stwalkerster / waca

includes/ConsoleTasks/RegenerateStylesheetsTask.php

Indentation +19 added lines, -19 removed lines

@@ -13,27 +13,27 @@
 
 class RegenerateStylesheetsTask extends ConsoleTaskBase
 {
-    const RESOURCES_GENERATED = 'resources/generated';
+	const RESOURCES_GENERATED = 'resources/generated';
 
-    public function execute()
-    {
-        $scss = new Compiler();
-        $scss->setImportPaths('resources/scss');
+	public function execute()
+	{
+		$scss = new Compiler();
+		$scss->setImportPaths('resources/scss');
 
-        if (!$this->getSiteConfiguration()->getDebuggingTraceEnabled()) {
-            $scss->setOutputStyle(\ScssPhp\ScssPhp\OutputStyle::COMPRESSED);
-            $scss->setSourceMap(Compiler::SOURCE_MAP_INLINE);
-        }
+		if (!$this->getSiteConfiguration()->getDebuggingTraceEnabled()) {
+			$scss->setOutputStyle(\ScssPhp\ScssPhp\OutputStyle::COMPRESSED);
+			$scss->setSourceMap(Compiler::SOURCE_MAP_INLINE);
+		}
 
-        if (!is_dir(self::RESOURCES_GENERATED)) {
-            mkdir(self::RESOURCES_GENERATED);
-        }
+		if (!is_dir(self::RESOURCES_GENERATED)) {
+			mkdir(self::RESOURCES_GENERATED);
+		}
 
-        foreach (['bootstrap-main', 'bootstrap-alt', 'bootstrap-auto'] as $file) {
-            file_put_contents(
-                self::RESOURCES_GENERATED . '/' . $file . '.css',
-                $scss->compileString('/*! Do not edit this auto-generated file! */ @import "' . $file . '";')->getCss()
-            );
-        }
-    }
+		foreach (['bootstrap-main', 'bootstrap-alt', 'bootstrap-auto'] as $file) {
+			file_put_contents(
+				self::RESOURCES_GENERATED . '/' . $file . '.css',
+				$scss->compileString('/*! Do not edit this auto-generated file! */ @import "' . $file . '";')->getCss()
+			);
+		}
+	}
 }

includes/ConsoleStart.php

Indentation +52 added lines, -52 removed lines

@@ -15,66 +15,66 @@
 
 class ConsoleStart extends ApplicationBase
 {
-    /**
-     * @var ConsoleTaskBase
-     */
-    private $consoleTask;
+	/**
+	 * @var ConsoleTaskBase
+	 */
+	private $consoleTask;
 
-    /**
-     * ConsoleStart constructor.
-     *
-     * @param SiteConfiguration $configuration
-     * @param ConsoleTaskBase   $consoleTask
-     */
-    public function __construct(SiteConfiguration $configuration, ConsoleTaskBase $consoleTask)
-    {
-        parent::__construct($configuration);
-        $this->consoleTask = $consoleTask;
-    }
+	/**
+	 * ConsoleStart constructor.
+	 *
+	 * @param SiteConfiguration $configuration
+	 * @param ConsoleTaskBase   $consoleTask
+	 */
+	public function __construct(SiteConfiguration $configuration, ConsoleTaskBase $consoleTask)
+	{
+		parent::__construct($configuration);
+		$this->consoleTask = $consoleTask;
+	}
 
-    protected function setupEnvironment()
-    {
-        // initialise super-global providers
-        WebRequest::setGlobalStateProvider(new FakeGlobalStateProvider());
+	protected function setupEnvironment()
+	{
+		// initialise super-global providers
+		WebRequest::setGlobalStateProvider(new FakeGlobalStateProvider());
 
-        if (WebRequest::method() !== null) {
-            throw new EnvironmentException('This is a console task, which cannot be executed via the web.');
-        }
+		if (WebRequest::method() !== null) {
+			throw new EnvironmentException('This is a console task, which cannot be executed via the web.');
+		}
 
-        return parent::setupEnvironment();
-    }
+		return parent::setupEnvironment();
+	}
 
-    protected function cleanupEnvironment()
-    {
-    }
+	protected function cleanupEnvironment()
+	{
+	}
 
-    /**
-     * Main application logic
-     */
-    protected function main()
-    {
-        $database = PdoDatabase::getDatabaseConnection('acc');
+	/**
+	 * Main application logic
+	 */
+	protected function main()
+	{
+		$database = PdoDatabase::getDatabaseConnection('acc');
 
-        $this->setupHelpers($this->consoleTask, $this->getConfiguration(), $database);
+		$this->setupHelpers($this->consoleTask, $this->getConfiguration(), $database);
 
-        // initialise a database transaction
-        if (!$database->beginTransaction()) {
-            throw new Exception('Failed to start transaction on primary database.');
-        }
+		// initialise a database transaction
+		if (!$database->beginTransaction()) {
+			throw new Exception('Failed to start transaction on primary database.');
+		}
 
-        try {
-            // run the task
-            $this->consoleTask->execute();
+		try {
+			// run the task
+			$this->consoleTask->execute();
 
-            if ($database->hasActiveTransaction()) {
-                $database->commit();
-            }
-        }
-        finally {
-            // Catch any hanging on transactions
-            if ($database->hasActiveTransaction()) {
-                $database->rollBack();
-            }
-        }
-    }
+			if ($database->hasActiveTransaction()) {
+				$database->commit();
+			}
+		}
+		finally {
+			// Catch any hanging on transactions
+			if ($database->hasActiveTransaction()) {
+				$database->rollBack();
+			}
+		}
+	}
 }
\ No newline at end of file

