => $request->getIP(),
                        'user_agent' => $this->getUserAgent(),
-                       'wiki' => wfWikiId(),
+                       'wiki' => wfWikiID(),
                        'time_backend_ms' => round( $time * 1000 ),
                        'params' => array(),
                );
@@ -1765,15 +1798,6 @@ class ApiMain extends ApiBase {
                $this->getModuleManager()->addModule( $name, 'format', $class );
        }
 
-       /**
-        * Get the array mapping module names to class names
-        * @deprecated since 1.21, Use getModuleManager()'s methods instead.
-        * @return array
-        */
-       function getModules() {
-               return $this->getModuleManager()->getNamesWithClasses( 'action' );
-       }
-
        /**
         * Returns the list of supported formats in form ( 'format' => 'ClassName' )
         *