API:
authorYuri Astrakhan <yurik@users.mediawiki.org>
Sun, 8 Jul 2007 03:35:37 +0000 (03:35 +0000)
committerYuri Astrakhan <yurik@users.mediawiki.org>
Sun, 8 Jul 2007 03:35:37 +0000 (03:35 +0000)
* added link enumeration (list=alllinks)
* marked potential security vulnerability

RELEASE-NOTES
includes/AutoLoader.php
includes/api/ApiPageSet.php
includes/api/ApiQuery.php
includes/api/ApiQueryAllLinks.php [new file with mode: 0644]
includes/api/ApiQueryAllpages.php
includes/api/ApiQueryBacklinks.php
includes/api/ApiQueryCategoryMembers.php

index 601372d..e50e2e5 100644 (file)
@@ -308,6 +308,7 @@ Full API documentation is available at http://www.mediawiki.org/wiki/API
 * Added prop=imageinfo - gets image properties and upload history
 * (bug 10211) Added db server replication lag information in meta=siteinfo
 * Added external url search within wiki pages (list=exturlusage)
+* Added link enumeration (list=alllinks)
 
 == Maintenance script changes since 1.10 ==
 
index f1e2a3d..ab86ab0 100644 (file)
@@ -306,6 +306,7 @@ function __autoload($className) {
                'ApiPageSet' => 'includes/api/ApiPageSet.php',
                'ApiQuery' => 'includes/api/ApiQuery.php',
                'ApiQueryAllpages' => 'includes/api/ApiQueryAllpages.php',
+               'ApiQueryAllLinks' => 'includes/api/ApiQueryAllLinks.php',
                'ApiQueryBase' => 'includes/api/ApiQueryBase.php',
                'ApiQueryGeneratorBase' => 'includes/api/ApiQueryBase.php',
                'ApiQueryBacklinks' => 'includes/api/ApiQueryBacklinks.php',
index b11963d..bb34149 100644 (file)
@@ -266,7 +266,6 @@ class ApiPageSet extends ApiQueryBase {
         */
        public function populateFromPageIDs($pageIDs) {
                $this->profileIn();
-               $pageIDs = array_map('intval', $pageIDs); // paranoia
                $this->initFromPageIds($pageIDs);
                $this->profileOut();
        }
@@ -361,7 +360,8 @@ class ApiPageSet extends ApiQueryBase {
        private function initFromPageIds($pageids) {
                if(empty($pageids))
                        return;
-                       
+
+               $pageids = array_map('intval', $pageids); // paranoia
                $set = array (
                        'page_id' => $pageids
                );
index 82e2b1d..46dc8f0 100644 (file)
@@ -59,6 +59,7 @@ class ApiQuery extends ApiBase {
 