includes/IdentificationVerifier.php

Indentation +161 added lines, -161 removed lines

@@ -26,133 +26,133 @@ 
  */
 class IdentificationVerifier
 {
-    /**
-     * This field is an array of parameters, in key => value format, that should be appended to the Meta Wikimedia
-     * Web Service Endpoint URL to query if a user is listed on the Identification Noticeboard.  Note that URL encoding
-     * of these values is *not* necessary; this is done automatically.
-     *
-     * @var string[]
-     * @category Security-Critical
-     */
-    private static $apiQueryParameters = array(
-        'action'   => 'query',
-        'format'   => 'json',
-        'prop'     => 'links',
-        // Populated from SiteConfiguration->getIdentificationNoticeboardPage
-        'titles'   => '',
-        // Username of the user to be checked, with User: prefix, goes here!  Set in isIdentifiedOnWiki()
-        'pltitles' => '',
-    );
-    /** @var HttpHelper */
-    private $httpHelper;
-    /** @var SiteConfiguration */
-    private $siteConfiguration;
-    /** @var PdoDatabase */
-    private $dbObject;
-
-    /**
-     * IdentificationVerifier constructor.
-     *
-     * @param HttpHelper        $httpHelper
-     * @param SiteConfiguration $siteConfiguration
-     * @param PdoDatabase       $dbObject
-     */
-    public function __construct(HttpHelper $httpHelper, SiteConfiguration $siteConfiguration, PdoDatabase $dbObject)
-    {
-        $this->httpHelper = $httpHelper;
-        $this->siteConfiguration = $siteConfiguration;
-        $this->dbObject = $dbObject;
-    }
-
-    /**
-     * Checks if the given user is identified to the Wikimedia Foundation.
-     *
-     * @param string $onWikiName The Wikipedia username of the user
-     *
-     * @return bool
-     * @category Security-Critical
-     * @throws EnvironmentException
-     */
-    public function isUserIdentified($onWikiName)
-    {
-        if ($this->checkIdentificationCache($onWikiName)) {
-            return true;
-        }
-        else {
-            if ($this->isIdentifiedOnWiki($onWikiName)) {
-                $this->cacheIdentificationStatus($onWikiName);
-
-                return true;
-            }
-            else {
-                return false;
-            }
-        }
-    }
-
-    /**
-     * Checks if the given user has a valid entry in the idcache table.
-     *
-     * @param string $onWikiName The Wikipedia username of the user
-     *
-     * @return bool
-     * @category Security-Critical
-     */
-    private function checkIdentificationCache($onWikiName)
-    {
-        $interval = $this->siteConfiguration->getIdentificationCacheExpiry();
-
-        $query = <<<SQL
+	/**
+	 * This field is an array of parameters, in key => value format, that should be appended to the Meta Wikimedia
+	 * Web Service Endpoint URL to query if a user is listed on the Identification Noticeboard.  Note that URL encoding
+	 * of these values is *not* necessary; this is done automatically.
+	 *
+	 * @var string[]
+	 * @category Security-Critical
+	 */
+	private static $apiQueryParameters = array(
+		'action'   => 'query',
+		'format'   => 'json',
+		'prop'     => 'links',
+		// Populated from SiteConfiguration->getIdentificationNoticeboardPage
+		'titles'   => '',
+		// Username of the user to be checked, with User: prefix, goes here!  Set in isIdentifiedOnWiki()
+		'pltitles' => '',
+	);
+	/** @var HttpHelper */
+	private $httpHelper;
+	/** @var SiteConfiguration */
+	private $siteConfiguration;
+	/** @var PdoDatabase */
+	private $dbObject;
+
+	/**
+	 * IdentificationVerifier constructor.
+	 *
+	 * @param HttpHelper        $httpHelper
+	 * @param SiteConfiguration $siteConfiguration
+	 * @param PdoDatabase       $dbObject
+	 */
+	public function __construct(HttpHelper $httpHelper, SiteConfiguration $siteConfiguration, PdoDatabase $dbObject)
+	{
+		$this->httpHelper = $httpHelper;
+		$this->siteConfiguration = $siteConfiguration;
+		$this->dbObject = $dbObject;
+	}
+
+	/**
+	 * Checks if the given user is identified to the Wikimedia Foundation.
+	 *
+	 * @param string $onWikiName The Wikipedia username of the user
+	 *
+	 * @return bool
+	 * @category Security-Critical
+	 * @throws EnvironmentException
+	 */
+	public function isUserIdentified($onWikiName)
+	{
+		if ($this->checkIdentificationCache($onWikiName)) {
+			return true;
+		}
+		else {
+			if ($this->isIdentifiedOnWiki($onWikiName)) {
+				$this->cacheIdentificationStatus($onWikiName);
+
+				return true;
+			}
+			else {
+				return false;
+			}
+		}
+	}
+
+	/**
+	 * Checks if the given user has a valid entry in the idcache table.
+	 *
+	 * @param string $onWikiName The Wikipedia username of the user
+	 *
+	 * @return bool
+	 * @category Security-Critical
+	 */
+	private function checkIdentificationCache($onWikiName)
+	{
+		$interval = $this->siteConfiguration->getIdentificationCacheExpiry();
+
+		$query = <<<SQL
 			SELECT COUNT(`id`)
 			FROM `idcache`
 			WHERE `onwikiusername` = :onwikiname
 				AND DATE_ADD(`checktime`, INTERVAL {$interval}) >= NOW();
 SQL;
-        $stmt = $this->dbObject->prepare($query);
-        $stmt->bindValue(':onwikiname', $onWikiName, PDO::PARAM_STR);
-        $stmt->execute();
-
-        // Guaranteed by the query to only return a single row with a single column
-        $results = $stmt->fetch(PDO::FETCH_NUM);
-
-        // I don't expect this to ever be a value other than 0 or 1 since the `onwikiusername` column is declared as a
-        // unique key - but meh.
-        return $results[0] != 0;
-    }
-
-    /**
-     * Does pretty much exactly what it says on the label - this method will clear all expired idcache entries from the
-     * idcache table.  Meant to be called periodically by a maintenance script.
-     *
-     * @param SiteConfiguration $siteConfiguration
-     * @param PdoDatabase       $dbObject
-     *
-     * @return void
-     */
-    public static function clearExpiredCacheEntries(SiteConfiguration $siteConfiguration, PdoDatabase $dbObject)
-    {
-        $interval = $siteConfiguration->getIdentificationCacheExpiry();
-
-        $query = <<<SQL
+		$stmt = $this->dbObject->prepare($query);
+		$stmt->bindValue(':onwikiname', $onWikiName, PDO::PARAM_STR);
+		$stmt->execute();
+
+		// Guaranteed by the query to only return a single row with a single column
+		$results = $stmt->fetch(PDO::FETCH_NUM);
+
+		// I don't expect this to ever be a value other than 0 or 1 since the `onwikiusername` column is declared as a
+		// unique key - but meh.
+		return $results[0] != 0;
+	}
+
+	/**
+	 * Does pretty much exactly what it says on the label - this method will clear all expired idcache entries from the
+	 * idcache table.  Meant to be called periodically by a maintenance script.
+	 *
+	 * @param SiteConfiguration $siteConfiguration
+	 * @param PdoDatabase       $dbObject
+	 *
+	 * @return void
+	 */
+	public static function clearExpiredCacheEntries(SiteConfiguration $siteConfiguration, PdoDatabase $dbObject)
+	{
+		$interval = $siteConfiguration->getIdentificationCacheExpiry();
+
+		$query = <<<SQL
 			DELETE FROM `idcache`
 			WHERE DATE_ADD(`checktime`, INTERVAL {$interval}) < NOW();
 SQL;
-        $dbObject->prepare($query)->execute();
-    }
-
-    /**
-     * This method will add an entry to the idcache that the given Wikipedia user has been verified as identified.  This
-     * is so we don't have to hit the API every single time we check.  The cache entry is valid for as long as specified
-     * in the ACC configuration (validity enforced by checkIdentificationCache() and clearExpiredCacheEntries()).
-     *
-     * @param string $onWikiName The Wikipedia username of the user
-     *
-     * @return void
-     * @category Security-Critical
-     */
-    private function cacheIdentificationStatus($onWikiName)
-    {
-        $query = <<<SQL
+		$dbObject->prepare($query)->execute();
+	}
+
+	/**
+	 * This method will add an entry to the idcache that the given Wikipedia user has been verified as identified.  This
+	 * is so we don't have to hit the API every single time we check.  The cache entry is valid for as long as specified
+	 * in the ACC configuration (validity enforced by checkIdentificationCache() and clearExpiredCacheEntries()).
+	 *
+	 * @param string $onWikiName The Wikipedia username of the user
+	 *
+	 * @return void
+	 * @category Security-Critical
+	 */
+	private function cacheIdentificationStatus($onWikiName)
+	{
+		$query = <<<SQL
 			INSERT INTO `idcache`
 				(`onwikiusername`)
 			VALUES
@@ -161,46 +161,46 @@ 
 				`onwikiusername` = VALUES(`onwikiusername`),
 				`checktime` = CURRENT_TIMESTAMP;
 SQL;
-        $stmt = $this->dbObject->prepare($query);
-        $stmt->bindValue(':onwikiname', $onWikiName, PDO::PARAM_STR);
-        $stmt->execute();
-    }
-
-    /**
-     * Queries the Wikimedia API to determine if the specified user is listed on the identification noticeboard.
-     *
-     * @param string $onWikiName The Wikipedia username of the user
-     *
-     * @return bool
-     * @throws EnvironmentException
-     * @category Security-Critical
-     */
-    private function isIdentifiedOnWiki($onWikiName)
-    {
-        $strings = new StringFunctions();
-
-        // First character of Wikipedia usernames is always capitalized.
-        $onWikiName = $strings->upperCaseFirst($onWikiName);
-
-        $parameters = self::$apiQueryParameters;
-        $parameters['pltitles'] = "User:" . $onWikiName;
-        $parameters['titles'] = $this->siteConfiguration->getIdentificationNoticeboardPage();
-
-        try {
-            $endpoint = $this->siteConfiguration->getMetaWikimediaWebServiceEndpoint();
-            $response = $this->httpHelper->get($endpoint, $parameters);
-            $response = json_decode($response, true);
-        }
-        catch (CurlException $ex) {
-            // failed getting identification status, so throw a nicer error.
-            $message = 'Could not contact metawiki API to determine user\' identification status. '
-                . 'This is probably a transient error, so please try again.';
-
-            throw new EnvironmentException($message);
-        }
-
-        $page = @array_pop($response['query']['pages']);
-
-        return @$page['links'][0]['title'] === "User:" . $onWikiName;
-    }
+		$stmt = $this->dbObject->prepare($query);
+		$stmt->bindValue(':onwikiname', $onWikiName, PDO::PARAM_STR);
+		$stmt->execute();
+	}
+
+	/**
+	 * Queries the Wikimedia API to determine if the specified user is listed on the identification noticeboard.
+	 *
+	 * @param string $onWikiName The Wikipedia username of the user
+	 *
+	 * @return bool
+	 * @throws EnvironmentException
+	 * @category Security-Critical
+	 */
+	private function isIdentifiedOnWiki($onWikiName)
+	{
+		$strings = new StringFunctions();
+
+		// First character of Wikipedia usernames is always capitalized.
+		$onWikiName = $strings->upperCaseFirst($onWikiName);
+
+		$parameters = self::$apiQueryParameters;
+		$parameters['pltitles'] = "User:" . $onWikiName;
+		$parameters['titles'] = $this->siteConfiguration->getIdentificationNoticeboardPage();
+
+		try {
+			$endpoint = $this->siteConfiguration->getMetaWikimediaWebServiceEndpoint();
+			$response = $this->httpHelper->get($endpoint, $parameters);
+			$response = json_decode($response, true);
+		}
+		catch (CurlException $ex) {
+			// failed getting identification status, so throw a nicer error.
+			$message = 'Could not contact metawiki API to determine user\' identification status. '
+				. 'This is probably a transient error, so please try again.';
+
+			throw new EnvironmentException($message);
+		}
+
+		$page = @array_pop($response['query']['pages']);
+
+		return @$page['links'][0]['title'] === "User:" . $onWikiName;
+	}
 }

