API: Filter lists of IDs before sending them to the database

[lhc/web/wiklou.git] / includes / api / ApiPageSet.php

diff --git a/includes/api/ApiPageSet.php b/includes/api/ApiPageSet.php
index 194a511..913f45b 100644 (file)
--- a/includes/api/ApiPageSet.php
+++ b/includes/api/ApiPageSet.php
@@ -819,8 +819,9 @@ class ApiPageSet extends ApiBase {
        /**
         * Does the same as initFromTitles(), but is based on page IDs instead
         * @param array $pageids Array of page IDs
+        * @param bool $filterIds Whether the IDs need filtering
         */
-       private function initFromPageIds( $pageids ) {
+       private function initFromPageIds( $pageids, $filterIds = false ) {
                if ( !$pageids ) {
                        return;
                }
@@ -828,7 +829,9 @@ class ApiPageSet extends ApiBase {
                $pageids = array_map( 'intval', $pageids ); // paranoia
                $remaining = array_flip( $pageids );
 
-               $pageids = self::getPositiveIntegers( $pageids );
+               if ( $filterIds ) {
+                       $pageids = $this->filterIDs( [ [ 'page', 'page_id' ] ], $pageids );
+               }
 
                $res = null;
                if ( !empty( $pageids ) ) {
@@ -939,9 +942,10 @@ class ApiPageSet extends ApiBase {
                $pageids = [];
                $remaining = array_flip( $revids );
 
-               $revids = self::getPositiveIntegers( $revids );
+               $revids = $this->filterIDs( [ [ 'revision', 'rev_id' ], [ 'archive', 'ar_rev_id' ] ], $revids );
+               $goodRemaining = array_flip( $revids );
 
-               if ( !empty( $revids ) ) {
+               if ( $revids ) {
                        $tables = [ 'revision', 'page' ];
                        $fields = [ 'rev_id', 'rev_page' ];
                        $where = [ 'rev_id' => $revids, 'rev_page = page_id' ];
@@ -955,22 +959,20 @@ class ApiPageSet extends ApiBase {
                                $this->mLiveRevIDs[$revid] = $pageid;
                                $pageids[$pageid] = '';
                                unset( $remaining[$revid] );
+                               unset( $goodRemaining[$revid] );
                        }
                }
 
-               $this->mMissingRevIDs = array_keys( $remaining );
-
                // Populate all the page information
-               $this->initFromPageIds( array_keys( $pageids ) );
+               $this->initFromPageIds( array_keys( $pageids ), false );
 
                // If the user can see deleted revisions, pull out the corresponding
                // titles from the archive table and include them too. We ignore
                // ar_page_id because deleted revisions are tied by title, not page_id.
-               if ( !empty( $this->mMissingRevIDs ) && $this->getUser()->isAllowed( 'deletedhistory' ) ) {
-                       $remaining = array_flip( $this->mMissingRevIDs );
+               if ( $goodRemaining && $this->getUser()->isAllowed( 'deletedhistory' ) ) {
                        $tables = [ 'archive' ];
                        $fields = [ 'ar_rev_id', 'ar_namespace', 'ar_title' ];
-                       $where = [ 'ar_rev_id' => $this->mMissingRevIDs ];
+                       $where = [ 'ar_rev_id' => array_keys( $goodRemaining ) ];
 
                        $res = $db->select( $tables, $fields, $where, __METHOD__ );
                        $titles = [];
@@ -1002,9 +1004,9 @@ class ApiPageSet extends ApiBase {
                                        $remaining[$revid] = true;
                                }
                        }
-
-                       $this->mMissingRevIDs = array_keys( $remaining );
                }
+
+               $this->mMissingRevIDs = array_keys( $remaining );
        }
 
        /**
@@ -1416,25 +1418,6 @@ class ApiPageSet extends ApiBase {
                return $this->mDbSource->getDB();
        }
 
-       /**
-        * Returns the input array of integers with all values < 0 removed
-        *
-        * @param array $array
-        * @return array
-        */
-       private static function getPositiveIntegers( $array ) {
-               // T27734 API: possible issue with revids validation
-               // It seems with a load of revision rows, MySQL gets upset
-               // Remove any < 0 integers, as they can't be valid
-               foreach ( $array as $i => $int ) {
-                       if ( $int < 0 ) {
-                               unset( $array[$i] );
-                       }
-               }
-
-               return $array;
-       }
-
        public function getAllowedParams( $flags = 0 ) {
                $result = [
                        'titles' => [