From: jenkins-bot <jenkins-bot@gerrit.wikimedia.org>
Date: Fri, 7 Jul 2017 01:21:30 +0000 (+0000)
Subject: Merge "Avoid high edit stash TTLs when a user signature was used"
X-Git-Tag: 1.31.0-rc.0~2776
X-Git-Url: https://git.heureux-cyclage.org/?p=lhc%2Fweb%2Fwiklou.git;a=commitdiff_plain;h=43697f81b00f29cbe9351ea527ec499149076ddb;hp=1326bfc813fc789935088bea572f11cca83ce8d5

Merge "Avoid high edit stash TTLs when a user signature was used"
---

diff --git a/includes/api/ApiStashEdit.php b/includes/api/ApiStashEdit.php
index c7a00c6464..d03fca87a0 100644
--- a/includes/api/ApiStashEdit.php
+++ b/includes/api/ApiStashEdit.php
@@ -44,6 +44,7 @@ class ApiStashEdit extends ApiBase {
 
 	const PRESUME_FRESH_TTL_SEC = 30;
 	const MAX_CACHE_TTL = 300; // 5 minutes
+	const MAX_SIGNATURE_TTL = 60;
 
 	public function execute() {
 		$user = $this->getUser();
@@ -391,6 +392,12 @@ class ApiStashEdit extends ApiBase {
 		// Put an upper limit on the TTL for sanity to avoid extreme template/file staleness.
 		$since = time() - wfTimestamp( TS_UNIX, $parserOutput->getTimestamp() );
 		$ttl = min( $parserOutput->getCacheExpiry() - $since, self::MAX_CACHE_TTL );
+
+		// Avoid extremely stale user signature timestamps (T84843)
+		if ( $parserOutput->getFlag( 'user-signature' ) ) {
+			$ttl = min( $ttl, self::MAX_SIGNATURE_TTL );
+		}
+
 		if ( $ttl <= 0 ) {
 			return [ null, 0, 'no_ttl' ];
 		}
diff --git a/includes/parser/Parser.php b/includes/parser/Parser.php
index 9ea65e013d..4a78ff8321 100644
--- a/includes/parser/Parser.php
+++ b/includes/parser/Parser.php
@@ -4502,12 +4502,16 @@ class Parser {
 		# which may corrupt this parser instance via its wfMessage()->text() call-
 
 		# Signatures
-		$sigText = $this->getUserSig( $user );
-		$text = strtr( $text, [
-			'~~~~~' => $d,
-			'~~~~' => "$sigText $d",
-			'~~~' => $sigText
-		] );
+		if ( strpos( $text, '~~~' ) !== false ) {
+			$sigText = $this->getUserSig( $user );
+			$text = strtr( $text, [
+				'~~~~~' => $d,
+				'~~~~' => "$sigText $d",
+				'~~~' => $sigText
+			] );
+			# The main two signature forms used above are time-sensitive
+			$this->mOutput->setFlag( 'user-signature' );
+		}
 
 		# Context links ("pipe tricks"): [[|name]] and [[name (context)|]]
 		$tc = '[' . Title::legalChars() . ']';