includes/Security/RoleConfiguration.php

Indentation +441 added lines, -441 removed lines

@@ -55,471 +55,471 @@
 
 class RoleConfiguration
 {
-    const ACCESS_ALLOW = 1;
-    const ACCESS_DENY = -1;
-    const ACCESS_DEFAULT = 0;
-    const MAIN = 'main';
-    const ALL = '*';
-    /**
-     * A map of roles to rights
-     *
-     * For example:
-     *
-     * array(
-     *   'myrole' => array(
-     *       PageMyPage::class => array(
-     *           'edit' => self::ACCESS_ALLOW,
-     *           'create' => self::ACCESS_DENY,
-     *       )
-     *   )
-     * )
-     *
-     * Note that DENY takes precedence over everything else when roles are combined, followed by ALLOW, followed by
-     * DEFAULT. Thus, if you have the following ([A]llow, [D]eny, [-] (default)) grants in different roles, this should
-     * be the expected result:
-     *
-     * - (-,-,-) = - (default because nothing to explicitly say allowed or denied equates to a denial)
-     * - (A,-,-) = A
-     * - (D,-,-) = D
-     * - (A,D,-) = D (deny takes precedence over allow)
-     * - (A,A,A) = A (repetition has no effect)
-     *
-     * The public role is special, and is applied to all users automatically. Avoid using deny on this role.
-     *
-     * @var array
-     */
-    private $roleConfig = array(
-        'public'            => array(
-            /*
+	const ACCESS_ALLOW = 1;
+	const ACCESS_DENY = -1;
+	const ACCESS_DEFAULT = 0;
+	const MAIN = 'main';
+	const ALL = '*';
+	/**
+	 * A map of roles to rights
+	 *
+	 * For example:
+	 *
+	 * array(
+	 *   'myrole' => array(
+	 *       PageMyPage::class => array(
+	 *           'edit' => self::ACCESS_ALLOW,
+	 *           'create' => self::ACCESS_DENY,
+	 *       )
+	 *   )
+	 * )
+	 *
+	 * Note that DENY takes precedence over everything else when roles are combined, followed by ALLOW, followed by
+	 * DEFAULT. Thus, if you have the following ([A]llow, [D]eny, [-] (default)) grants in different roles, this should
+	 * be the expected result:
+	 *
+	 * - (-,-,-) = - (default because nothing to explicitly say allowed or denied equates to a denial)
+	 * - (A,-,-) = A
+	 * - (D,-,-) = D
+	 * - (A,D,-) = D (deny takes precedence over allow)
+	 * - (A,A,A) = A (repetition has no effect)
+	 *
+	 * The public role is special, and is applied to all users automatically. Avoid using deny on this role.
+	 *
+	 * @var array
+	 */
+	private $roleConfig = array(
+		'public'            => array(
+			/*
              * THIS ROLE IS GRANTED TO ALL LOGGED *OUT* USERS IMPLICITLY.
              *
              * USERS IN THIS ROLE DO NOT HAVE TO BE IDENTIFIED TO GET THE RIGHTS CONFERRED HERE.
              * DO NOT ADD ANY SECURITY-SENSITIVE RIGHTS HERE.
              */
-            '_childRoles'   => array(
-                'publicStats',
-            ),
-            PageTeam::class => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageXffDemo::class        => array(
-                self::MAIN  => self::ACCESS_ALLOW,
-            )
-        ),
-        'loggedIn'          => array(
-            /*
+			'_childRoles'   => array(
+				'publicStats',
+			),
+			PageTeam::class => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageXffDemo::class        => array(
+				self::MAIN  => self::ACCESS_ALLOW,
+			)
+		),
+		'loggedIn'          => array(
+			/*
              * THIS ROLE IS GRANTED TO ALL LOGGED IN USERS IMPLICITLY.
              *
              * USERS IN THIS ROLE DO NOT HAVE TO BE IDENTIFIED TO GET THE RIGHTS CONFERRED HERE.
              * DO NOT ADD ANY SECURITY-SENSITIVE RIGHTS HERE.
              */
-            '_childRoles'             => array(
-                'public',
-            ),
-            PagePreferences::class    => array(
-                self::MAIN => self::ACCESS_ALLOW,
-                'refreshOAuth' => self::ACCESS_ALLOW,
-            ),
-            PageChangePassword::class => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageMultiFactor::class    => array(
-                self::MAIN          => self::ACCESS_ALLOW,
-                'scratch'           => self::ACCESS_ALLOW,
-                'enableYubikeyOtp'  => self::ACCESS_ALLOW,
-                'disableYubikeyOtp' => self::ACCESS_ALLOW,
-                'enableTotp'        => self::ACCESS_ALLOW,
-                'disableTotp'       => self::ACCESS_ALLOW,
-            ),
-            PageOAuth::class          => array(
-                'attach' => self::ACCESS_ALLOW,
-                'detach' => self::ACCESS_ALLOW,
-            ),
-            PageDomainSwitch::class   => array(
-                self::MAIN => self::ACCESS_ALLOW
-            )
-        ),
-        'user'              => array(
-            '_description'                       => 'A standard tool user.',
-            '_editableBy'                        => array('admin', 'toolRoot'),
-            '_childRoles'                        => array(
-                'internalStats',
-            ),
-            PageMain::class                      => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageBan::class                       => array(
-                self::MAIN => self::ACCESS_ALLOW,
-                'show'     => self::ACCESS_ALLOW,
-            ),
-            'BanVisibility'             => array(
-                'user' => self::ACCESS_ALLOW,
-            ),
-            'BanType'                   => array(
-                'ip' => self::ACCESS_ALLOW,
-                'name' => self::ACCESS_ALLOW,
-            ),
-            PageEditComment::class               => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageEmailManagement::class           => array(
-                self::MAIN => self::ACCESS_ALLOW,
-                'view'     => self::ACCESS_ALLOW,
-            ),
-            PageExpandedRequestList::class       => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageLog::class                       => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageSearch::class                    => array(
-                self::MAIN => self::ACCESS_ALLOW,
-                'byName'   => self::ACCESS_ALLOW,
-                'byEmail'  => self::ACCESS_ALLOW,
-                'byIp'     => self::ACCESS_ALLOW,
-                'allowNonConfirmed' => self::ACCESS_ALLOW,
-            ),
-            PageWelcomeTemplateManagement::class => array(
-                self::MAIN => self::ACCESS_ALLOW,
-                'select'   => self::ACCESS_ALLOW,
-                'view'     => self::ACCESS_ALLOW,
-            ),
-            PageViewRequest::class               => array(
-                self::MAIN       => self::ACCESS_ALLOW,
-                'seeAllRequests' => self::ACCESS_ALLOW,
-            ),
-            'RequestData'                        => array(
-                'seePrivateDataWhenReserved' => self::ACCESS_ALLOW,
-                'seePrivateDataWithHash'     => self::ACCESS_ALLOW,
-                'seeRelatedRequests'         => self::ACCESS_ALLOW,
-            ),
-            PageCustomClose::class               => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageComment::class                   => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageFlagComment::class               => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageCloseRequest::class              => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageCreateRequest::class             => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageDeferRequest::class              => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageDropRequest::class               => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageReservation::class               => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageSendToUser::class                => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageBreakReservation::class          => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageJobQueue::class                  => array(
-                self::MAIN    => self::ACCESS_ALLOW,
-                'view'        => self::ACCESS_ALLOW,
-                'all'         => self::ACCESS_ALLOW,
-                'acknowledge' => self::ACCESS_ALLOW,
-                'cancel'      => self::ACCESS_ALLOW
-            ),
-            PageDomainManagement::class          => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageRequestFormManagement::class     => array(
-                self::MAIN => self::ACCESS_ALLOW,
-                'view'     => self::ACCESS_ALLOW,
-                'preview'  => self::ACCESS_ALLOW,
-            ),
-            'RequestCreation'                    => array(
-                User::CREATION_MANUAL => self::ACCESS_ALLOW,
-                User::CREATION_OAUTH  => self::ACCESS_ALLOW,
-            ),
-            'GlobalInfo'                         => array(
-                'viewSiteNotice' => self::ACCESS_ALLOW,
-                'viewOnlineUsers' => self::ACCESS_ALLOW,
-            ),
-        ),
-        'admin'             => array(
-            '_description'                       => 'A tool administrator.',
-            '_editableBy'                        => array('admin', 'toolRoot'),
-            '_childRoles'                        => array(
-                'user',
-                'requestAdminTools',
-            ),
-            PageEmailManagement::class           => array(
-                'edit'   => self::ACCESS_ALLOW,
-                'create' => self::ACCESS_ALLOW,
-            ),
-            PageSiteNotice::class                => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageUserManagement::class            => array(
-                self::MAIN  => self::ACCESS_ALLOW,
-                'approve'   => self::ACCESS_ALLOW,
-                'decline'   => self::ACCESS_ALLOW,
-                'rename'    => self::ACCESS_ALLOW,
-                'editUser'  => self::ACCESS_ALLOW,
-                'suspend'   => self::ACCESS_ALLOW,
-                'editRoles' => self::ACCESS_ALLOW,
-            ),
-            PageSearch::class                    => array(
-                'byComment' => self::ACCESS_ALLOW,
-            ),
-            PageManuallyConfirm::class               => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            PageWelcomeTemplateManagement::class => array(
-                'edit'   => self::ACCESS_ALLOW,
-                'delete' => self::ACCESS_ALLOW,
-                'add'    => self::ACCESS_ALLOW,
-            ),
-            PageJobQueue::class                  => array(
-                'acknowledge' => self::ACCESS_ALLOW,
-                'requeue'     => self::ACCESS_ALLOW,
-                'cancel'      => self::ACCESS_ALLOW,
-            ),
-            'RequestData'               => array(
-                'reopenClearedRequest'  => self::ACCESS_ALLOW,
-            ),
-            PageQueueManagement::class           => array(
-                self::MAIN => self::ACCESS_ALLOW,
-                'edit'     => self::ACCESS_ALLOW,
-                'create'   => self::ACCESS_ALLOW,
-            ),