        private $mQueryListModules = array (
                'allpages' => 'ApiQueryAllpages',
+               'alllinks' => 'ApiQueryAllLinks',
                'backlinks' => 'ApiQueryBacklinks',
                'categorymembers' => 'ApiQueryCategoryMembers',
                'embeddedin' => 'ApiQueryBacklinks',
diff --git a/includes/api/ApiQueryAllLinks.php b/includes/api/ApiQueryAllLinks.php
new file mode 100644 (file)
index 0000000..a7803b0
--- /dev/null
@@ -0,0 +1,181 @@
+<?php
+
+/*
+ * Created on July 7, 2007
+ *
+ * API for MediaWiki 1.8+
+ *
+ * Copyright (C) 2006 Yuri Astrakhan <Firstname><Lastname>@gmail.com
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ * http://www.gnu.org/copyleft/gpl.html
+ */
+
+if (!defined('MEDIAWIKI')) {
+       // Eclipse helper - will be ignored in production
+       require_once ('ApiQueryBase.php');
+}
+
+/**
+ * Query module to enumerate all available pages.
+ * 
+ * @addtogroup API
+ */
+class ApiQueryAllLinks extends ApiQueryGeneratorBase {
+
+       public function __construct($query, $moduleName) {
+               parent :: __construct($query, $moduleName, 'al');
+       }
+
+       public function execute() {
+               $this->run();
+       }
+
+       public function executeGenerator($resultPageSet) {
+               $this->run($resultPageSet);
+       }
+
+       private function run($resultPageSet = null) {
+
+               $db = $this->getDB();
+               $params = $this->extractRequestParams();
+               $this->debugPrint($params);
+
+               $prop = array_flip($params['prop']);
+               $fld_ids = isset($prop['ids']);
+               $fld_title = isset($prop['title']);
+
+               if ($params['unique']) {
+                       if (!is_null($resultPageSet))
+                               $this->dieUsage($this->getModuleName() . ' cannot be used as a generator in unique links mode', 'params');
+                       if ($fld_ids)
+                               $this->dieUsage($this->getModuleName() . ' cannot return corresponding page ids in unique links mode', 'params');
+                       $this->addOption('DISTINCT');
+               }
+
+               $this->addTables('pagelinks');
+               $this->addWhereFld('pl_namespace', $params['namespace']);
+               
+               if (!is_null($params['from']))
+                       $this->addWhere('pl_title>=' . $db->addQuotes(ApiQueryBase :: titleToKey($params['from'])));
+               if (isset ($params['prefix']))
+                       $this->addWhere("pl_title LIKE '" . $db->strencode(ApiQueryBase :: titleToKey($params['prefix'])) . "%'");
+
+               if (is_null($resultPageSet)) {
+                       $this->addFields(array (
+                               'pl_namespace',
+                               'pl_title'
+                       ));
+                       $this->addFieldsIf('pl_from', $fld_ids);
+               } else {
+                       $this->addFields('pl_from');
+                       $pageids = array();
+               }
+
+               $this->addOption('USE INDEX', 'pl_namespace');
+               $limit = $params['limit'];
+               $this->addOption('LIMIT', $limit+1);
+               $this->addOption('ORDER BY', 'pl_namespace, pl_title');
+
+               $res = $this->select(__METHOD__);
+
+               $data = array ();
+               $count = 0;
+               while ($row = $db->fetchObject($res)) {
+                       if (++ $count > $limit) {
+                               // We've reached the one extra which shows that there are additional pages to be had. Stop here...
+                               // TODO: Security issue - if the user has no right to view next title, it will still be shown
+                               $this->setContinueEnumParameter('from', ApiQueryBase :: keyToTitle($row->pl_title));
+                               break;
+                       }
+
+                       if (is_null($resultPageSet)) {
+                               $title = Title :: makeTitle($row->pl_namespace, $row->pl_title);
+                               if ($title->userCanRead()) {
+                                       $vals = array();
+                                       if ($fld_ids)
+                                               $vals['fromid'] = intval($row->pl_from);
+                                       if ($fld_title) {
+                                               $vals['ns'] = intval($title->getNamespace());
+                                               $vals['title'] = $title->getPrefixedText();
+                                       }
+                                       $data[] = $vals;
+                               }
+                       } else {
+                               $pageids[] = $row->pl_from;
+                       }
+               }
+               $db->freeResult($res);
+
+               if (is_null($resultPageSet)) {
+                       $result = $this->getResult();
+                       $result->setIndexedTagName($data, 'l');
+                       $result->addValue('query', $this->getModuleName(), $data);
+               } else {
+                       $resultPageSet->populateFromPageIDs($pageids);
+               }
+       }
+
+       protected function getAllowedParams() {
+               return array (
+                       'from' => null,
+                       'prefix' => null,
+                       'unique' => false,
+                       'prop' => array (
+                               ApiBase :: PARAM_ISMULTI => true,
+                               ApiBase :: PARAM_DFLT => 'title',
+                               ApiBase :: PARAM_TYPE => array (
+                                       'ids',
+                                       'title'
+                               )
+                       ),
+                       'namespace' => array (
+                               ApiBase :: PARAM_DFLT => 0,
+                               ApiBase :: PARAM_TYPE => 'namespace'
+                       ),
+                       'limit' => array (
+                               ApiBase :: PARAM_DFLT => 10,
+                               ApiBase :: PARAM_TYPE => 'limit',
+                               ApiBase :: PARAM_MIN => 1,
+                               ApiBase :: PARAM_MAX => ApiBase :: LIMIT_BIG1,
+                               ApiBase :: PARAM_MAX2 => ApiBase :: LIMIT_BIG2
+                       )
+               );
+       }
+
+       protected function getParamDescription() {
+               return array (
+                       'from' => 'The page title to start enumerating from.',
+                       'prefix' => 'Search for all page titles that begin with this value.',
+                       'unique' => 'Only show unique links. Cannot be used with generator or prop=ids',
+                       'namespace' => 'The namespace to enumerate.',
+                       'limit' => 'How many total links to return.'
+               );
+       }
+
+       protected function getDescription() {
+               return 'Enumerate all pages sequentially in a given namespace';
+       }
+
+       protected function getExamples() {
+               return array (
+                       'api.php?action=query&list=alllinks&alunique&alfrom=B',
+               );
+       }
+
+       public function getVersion() {
+               return __CLASS__ . ': $Id$';
+       }
+}
index 49981d9..e858dec 100644 (file)
@@ -54,17 +54,16 @@ class ApiQueryAllpages extends ApiQueryGeneratorBase {
 
