SECURITY: rate-limit and prevent blocked users from changing email

[lhc/web/wiklou.git] / includes / api / ApiMain.php

diff --git a/includes/api/ApiMain.php b/includes/api/ApiMain.php
index 295d5d0..b845c57 100644 (file)
--- a/includes/api/ApiMain.php
+++ b/includes/api/ApiMain.php
@@ -148,7 +148,7 @@ class ApiMain extends ApiBase {
        private $mContinuationManager;
        private $mAction;
        private $mEnableWrite;
-       private $mInternalMode, $mSquidMaxage;
+       private $mInternalMode, $mCdnMaxAge;
        /** @var ApiBase */
        private $mModule;
 
@@ -218,7 +218,7 @@ class ApiMain extends ApiBase {
                                                'cookies' => $sessionCookies,
                                                'ip' => $request->getIP(),
                                                'userAgent' => $this->getUserAgent(),
-                                               'wiki' => wfWikiID(),
+                                               'wiki' => WikiMap::getCurrentWikiDbDomain()->getId(),
                                        ]
                                );
                        }
@@ -288,7 +288,7 @@ class ApiMain extends ApiBase {
                $this->mContinuationManager = null;
                $this->mEnableWrite = $enableWrite;
 
-               $this->mSquidMaxage = -1; // flag for executeActionWithErrorHandling()
+               $this->mCdnMaxAge = -1; // flag for executeActionWithErrorHandling()
                $this->mCommit = false;
        }
 
@@ -321,7 +321,7 @@ class ApiMain extends ApiBase {
                $request = $this->getRequest();
 
                // JSONP mode
-               if ( $request->getVal( 'callback' ) !== null ) {
+               if ( $request->getCheck( 'callback' ) ) {
                        $this->lacksSameOriginSecurity = true;
                        return true;
                }
@@ -1117,19 +1117,17 @@ class ApiMain extends ApiBase {
                                        . $this->msg( 'api-usage-mailinglist-ref' )->inLanguage( $formatter->getLanguage() )->text()
                                )
                        );
-               } else {
-                       if ( $config->get( 'ShowExceptionDetails' ) ) {
-                               $result->addContentValue(
-                                       $path,
-                                       'trace',
-                                       $this->msg( 'api-exception-trace',
-                                               get_class( $e ),
-                                               $e->getFile(),
-                                               $e->getLine(),
-                                               MWExceptionHandler::getRedactedTraceAsString( $e )
-                                       )->inLanguage( $formatter->getLanguage() )->text()
-                               );
-                       }
+               } elseif ( $config->get( 'ShowExceptionDetails' ) ) {
+                       $result->addContentValue(
+                               $path,
+                               'trace',
+                               $this->msg( 'api-exception-trace',
+                                       get_class( $e ),
+                                       $e->getFile(),
+                                       $e->getLine(),
+                                       MWExceptionHandler::getRedactedTraceAsString( $e )
+                               )->inLanguage( $formatter->getLanguage() )->text()
+                       );
                }
 
                // Add the id and such
@@ -1370,18 +1368,20 @@ class ApiMain extends ApiBase {
                                                $ts->format( 'D M j H:i:s Y' ) === $value ||
                                                $ts->format( 'D M  j H:i:s Y' ) === $value
                                        ) {
+                                               $config = $this->getConfig();
                                                $lastMod = $module->getConditionalRequestData( 'last-modified' );
                                                if ( $lastMod !== null ) {
                                                        // Mix in some MediaWiki modification times
                                                        $modifiedTimes = [
                                                                'page' => $lastMod,
                                                                'user' => $this->getUser()->getTouched(),
-                                                               'epoch' => $this->getConfig()->get( 'CacheEpoch' ),
+                                                               'epoch' => $config->get( 'CacheEpoch' ),
                                                        ];
-                                                       if ( $this->getConfig()->get( 'UseSquid' ) ) {
+
+                                                       if ( $config->get( 'UseCdn' ) ) {
                                                                // T46570: the core page itself may not change, but resources might
                                                                $modifiedTimes['sepoch'] = wfTimestamp(
-                                                                       TS_MW, time() - $this->getConfig()->get( 'SquidMaxage' )
+                                                                       TS_MW, time() - $config->get( 'CdnMaxAge' )
                                                                );
                                                        }
                                                        Hooks::run( 'OutputPageCheckLastModified', [ &$modifiedTimes, $this->getOutput() ] );
@@ -1633,7 +1633,7 @@ class ApiMain extends ApiBase {
                        'ts' => time(),
                        'ip' => $request->getIP(),
                        'userAgent' => $this->getUserAgent(),
-                       'wiki' => wfWikiID(),
+                       'wiki' => WikiMap::getCurrentWikiDbDomain()->getId(),
                        'timeSpentBackend' => (int)round( $time * 1000 ),
                        'hadError' => $e !== null,
                        'errorCodes' => [],
@@ -1653,7 +1653,7 @@ class ApiMain extends ApiBase {
                                'method' => $request->getMethod(),
                                'client_ip' => $request->getIP()
                        ],
-                       'database' => wfWikiID(),
+                       'database' => WikiMap::getCurrentWikiDbDomain()->getId(),
                        'backend_time_ms' => (int)round( $time * 1000 ),
                ];
 
@@ -1840,7 +1840,7 @@ class ApiMain extends ApiBase {
         */
        protected function printResult( $httpCode = 0 ) {
                if ( $this->getConfig()->get( 'DebugAPI' ) !== false ) {
-                       $this->addWarning( 'apiwarn-wgDebugAPI' );
+                       $this->addWarning( 'apiwarn-wgdebugapi' );
                }
 
                $printer = $this->mPrinter;