-            PageRequestFormManagement::class     => array(
-                'edit'     => self::ACCESS_ALLOW,
-                'create'   => self::ACCESS_ALLOW,
-            ),
-            PageDomainManagement::class          => array(
-                'edit'     => self::ACCESS_ALLOW,
-            ),
-        ),
-        'checkuser'         => array(
-            '_description'            => 'A user with CheckUser access',
-            '_editableBy'             => array('checkuser', 'toolRoot'),
-            '_childRoles'             => array(
-                'user',
-                'requestAdminTools',
-            ),
-            PageUserManagement::class => array(
-                self::MAIN  => self::ACCESS_ALLOW,
-                'suspend'   => self::ACCESS_ALLOW,
-                'editRoles' => self::ACCESS_ALLOW,
-            ),
-            'RequestData'             => array(
-                'seeUserAgentData'      => self::ACCESS_ALLOW,
-                'seeCheckuserComments'  => self::ACCESS_ALLOW,
-                'createLocalAccount'    => self::ACCESS_ALLOW,
-            ),
-            'BanType'                   => array(
-                'useragent' => self::ACCESS_ALLOW,
-            ),
-            'BanVisibility'             => array(
-                'checkuser' => self::ACCESS_ALLOW,
-            ),
-        ),
-        'toolRoot'          => array(
-            '_description' => 'A user with shell access to the servers running the tool',
-            '_editableBy'  => array('toolRoot'),
-            '_childRoles'  => array(
-                'admin',
-            ),
-            'BanType'                   => array(
-                'ip-largerange' => self::ACCESS_ALLOW,
-            ),
-            PageMultiFactor::class => array(
-                'enableU2F'         => self::ACCESS_ALLOW,
-                'disableU2F'        => self::ACCESS_ALLOW,
-            ),
-            PageDomainManagement::class => array(
-                self::MAIN => self::ACCESS_ALLOW,
-                'editAll'  => self::ACCESS_ALLOW,
-                'edit'     => self::ACCESS_ALLOW,
-                'create'   => self::ACCESS_ALLOW,
-            ),
-            PageErrorLogViewer::class => array(
-                self::MAIN      => self::ACCESS_ALLOW,
-                'view'          => self::ACCESS_ALLOW,
-                'remove'        => self::ACCESS_ALLOW,
-            ),
-        ),
-        'botCreation'       => array(
-            '_description'    => 'A user allowed to use the bot to perform account creations',
-            '_editableBy'     => array('admin', 'toolRoot'),
-            '_childRoles'     => array(),
-            'RequestCreation' => array(
-                User::CREATION_BOT => self::ACCESS_ALLOW,
-            ),
-        ),
+			'_childRoles'             => array(
+				'public',
+			),
+			PagePreferences::class    => array(
+				self::MAIN => self::ACCESS_ALLOW,
+				'refreshOAuth' => self::ACCESS_ALLOW,
+			),
+			PageChangePassword::class => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageMultiFactor::class    => array(
+				self::MAIN          => self::ACCESS_ALLOW,
+				'scratch'           => self::ACCESS_ALLOW,
+				'enableYubikeyOtp'  => self::ACCESS_ALLOW,
+				'disableYubikeyOtp' => self::ACCESS_ALLOW,
+				'enableTotp'        => self::ACCESS_ALLOW,
+				'disableTotp'       => self::ACCESS_ALLOW,
+			),
+			PageOAuth::class          => array(
+				'attach' => self::ACCESS_ALLOW,
+				'detach' => self::ACCESS_ALLOW,
+			),
+			PageDomainSwitch::class   => array(
+				self::MAIN => self::ACCESS_ALLOW
+			)
+		),
+		'user'              => array(
+			'_description'                       => 'A standard tool user.',
+			'_editableBy'                        => array('admin', 'toolRoot'),
+			'_childRoles'                        => array(
+				'internalStats',
+			),
+			PageMain::class                      => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageBan::class                       => array(
+				self::MAIN => self::ACCESS_ALLOW,
+				'show'     => self::ACCESS_ALLOW,
+			),
+			'BanVisibility'             => array(
+				'user' => self::ACCESS_ALLOW,
+			),
+			'BanType'                   => array(
+				'ip' => self::ACCESS_ALLOW,
+				'name' => self::ACCESS_ALLOW,
+			),
+			PageEditComment::class               => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageEmailManagement::class           => array(
+				self::MAIN => self::ACCESS_ALLOW,
+				'view'     => self::ACCESS_ALLOW,
+			),
+			PageExpandedRequestList::class       => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageLog::class                       => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageSearch::class                    => array(
+				self::MAIN => self::ACCESS_ALLOW,
+				'byName'   => self::ACCESS_ALLOW,
+				'byEmail'  => self::ACCESS_ALLOW,
+				'byIp'     => self::ACCESS_ALLOW,
+				'allowNonConfirmed' => self::ACCESS_ALLOW,
+			),
+			PageWelcomeTemplateManagement::class => array(
+				self::MAIN => self::ACCESS_ALLOW,
+				'select'   => self::ACCESS_ALLOW,
+				'view'     => self::ACCESS_ALLOW,
+			),
+			PageViewRequest::class               => array(
+				self::MAIN       => self::ACCESS_ALLOW,
+				'seeAllRequests' => self::ACCESS_ALLOW,
+			),
+			'RequestData'                        => array(
+				'seePrivateDataWhenReserved' => self::ACCESS_ALLOW,
+				'seePrivateDataWithHash'     => self::ACCESS_ALLOW,
+				'seeRelatedRequests'         => self::ACCESS_ALLOW,
+			),
+			PageCustomClose::class               => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageComment::class                   => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageFlagComment::class               => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageCloseRequest::class              => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageCreateRequest::class             => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageDeferRequest::class              => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageDropRequest::class               => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageReservation::class               => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageSendToUser::class                => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageBreakReservation::class          => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageJobQueue::class                  => array(
+				self::MAIN    => self::ACCESS_ALLOW,
+				'view'        => self::ACCESS_ALLOW,
+				'all'         => self::ACCESS_ALLOW,
+				'acknowledge' => self::ACCESS_ALLOW,
+				'cancel'      => self::ACCESS_ALLOW
+			),
+			PageDomainManagement::class          => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageRequestFormManagement::class     => array(
+				self::MAIN => self::ACCESS_ALLOW,
+				'view'     => self::ACCESS_ALLOW,
+				'preview'  => self::ACCESS_ALLOW,
+			),
+			'RequestCreation'                    => array(
+				User::CREATION_MANUAL => self::ACCESS_ALLOW,
+				User::CREATION_OAUTH  => self::ACCESS_ALLOW,
+			),
+			'GlobalInfo'                         => array(
+				'viewSiteNotice' => self::ACCESS_ALLOW,
+				'viewOnlineUsers' => self::ACCESS_ALLOW,
+			),
+		),
+		'admin'             => array(
+			'_description'                       => 'A tool administrator.',
+			'_editableBy'                        => array('admin', 'toolRoot'),
+			'_childRoles'                        => array(
+				'user',
+				'requestAdminTools',
+			),
+			PageEmailManagement::class           => array(
+				'edit'   => self::ACCESS_ALLOW,
+				'create' => self::ACCESS_ALLOW,
+			),
+			PageSiteNotice::class                => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageUserManagement::class            => array(
+				self::MAIN  => self::ACCESS_ALLOW,
+				'approve'   => self::ACCESS_ALLOW,
+				'decline'   => self::ACCESS_ALLOW,
+				'rename'    => self::ACCESS_ALLOW,
+				'editUser'  => self::ACCESS_ALLOW,
+				'suspend'   => self::ACCESS_ALLOW,
+				'editRoles' => self::ACCESS_ALLOW,
+			),
+			PageSearch::class                    => array(
+				'byComment' => self::ACCESS_ALLOW,
+			),
+			PageManuallyConfirm::class               => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			PageWelcomeTemplateManagement::class => array(
+				'edit'   => self::ACCESS_ALLOW,
+				'delete' => self::ACCESS_ALLOW,
+				'add'    => self::ACCESS_ALLOW,
+			),
+			PageJobQueue::class                  => array(
+				'acknowledge' => self::ACCESS_ALLOW,
+				'requeue'     => self::ACCESS_ALLOW,
+				'cancel'      => self::ACCESS_ALLOW,
+			),
+			'RequestData'               => array(
+				'reopenClearedRequest'  => self::ACCESS_ALLOW,
+			),
+			PageQueueManagement::class           => array(
+				self::MAIN => self::ACCESS_ALLOW,
+				'edit'     => self::ACCESS_ALLOW,
+				'create'   => self::ACCESS_ALLOW,
+			),
+			PageRequestFormManagement::class     => array(
+				'edit'     => self::ACCESS_ALLOW,
+				'create'   => self::ACCESS_ALLOW,
+			),
+			PageDomainManagement::class          => array(
+				'edit'     => self::ACCESS_ALLOW,
+			),
+		),
+		'checkuser'         => array(
+			'_description'            => 'A user with CheckUser access',
+			'_editableBy'             => array('checkuser', 'toolRoot'),
+			'_childRoles'             => array(
+				'user',
+				'requestAdminTools',
+			),
+			PageUserManagement::class => array(
+				self::MAIN  => self::ACCESS_ALLOW,
+				'suspend'   => self::ACCESS_ALLOW,
+				'editRoles' => self::ACCESS_ALLOW,
+			),
+			'RequestData'             => array(
+				'seeUserAgentData'      => self::ACCESS_ALLOW,
+				'seeCheckuserComments'  => self::ACCESS_ALLOW,
+				'createLocalAccount'    => self::ACCESS_ALLOW,
+			),
+			'BanType'                   => array(
+				'useragent' => self::ACCESS_ALLOW,
+			),
+			'BanVisibility'             => array(
+				'checkuser' => self::ACCESS_ALLOW,
+			),
+		),
+		'toolRoot'          => array(
+			'_description' => 'A user with shell access to the servers running the tool',
+			'_editableBy'  => array('toolRoot'),
+			'_childRoles'  => array(
+				'admin',
+			),
+			'BanType'                   => array(
+				'ip-largerange' => self::ACCESS_ALLOW,
+			),
+			PageMultiFactor::class => array(
+				'enableU2F'         => self::ACCESS_ALLOW,
+				'disableU2F'        => self::ACCESS_ALLOW,
+			),
+			PageDomainManagement::class => array(
+				self::MAIN => self::ACCESS_ALLOW,
+				'editAll'  => self::ACCESS_ALLOW,
+				'edit'     => self::ACCESS_ALLOW,
+				'create'   => self::ACCESS_ALLOW,
+			),
+			PageErrorLogViewer::class => array(
+				self::MAIN      => self::ACCESS_ALLOW,
+				'view'          => self::ACCESS_ALLOW,
+				'remove'        => self::ACCESS_ALLOW,
+			),
+		),
+		'botCreation'       => array(
+			'_description'    => 'A user allowed to use the bot to perform account creations',
+			'_editableBy'     => array('admin', 'toolRoot'),
+			'_childRoles'     => array(),
+			'RequestCreation' => array(
+				User::CREATION_BOT => self::ACCESS_ALLOW,
+			),
+		),
 
