Allow fallbacks for $wgReferrerPolicy

For browsers that support older versions of the Referrer Policy
specification (Edge and Safari), using a value from a newer version of
the specification will result in those browsers falling back to a
default of "default".

So allow $wgReferrerPolicy to have fallbacks if the browser does not
recognize the currently set value. It will emit <meta> tags for each
value in the array, but in reverse order, as browsers will use the last
one that they recognize.

Bug: T180921
Change-Id: Ie0f523fc6937c9ecffc8a6fc791c6b54d5a1cb06

diff --git a/RELEASE-NOTES-1.31 b/RELEASE-NOTES-1.31
index 1a1a9f7..aa8e5f4 100644 (file)
--- a/RELEASE-NOTES-1.31
+++ b/RELEASE-NOTES-1.31
@@ -19,6 +19,8 @@ production.
   maintenance/cleanupUsersWithNoId.php.
 * $wgResourceLoaderMinifierStatementsOnOwnLine and $wgResourceLoaderMinifierMaxLineLength
   were removed (deprecated since 1.27).
+* (T180921) $wgReferrerPolicy now supports having fallbacks for browsers that are not
+  using the latest version of the Referrer Policy specification.
 
 === New features in 1.31 ===
 * Wikimedia\Rdbms\IDatabase->select() and similar methods now support

diff --git a/includes/DefaultSettings.php b/includes/DefaultSettings.php
index d0a02de..163e253 100644 (file)
--- a/includes/DefaultSettings.php
+++ b/includes/DefaultSettings.php
@@ -316,7 +316,7 @@ $wgAppleTouchIcon = false;
 
 /**
  * Value for the referrer policy meta tag.
- * One of the values defined in the Referrer Policy specification:
+ * One or more of the values defined in the Referrer Policy specification:
  * https://w3c.github.io/webappsec-referrer-policy/
  * ('no-referrer', 'no-referrer-when-downgrade', 'same-origin',
  * 'origin', 'strict-origin', 'origin-when-cross-origin',
@@ -324,8 +324,12 @@ $wgAppleTouchIcon = false;
  * Setting it to false prevents the meta tag from being output
  * (which results in falling back to the Referrer-Policy header,
  * or 'no-referrer-when-downgrade' if that's not set either.)
+ * Setting it to an array (supported since 1.31) will create a meta tag for
+ * each value, in the reverse of the order (meaning that the first array element
+ * will be the default and the others used as fallbacks for browsers which do not
+ * understand it).
  *
- * @var string|bool
+ * @var array|string|bool
  * @since 1.25
  */
 $wgReferrerPolicy = false;

diff --git a/includes/OutputPage.php b/includes/OutputPage.php
index 92963fd..9cf94d8 100644 (file)
--- a/includes/OutputPage.php
+++ b/includes/OutputPage.php
@@ -3331,10 +3331,14 @@ class OutputPage extends ContextSource {
                ] );
 
                if ( $config->get( 'ReferrerPolicy' ) !== false ) {
-                       $tags['meta-referrer'] = Html::element( 'meta', [
-                               'name' => 'referrer',
-                               'content' => $config->get( 'ReferrerPolicy' )
-                       ] );
+                       // Per https://w3c.github.io/webappsec-referrer-policy/#unknown-policy-values
+                       // fallbacks should come before the primary value so we need to reverse the array.
+                       foreach ( array_reverse( (array)$config->get( 'ReferrerPolicy' ) ) as $i => $policy ) {
+                               $tags["meta-referrer-$i"] = Html::element( 'meta', [
+                                       'name' => 'referrer',
+                                       'content' => $policy,
+                               ] );
+                       }
                }
 
                $p = "{$this->mIndexPolicy},{$this->mFollowPolicy}";