                $db = $this->getDB();
 
-               $limit = $from = $namespace = $filterredir = $prefix = null;
-               extract($this->extractRequestParams());
+               $params = $this->extractRequestParams();
 
                $this->addTables('page');
-               if (!$this->addWhereIf('page_is_redirect = 1', $filterredir === 'redirects'))
-                       $this->addWhereIf('page_is_redirect = 0', $filterredir === 'nonredirects');
-               $this->addWhereFld('page_namespace', $namespace);
-               if (isset ($from))
-                       $this->addWhere('page_title>=' . $db->addQuotes(ApiQueryBase :: titleToKey($from)));
-               if (isset ($prefix))
-                       $this->addWhere("page_title LIKE '{$db->strencode(ApiQueryBase :: titleToKey($prefix))}%'");
+               if (!$this->addWhereIf('page_is_redirect = 1', $params['filterredir'] === 'redirects'))
+                       $this->addWhereIf('page_is_redirect = 0', $params['filterredir'] === 'nonredirects');
+               $this->addWhereFld('page_namespace', $params['namespace']);
+               if (!is_null($params['from']))
+                       $this->addWhere('page_title>=' . $db->addQuotes(ApiQueryBase :: titleToKey($params['from'])));
+               if (isset ($params['prefix']))
+                       $this->addWhere("page_title LIKE '" . $db->strencode(ApiQueryBase :: titleToKey($params['prefix'])) . "%'");
 
                if (is_null($resultPageSet)) {
                        $this->addFields(array (
@@ -77,7 +76,8 @@ class ApiQueryAllpages extends ApiQueryGeneratorBase {
                }
 
                $this->addOption('USE INDEX', 'name_title');
-               $this->addOption('LIMIT', $limit +1);
+               $limit = $params['limit'];
+               $this->addOption('LIMIT', $limit+1);
                $this->addOption('ORDER BY', 'page_namespace, page_title');
 
                $res = $this->select(__METHOD__);
@@ -87,6 +87,7 @@ class ApiQueryAllpages extends ApiQueryGeneratorBase {
                while ($row = $db->fetchObject($res)) {
                        if (++ $count > $limit) {
                                // We've reached the one extra which shows that there are additional pages to be had. Stop here...
+                               // TODO: Security issue - if the user has no right to view next title, it will still be shown
                                $this->setContinueEnumParameter('from', ApiQueryBase :: keyToTitle($row->page_title));
                                break;
                        }
index be76c95..a9e059f 100644 (file)
@@ -162,6 +162,7 @@ class ApiQueryBacklinks extends ApiQueryGeneratorBase {
                                        $continue = $this->getContinueRedirStr(false, 0, $ns, $t, $row->page_id);
                                } else
                                        $continue = $this->getContinueStr($row->page_id);
+                               // TODO: Security issue - if the user has no right to view next title, it will still be shown
                                $this->setContinueEnumParameter('continue', $continue);
                                break;
                        }
index aac3dad..175aabc 100644 (file)
@@ -92,6 +92,7 @@ class ApiQueryCategoryMembers extends ApiQueryGeneratorBase {
                while ($row = $db->fetchObject($res)) {
                        if (++ $count > $limit) {
                                // We've reached the one extra which shows that there are additional pages to be had. Stop here...
+                               // TODO: Security issue - if the user has no right to view next title, it will still be shown
                                $this->setContinueEnumParameter('continue', $this->getContinueStr($row, $lastSortKey));
                                break;
                        }