-        // Child roles go below this point
-        'publicStats'       => array(
-            '_hidden'               => true,
-            StatsUsers::class       => array(
-                self::MAIN => self::ACCESS_ALLOW,
-                'detail'   => self::ACCESS_ALLOW,
-            ),
-            StatsTopCreators::class => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            StatsMonthlyStats::class     => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-        ),
-        'internalStats'     => array(
-            '_hidden'                    => true,
-            StatsMain::class             => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            StatsFastCloses::class       => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            StatsInactiveUsers::class    => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            StatsReservedRequests::class => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            StatsTemplateStats::class    => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-        ),
-        'requestAdminTools' => array(
-            '_hidden'                   => true,
-            PageBan::class              => array(
-                self::MAIN => self::ACCESS_ALLOW,
-                'set'      => self::ACCESS_ALLOW,
-                'remove'   => self::ACCESS_ALLOW,
-            ),
-            'BanType'                   => array(
-                'ip' => self::ACCESS_ALLOW,
-                'email' => self::ACCESS_ALLOW,
-                'name' => self::ACCESS_ALLOW,
-            ),
-            'BanVisibility'             => array(
-                'user' => self::ACCESS_ALLOW,
-                'admin' => self::ACCESS_ALLOW,
-            ),
-            PageEditComment::class      => array(
-                'editOthers' => self::ACCESS_ALLOW,
-            ),
-            PageBreakReservation::class => array(
-                'force' => self::ACCESS_ALLOW,
-            ),
-            PageCustomClose::class      => array(
-                'skipCcMailingList' => self::ACCESS_ALLOW,
-            ),
-            PageFlagComment::class      => array(
-                'unflag'   => self::ACCESS_ALLOW,
-            ),
-            PageListFlaggedComments::class => array(
-                self::MAIN => self::ACCESS_ALLOW,
-            ),
-            'RequestData'               => array(
-                'reopenOldRequest'      => self::ACCESS_ALLOW,
-                'alwaysSeePrivateData'  => self::ACCESS_ALLOW,
-                'alwaysSeeHash'         => self::ACCESS_ALLOW,
-                'seeRestrictedComments' => self::ACCESS_ALLOW,
-            ),
-        ),
-    );
-    /** @var array
-     * List of roles which are *exempt* from the identification requirements
-     *
-     * Think twice about adding roles to this list.
-     *
-     * @category Security-Critical
-     */
-    private $identificationExempt = array('public', 'loggedIn');
+		// Child roles go below this point
+		'publicStats'       => array(
+			'_hidden'               => true,
+			StatsUsers::class       => array(
+				self::MAIN => self::ACCESS_ALLOW,
+				'detail'   => self::ACCESS_ALLOW,
+			),
+			StatsTopCreators::class => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			StatsMonthlyStats::class     => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+		),
+		'internalStats'     => array(
+			'_hidden'                    => true,
+			StatsMain::class             => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			StatsFastCloses::class       => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			StatsInactiveUsers::class    => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			StatsReservedRequests::class => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			StatsTemplateStats::class    => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+		),
+		'requestAdminTools' => array(
+			'_hidden'                   => true,
+			PageBan::class              => array(
+				self::MAIN => self::ACCESS_ALLOW,
+				'set'      => self::ACCESS_ALLOW,
+				'remove'   => self::ACCESS_ALLOW,
+			),
+			'BanType'                   => array(
+				'ip' => self::ACCESS_ALLOW,
+				'email' => self::ACCESS_ALLOW,
+				'name' => self::ACCESS_ALLOW,
+			),
+			'BanVisibility'             => array(
+				'user' => self::ACCESS_ALLOW,
+				'admin' => self::ACCESS_ALLOW,
+			),
+			PageEditComment::class      => array(
+				'editOthers' => self::ACCESS_ALLOW,
+			),
+			PageBreakReservation::class => array(
+				'force' => self::ACCESS_ALLOW,
+			),
+			PageCustomClose::class      => array(
+				'skipCcMailingList' => self::ACCESS_ALLOW,
+			),
+			PageFlagComment::class      => array(
+				'unflag'   => self::ACCESS_ALLOW,
+			),
+			PageListFlaggedComments::class => array(
+				self::MAIN => self::ACCESS_ALLOW,
+			),
+			'RequestData'               => array(
+				'reopenOldRequest'      => self::ACCESS_ALLOW,
+				'alwaysSeePrivateData'  => self::ACCESS_ALLOW,
+				'alwaysSeeHash'         => self::ACCESS_ALLOW,
+				'seeRestrictedComments' => self::ACCESS_ALLOW,
+			),
+		),
+	);
+	/** @var array
+	 * List of roles which are *exempt* from the identification requirements
+	 *
+	 * Think twice about adding roles to this list.
+	 *
+	 * @category Security-Critical
+	 */
+	private $identificationExempt = array('public', 'loggedIn');
 
-    /**
-     * RoleConfiguration constructor.
-     *
-     * @param array $roleConfig           Set to non-null to override the default configuration.
-     * @param array $identificationExempt Set to non-null to override the default configuration.
-     */
-    public function __construct(array $roleConfig = null, array $identificationExempt = null)
-    {
-        if ($roleConfig !== null) {
-            $this->roleConfig = $roleConfig;
-        }
+	/**
+	 * RoleConfiguration constructor.
+	 *
+	 * @param array $roleConfig           Set to non-null to override the default configuration.
+	 * @param array $identificationExempt Set to non-null to override the default configuration.
+	 */
+	public function __construct(array $roleConfig = null, array $identificationExempt = null)
+	{
+		if ($roleConfig !== null) {
+			$this->roleConfig = $roleConfig;
+		}
 
-        if ($identificationExempt !== null) {
-            $this->identificationExempt = $identificationExempt;
-        }
-    }
+		if ($identificationExempt !== null) {
+			$this->identificationExempt = $identificationExempt;
+		}
+	}
 
-    /**
-     * @param array $roles The roles to check
-     *
-     * @return array
-     */
-    public function getApplicableRoles(array $roles)
-    {
-        $available = array();
+	/**
+	 * @param array $roles The roles to check
+	 *
+	 * @return array
+	 */
+	public function getApplicableRoles(array $roles)
+	{
+		$available = array();
 
-        foreach ($roles as $role) {
-            if (!isset($this->roleConfig[$role])) {
-                // wat
-                continue;
-            }
+		foreach ($roles as $role) {
+			if (!isset($this->roleConfig[$role])) {
+				// wat
+				continue;
+			}
 
-            $available[$role] = $this->roleConfig[$role];
+			$available[$role] = $this->roleConfig[$role];
 
-            if (isset($available[$role]['_childRoles'])) {
-                $childRoles = $this->getApplicableRoles($available[$role]['_childRoles']);
-                $available = array_merge($available, $childRoles);
+			if (isset($available[$role]['_childRoles'])) {
+				$childRoles = $this->getApplicableRoles($available[$role]['_childRoles']);
+				$available = array_merge($available, $childRoles);
 
-                unset($available[$role]['_childRoles']);
-            }
+				unset($available[$role]['_childRoles']);
+			}
 
-            foreach (array('_hidden', '_editableBy', '_description') as $item) {
-                if (isset($available[$role][$item])) {
-                    unset($available[$role][$item]);
-                }
-            }
-        }
+			foreach (array('_hidden', '_editableBy', '_description') as $item) {
+				if (isset($available[$role][$item])) {
+					unset($available[$role][$item]);
+				}
+			}
+		}
 
-        return $available;
-    }
+		return $available;
+	}
 
-    public function getAvailableRoles()
-    {
-        $possible = array_diff(array_keys($this->roleConfig), array('public', 'loggedIn'));
+	public function getAvailableRoles()
+	{
+		$possible = array_diff(array_keys($this->roleConfig), array('public', 'loggedIn'));
 
-        $actual = array();
+		$actual = array();
 
-        foreach ($possible as $role) {
-            if (!isset($this->roleConfig[$role]['_hidden'])) {
-                $actual[$role] = array(
-                    'description' => $this->roleConfig[$role]['_description'],
-                    'editableBy'  => $this->roleConfig[$role]['_editableBy'],
-                );
-            }
-        }
+		foreach ($possible as $role) {
+			if (!isset($this->roleConfig[$role]['_hidden'])) {
+				$actual[$role] = array(
+					'description' => $this->roleConfig[$role]['_description'],
+					'editableBy'  => $this->roleConfig[$role]['_editableBy'],
+				);
+			}
+		}
 
-        return $actual;
-    }
+		return $actual;
+	}
 
-    /**
-     * @param string $role
-     *
-     * @return bool
-     */
-    public function roleNeedsIdentification($role)
-    {
-        if (in_array($role, $this->identificationExempt)) {
-            return false;
-        }
+	/**
+	 * @param string $role
+	 *
+	 * @return bool
+	 */
+	public function roleNeedsIdentification($role)
+	{
+		if (in_array($role, $this->identificationExempt)) {
+			return false;
+		}
 
-        return true;
-    }
+		return true;
+	}
 }

includes/Security/SecurityManager.php

Indentation +214 added lines, -214 removed lines

@@ -14,218 +14,218 @@
 
 final class SecurityManager
 {
-    const ALLOWED = 1;
-    const ERROR_NOT_IDENTIFIED = 2;
-    const ERROR_DENIED = 3;
-    /** @var IdentificationVerifier */
-    private $identificationVerifier;
-    /**
-     * @var RoleConfiguration
-     */
-    private $roleConfiguration;
-
-    private $cache = [];
-
-    /**
-     * SecurityManager constructor.
-     *
-     * @param IdentificationVerifier $identificationVerifier
-     * @param RoleConfiguration      $roleConfiguration
-     */
-    public function __construct(
-        IdentificationVerifier $identificationVerifier,
-        RoleConfiguration $roleConfiguration
-    ) {
-        $this->identificationVerifier = $identificationVerifier;
-        $this->roleConfiguration = $roleConfiguration;
-    }
-
-    /**
-     * Tests if a user is allowed to perform an action.
-     *
-     * This method should form a hard, deterministic security barrier, and only return true if it is absolutely sure
-     * that a user should have access to something.
-     *
-     * @param string $page
-     * @param string $route
-     * @param User   $user
-     *
-     * @return int
-     *
-     * @category Security-Critical
-     */
-    public function allows($page, $route, User $user)
-    {
-        $this->getCachedActiveRoles($user, $activeRoles, $inactiveRoles);
-
-        $availableRights = $this->flattenRoles($activeRoles);
-        $testResult = $this->findResult($availableRights, $page, $route);
-
-        if ($testResult !== null) {
-            // We got a firm result here, so just return it.
-            return $testResult;
-        }
-
-        // No firm result yet, so continue testing the inactive roles so we can give a better error.
-        $inactiveRights = $this->flattenRoles($inactiveRoles);
-        $testResult = $this->findResult($inactiveRights, $page, $route);
-
-        if ($testResult === self::ALLOWED) {
-            // The user is allowed to access this, but their role is inactive.
-            return self::ERROR_NOT_IDENTIFIED;
-        }
-
-        // Other options from the secondary test are denied and inconclusive, which at this point defaults to denied.
-        return self::ERROR_DENIED;
-    }
-
-    /**
-     * @param array  $pseudoRole The role (flattened) to check
-     * @param string $page       The page class to check
-     * @param string $route      The page route to check
-     *
-     * @return int|null
-     */
-    private function findResult($pseudoRole, $page, $route)
-    {
-        if (isset($pseudoRole[$page])) {
-            // check for deny on catch-all route
-            if (isset($pseudoRole[$page][RoleConfiguration::ALL])) {
-                if ($pseudoRole[$page][RoleConfiguration::ALL] === RoleConfiguration::ACCESS_DENY) {
-                    return self::ERROR_DENIED;
-                }
-            }
-
-            // check normal route
-            if (isset($pseudoRole[$page][$route])) {
-                if ($pseudoRole[$page][$route] === RoleConfiguration::ACCESS_DENY) {
-                    return self::ERROR_DENIED;
-                }
-
-                if ($pseudoRole[$page][$route] === RoleConfiguration::ACCESS_ALLOW) {
-                    return self::ALLOWED;
-                }
-            }
-
-            // check for allowed on catch-all route
-            if (isset($pseudoRole[$page][RoleConfiguration::ALL])) {
-                if ($pseudoRole[$page][RoleConfiguration::ALL] === RoleConfiguration::ACCESS_ALLOW) {
-                    return self::ALLOWED;
-                }
-            }
-        }
-
-        // return indeterminate result
-        return null;
-    }
-
-    /**
-     * Takes an array of roles and flattens the values to a single set.
-     *
-     * @param array $activeRoles
-     *
-     * @return array
-     */
-    private function flattenRoles($activeRoles)
-    {
-        $result = array();
-
-        $roleConfig = $this->roleConfiguration->getApplicableRoles($activeRoles);
-
-        // Iterate over every page in every role
-        foreach ($roleConfig as $role) {
-            foreach ($role as $page => $pageRights) {
-                // Create holder in result for this page
-                if (!isset($result[$page])) {
-                    $result[$page] = array();
-                }
-
-                foreach ($pageRights as $action => $permission) {
-                    // Deny takes precedence, so if it's set, don't change it.
-                    if (isset($result[$page][$action])) {
-                        if ($result[$page][$action] === RoleConfiguration::ACCESS_DENY) {
-                            continue;
-                        }
-                    }
-
-                    if ($permission === RoleConfiguration::ACCESS_DEFAULT) {
-                        // Configured to do precisely nothing.
-                        continue;
-                    }
-
-                    $result[$page][$action] = $permission;
-                }
-            }
-        }
-
-        return $result;
-    }
-
-    /**
-     * @param User  $user
-     * @param array $activeRoles
-     * @param array $inactiveRoles
-     */
-    public function getActiveRoles(User $user, &$activeRoles, &$inactiveRoles)
-    {
-        // Default to the community user here, because the main user is logged out
-        $identified = false;
-        $userRoles = array('public');
-
-        // if we're not the community user, get our real rights.
-        if (!$user->isCommunityUser()) {
-            // Check the user's status - only active users are allowed the effects of roles
-
-            $userRoles[] = 'loggedIn';
-
-            if ($user->isActive()) {
-                $ur = UserRole::getForUser($user->getId(), $user->getDatabase());
-
-                // NOTE: public is still in this array.
-                foreach ($ur as $r) {
-                    $userRoles[] = $r->getRole();
-                }
-
-                $identified = $user->isIdentified($this->identificationVerifier);
-            }
-        }
-
-        $activeRoles = array();
-        $inactiveRoles = array();
-
-        foreach ($userRoles as $v) {
-            if ($this->roleConfiguration->roleNeedsIdentification($v)) {
-                if ($identified) {
-                    $activeRoles[] = $v;
-                }
-                else {
-                    $inactiveRoles[] = $v;
-                }
-            }
-            else {
-                $activeRoles[] = $v;
-            }
-        }
-    }
-
-    /**
-     * @param User  $user
-     * @param array $activeRoles
-     * @param array $inactiveRoles
-     */
-    public function getCachedActiveRoles(User $user, &$activeRoles, &$inactiveRoles)
-    {
-        if (!array_key_exists($user->getId(), $this->cache)) {
-            $this->getActiveRoles($user, $retrievedActiveRoles, $retrievedInactiveRoles);
-            $this->cache[$user->getId()] = ['active' => $retrievedActiveRoles, 'inactive' => $retrievedInactiveRoles];
-        }
-
-        $activeRoles = $this->cache[$user->getId()]['active'];
-        $inactiveRoles = $this->cache[$user->getId()]['inactive'];
-    }
-
-    public function getRoleConfiguration()
-    {
-        return $this->roleConfiguration;
-    }
+	const ALLOWED = 1;
+	const ERROR_NOT_IDENTIFIED = 2;
+	const ERROR_DENIED = 3;
+	/** @var IdentificationVerifier */
+	private $identificationVerifier;
+	/**
+	 * @var RoleConfiguration
+	 */
+	private $roleConfiguration;
+
+	private $cache = [];
+
+	/**
+	 * SecurityManager constructor.
+	 *
+	 * @param IdentificationVerifier $identificationVerifier
+	 * @param RoleConfiguration      $roleConfiguration
+	 */
+	public function __construct(
+		IdentificationVerifier $identificationVerifier,
+		RoleConfiguration $roleConfiguration
+	) {
+		$this->identificationVerifier = $identificationVerifier;
+		$this->roleConfiguration = $roleConfiguration;
+	}
+
+	/**
+	 * Tests if a user is allowed to perform an action.
+	 *
+	 * This method should form a hard, deterministic security barrier, and only return true if it is absolutely sure
+	 * that a user should have access to something.
+	 *
+	 * @param string $page
+	 * @param string $route
+	 * @param User   $user
+	 *
+	 * @return int
+	 *
+	 * @category Security-Critical
+	 */
+	public function allows($page, $route, User $user)
+	{
+		$this->getCachedActiveRoles($user, $activeRoles, $inactiveRoles);
+
+		$availableRights = $this->flattenRoles($activeRoles);
+		$testResult = $this->findResult($availableRights, $page, $route);
+
+		if ($testResult !== null) {
+			// We got a firm result here, so just return it.
+			return $testResult;
+		}
+
+		// No firm result yet, so continue testing the inactive roles so we can give a better error.
+		$inactiveRights = $this->flattenRoles($inactiveRoles);
+		$testResult = $this->findResult($inactiveRights, $page, $route);
+
+		if ($testResult === self::ALLOWED) {
+			// The user is allowed to access this, but their role is inactive.
+			return self::ERROR_NOT_IDENTIFIED;
+		}
+
+		// Other options from the secondary test are denied and inconclusive, which at this point defaults to denied.
+		return self::ERROR_DENIED;
+	}
+
+	/**
+	 * @param array  $pseudoRole The role (flattened) to check
+	 * @param string $page       The page class to check
+	 * @param string $route      The page route to check
+	 *
+	 * @return int|null
+	 */
+	private function findResult($pseudoRole, $page, $route)
+	{
+		if (isset($pseudoRole[$page])) {
+			// check for deny on catch-all route
+			if (isset($pseudoRole[$page][RoleConfiguration::ALL])) {
+				if ($pseudoRole[$page][RoleConfiguration::ALL] === RoleConfiguration::ACCESS_DENY) {
+					return self::ERROR_DENIED;
+				}
+			}
+
+			// check normal route
+			if (isset($pseudoRole[$page][$route])) {
+				if ($pseudoRole[$page][$route] === RoleConfiguration::ACCESS_DENY) {
+					return self::ERROR_DENIED;
+				}
+
+				if ($pseudoRole[$page][$route] === RoleConfiguration::ACCESS_ALLOW) {
+					return self::ALLOWED;
+				}
+			}
+
+			// check for allowed on catch-all route
+			if (isset($pseudoRole[$page][RoleConfiguration::ALL])) {
+				if ($pseudoRole[$page][RoleConfiguration::ALL] === RoleConfiguration::ACCESS_ALLOW) {
+					return self::ALLOWED;
+				}
+			}
+		}
+
+		// return indeterminate result
+		return null;
+	}
+
+	/**
+	 * Takes an array of roles and flattens the values to a single set.
+	 *
+	 * @param array $activeRoles
+	 *
+	 * @return array
+	 */
+	private function flattenRoles($activeRoles)
+	{
+		$result = array();
+
+		$roleConfig = $this->roleConfiguration->getApplicableRoles($activeRoles);
+
+		// Iterate over every page in every role
+		foreach ($roleConfig as $role) {
+			foreach ($role as $page => $pageRights) {
+				// Create holder in result for this page
+				if (!isset($result[$page])) {
+					$result[$page] = array();
+				}
+
+				foreach ($pageRights as $action => $permission) {
+					// Deny takes precedence, so if it's set, don't change it.
+					if (isset($result[$page][$action])) {
+						if ($result[$page][$action] === RoleConfiguration::ACCESS_DENY) {
+							continue;
+						}
+					}
+
+					if ($permission === RoleConfiguration::ACCESS_DEFAULT) {
+						// Configured to do precisely nothing.
+						continue;
+					}
+
+					$result[$page][$action] = $permission;
+				}
+			}
+		}
+
+		return $result;
+	}
+
+	/**
+	 * @param User  $user
+	 * @param array $activeRoles
+	 * @param array $inactiveRoles
+	 */
+	public function getActiveRoles(User $user, &$activeRoles, &$inactiveRoles)
+	{
+		// Default to the community user here, because the main user is logged out
+		$identified = false;
+		$userRoles = array('public');
+
+		// if we're not the community user, get our real rights.
+		if (!$user->isCommunityUser()) {
+			// Check the user's status - only active users are allowed the effects of roles
+
+			$userRoles[] = 'loggedIn';
+
+			if ($user->isActive()) {
+				$ur = UserRole::getForUser($user->getId(), $user->getDatabase());
+
+				// NOTE: public is still in this array.
+				foreach ($ur as $r) {
+					$userRoles[] = $r->getRole();
+				}
+
+				$identified = $user->isIdentified($this->identificationVerifier);
+			}
+		}
+
+		$activeRoles = array();
+		$inactiveRoles = array();
+
+		foreach ($userRoles as $v) {
+			if ($this->roleConfiguration->roleNeedsIdentification($v)) {
+				if ($identified) {
+					$activeRoles[] = $v;
+				}
+				else {
+					$inactiveRoles[] = $v;
+				}
+			}
+			else {
+				$activeRoles[] = $v;
+			}
+		}
+	}
+
+	/**
+	 * @param User  $user
+	 * @param array $activeRoles
+	 * @param array $inactiveRoles
+	 */
+	public function getCachedActiveRoles(User $user, &$activeRoles, &$inactiveRoles)
+	{
+		if (!array_key_exists($user->getId(), $this->cache)) {
+			$this->getActiveRoles($user, $retrievedActiveRoles, $retrievedInactiveRoles);
+			$this->cache[$user->getId()] = ['active' => $retrievedActiveRoles, 'inactive' => $retrievedInactiveRoles];
+		}
+
+		$activeRoles = $this->cache[$user->getId()]['active'];
+		$inactiveRoles = $this->cache[$user->getId()]['inactive'];
+	}
+
+	public function getRoleConfiguration()
+	{
+		return $this->roleConfiguration;
+	}
 }

includes/Security/DomainAccessManager.php

Indentation +50 added lines, -50 removed lines

@@ -16,61 +16,61 @@
 
 class DomainAccessManager
 {
-    /**
-     * @var SecurityManager
-     */
-    private $securityManager;
+	/**
+	 * @var SecurityManager
+	 */
+	private $securityManager;
 
-    public function __construct(SecurityManager $securityManager)
-    {
-        $this->securityManager = $securityManager;
-    }
+	public function __construct(SecurityManager $securityManager)
+	{
+		$this->securityManager = $securityManager;
+	}
 
-    /**
-     * @param User $user
-     *
-     * @return Domain[]
-     */
-    public function getAllowedDomains(User $user): array
-    {
-        if ($user->isCommunityUser()) {
-            return [];
-        }
+	/**
+	 * @param User $user
+	 *
+	 * @return Domain[]
+	 */
+	public function getAllowedDomains(User $user): array
+	{
+		if ($user->isCommunityUser()) {
+			return [];
+		}
 
-        return Domain::getDomainByUser($user->getDatabase(), $user, true);
-    }
+		return Domain::getDomainByUser($user->getDatabase(), $user, true);
+	}
 
-    public function switchDomain(User $user, Domain $newDomain): void
-    {
-        $mapToId = function(DataObject $object) {
-            return $object->getId();
-        };
+	public function switchDomain(User $user, Domain $newDomain): void
+	{
+		$mapToId = function(DataObject $object) {
+			return $object->getId();
+		};
 
-        $allowed = in_array($newDomain->getId(), array_map($mapToId, self::getAllowedDomains($user)));
+		$allowed = in_array($newDomain->getId(), array_map($mapToId, self::getAllowedDomains($user)));
 
-        if ($allowed) {
-            WebRequest::setActiveDomain($newDomain);
-        }
-        else {
-            throw new AccessDeniedException($this->securityManager, $this);
-        }
-    }
+		if ($allowed) {
+			WebRequest::setActiveDomain($newDomain);
+		}
+		else {
+			throw new AccessDeniedException($this->securityManager, $this);
+		}
+	}
 
-    /**
-     * Not a very smart way of doing this - just set the user's current domain to the first one in the list.
-     *
-     * We may wish to allow the user to configure a default domain, but I don't expect this to be needed by many people,
-     * so for now they can suffer until someone complains.
-     *
-     * @param User $user
-     *
-     * @return void
-     */
-    public function switchToDefaultDomain(User $user): void
-    {
-        $domains = $this->getAllowedDomains($user);
-        if (count($domains) > 0) {
-            WebRequest::setActiveDomain($domains[0]);
-        }
-    }
+	/**
+	 * Not a very smart way of doing this - just set the user's current domain to the first one in the list.
+	 *
+	 * We may wish to allow the user to configure a default domain, but I don't expect this to be needed by many people,
+	 * so for now they can suffer until someone complains.
+	 *
+	 * @param User $user
+	 *
+	 * @return void
+	 */
+	public function switchToDefaultDomain(User $user): void
+	{
+		$domains = $this->getAllowedDomains($user);
+		if (count($domains) > 0) {
+			WebRequest::setActiveDomain($domains[0]);
+		}
+	}
 }
\ No newline at end of file

includes/Security/ContentSecurityPolicyManager.php

Indentation +86 added lines, -86 removed lines

@@ -12,101 +12,101 @@
 
 class ContentSecurityPolicyManager
 {
-    private $policy = [
-        'default-src'     => [],
-        'script-src'      => ['self', 'nonce'],
-        'script-src-elem' => ['self', 'nonce'],
-        'script-src-attr' => [],
-        'connect-src'     => ['self'],
-        'style-src'       => ['self'],
-        'style-src-elem'  => ['self'],
-        'style-src-attr'  => [],
-        'img-src'         => ['self', 'data:', 'https://upload.wikimedia.org', 'https://accounts-dev.wmflabs.org/'],
-        'font-src'        => ['self'],
-        'form-action'     => ['self', 'oauth'],
-        'frame-ancestors' => ['self'],
-        'frame-src'       => ['self'],
-    ];
-    private $nonce = null;
-    private $reportOnly = false;
-    /**
-     * @var SiteConfiguration
-     */
-    private $configuration;
+	private $policy = [
+		'default-src'     => [],
+		'script-src'      => ['self', 'nonce'],
+		'script-src-elem' => ['self', 'nonce'],
+		'script-src-attr' => [],
+		'connect-src'     => ['self'],
+		'style-src'       => ['self'],
+		'style-src-elem'  => ['self'],
+		'style-src-attr'  => [],
+		'img-src'         => ['self', 'data:', 'https://upload.wikimedia.org', 'https://accounts-dev.wmflabs.org/'],
+		'font-src'        => ['self'],
+		'form-action'     => ['self', 'oauth'],
+		'frame-ancestors' => ['self'],
+		'frame-src'       => ['self'],
+	];
+	private $nonce = null;
+	private $reportOnly = false;
+	/**
+	 * @var SiteConfiguration
+	 */
+	private $configuration;
 
-    /**
-     * ContentSecurityPolicyManager constructor.
-     *
-     * @param SiteConfiguration $configuration
-     */
-    public function __construct(SiteConfiguration $configuration)
-    {
-        $this->configuration = $configuration;
-    }
+	/**
+	 * ContentSecurityPolicyManager constructor.
+	 *
+	 * @param SiteConfiguration $configuration
+	 */
+	public function __construct(SiteConfiguration $configuration)
+	{
+		$this->configuration = $configuration;
+	}
 
-    public function getNonce()
-    {
-        if ($this->nonce === null) {
-            $this->nonce = base64_encode(openssl_random_pseudo_bytes(32));
-        }
+	public function getNonce()
+	{
+		if ($this->nonce === null) {
+			$this->nonce = base64_encode(openssl_random_pseudo_bytes(32));
+		}
 
-        return $this->nonce;
-    }
+		return $this->nonce;
+	}
 
-    public function getHeader(): string
-    {
-        $reportOnly = '';
-        if ($this->reportOnly) {
-            $reportOnly = '-Report-Only';
-        }
+	public function getHeader(): string
+	{
+		$reportOnly = '';
+		if ($this->reportOnly) {
+			$reportOnly = '-Report-Only';
+		}
 
-        $constructedPolicy = "Content-Security-Policy{$reportOnly}: ";
+		$constructedPolicy = "Content-Security-Policy{$reportOnly}: ";
 
-        foreach ($this->policy as $item => $values) {
-            $constructedPolicy .= $item . ' ';
-            $policyIsSet = false;
+		foreach ($this->policy as $item => $values) {
+			$constructedPolicy .= $item . ' ';
+			$policyIsSet = false;
 
-            if (count($values) > 0) {
-                foreach ($values as $value) {
-                    switch ($value) {
-                        case 'none':
-                        case 'self':
-                        case 'strict-dynamic':
-                            $policyIsSet = true;
-                            $constructedPolicy .= "'{$value}' ";
-                            break;
-                        case 'nonce':
-                            if ($this->nonce !== null) {
-                                $policyIsSet = true;
-                                $constructedPolicy .= "'nonce-{$this->nonce}' ";
-                            }
-                            break;
-                        case 'oauth':
-                            $policyIsSet = true;
-                            $constructedPolicy .= "{$this->configuration->getOauthMediaWikiCanonicalServer()} ";
-                            break;
-                        default:
-                            $policyIsSet = true;
-                            $constructedPolicy .= $value . ' ';
-                            break;
-                    }
-                }
+			if (count($values) > 0) {
+				foreach ($values as $value) {
+					switch ($value) {
+						case 'none':
+						case 'self':
+						case 'strict-dynamic':
+							$policyIsSet = true;
+							$constructedPolicy .= "'{$value}' ";
+							break;
+						case 'nonce':
+							if ($this->nonce !== null) {
+								$policyIsSet = true;
+								$constructedPolicy .= "'nonce-{$this->nonce}' ";
+							}
+							break;
+						case 'oauth':
+							$policyIsSet = true;
+							$constructedPolicy .= "{$this->configuration->getOauthMediaWikiCanonicalServer()} ";
+							break;
+						default:
+							$policyIsSet = true;
+							$constructedPolicy .= $value . ' ';
+							break;
+					}
+				}
 
-                if (!$policyIsSet) {
-                    $constructedPolicy .= "'none' ";
-                }
-            }
-            else {
-                $constructedPolicy .= "'none' ";
-            }
+				if (!$policyIsSet) {
+					$constructedPolicy .= "'none' ";
+				}
+			}
+			else {
+				$constructedPolicy .= "'none' ";
+			}
 
-            $constructedPolicy .= '; ';
-        }
+			$constructedPolicy .= '; ';
+		}
 
-        if ($this->configuration->getCspReportUri() !== null) {
-            $constructedPolicy .= 'report-uri ' . $this->configuration->getCspReportUri();
-        }
+		if ($this->configuration->getCspReportUri() !== null) {
+			$constructedPolicy .= 'report-uri ' . $this->configuration->getCspReportUri();
+		}
 
-        return $constructedPolicy;
-    }
+		return $constructedPolicy;
+	}
 }

includes/PdoDatabase.php

Indentation +130 added lines, -130 removed lines

@@ -15,134 +15,134 @@
 
 class PdoDatabase extends PDO
 {
-    public const ISOLATION_SERIALIZABLE = 'SERIALIZABLE';
-    public const ISOLATION_READ_COMMITTED = 'READ COMMITTED';
-    public const ISOLATION_READ_ONLY = 'READ ONLY';
-
-    /**
-     * @var PdoDatabase[]
-     */
-    private static $connections = array();
-    /**
-     * @var bool True if a transaction is active
-     */
-    protected $hasActiveTransaction = false;
-
-    /**
-     * Unless you're doing low-level work, this is not the function you want.
-     *
-     * @param string $connectionName
-     *
-     * @return PdoDatabase
-     * @throws Exception
-     */
-    public static function getDatabaseConnection($connectionName)
-    {
-        if (!isset(self::$connections[$connectionName])) {
-            global $cDatabaseConfig;
-
-            if (!array_key_exists($connectionName, $cDatabaseConfig)) {
-                throw new Exception("Database configuration not found for alias $connectionName");
-            }
-
-            try {
-                $databaseObject = new PdoDatabase(
-                    $cDatabaseConfig[$connectionName]["dsrcname"],
-                    $cDatabaseConfig[$connectionName]["username"],
-                    $cDatabaseConfig[$connectionName]["password"],
-                    $cDatabaseConfig[$connectionName]["options"]
-                );
-            }
-            catch (PDOException $ex) {
-                // wrap around any potential stack traces which may include passwords
-                throw new EnvironmentException("Error connecting to database '$connectionName': " . $ex->getMessage());
-            }
-
-            $databaseObject->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
-
-            // emulating prepared statements gives a performance boost on MySQL.
-            //
-            // however, our version of PDO doesn't seem to understand parameter types when emulating
-            // the prepared statements, so we're forced to turn this off for now.
-            // -- stw 2014-02-11
-            $databaseObject->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);
-
-            // Set the default transaction mode
-            $databaseObject->exec("SET SESSION TRANSACTION ISOLATION LEVEL READ COMMITTED;");
-
-            self::$connections[$connectionName] = $databaseObject;
-        }
-
-        return self::$connections[$connectionName];
-    }
-
-    /**
-     * Determines if this connection has a transaction in progress or not
-     * @return boolean true if there is a transaction in progress.
-     */
-    public function hasActiveTransaction()
-    {
-        return $this->hasActiveTransaction;
-    }
-
-    /**
-     * Summary of beginTransaction
-     * @return bool
-     */
-    public function beginTransaction(string $isolationLevel = self::ISOLATION_READ_COMMITTED)
-    {
-        // Override the pre-existing method, which doesn't stop you from
-        // starting transactions within transactions - which doesn't work and
-        // will throw an exception. This eliminates the need to catch exceptions
-        // all over the rest of the code
-        if ($this->hasActiveTransaction) {
-            return false;
-        }
-        else {
-            $accessMode = 'READ WRITE';
-
-            switch ($isolationLevel) {
-                case self::ISOLATION_SERIALIZABLE:
-                case self::ISOLATION_READ_COMMITTED:
-                    break;
-                case self::ISOLATION_READ_ONLY:
-                    $isolationLevel = self::ISOLATION_READ_COMMITTED;
-                    $accessMode = 'READ ONLY';
-                    break;
-                default:
-                    throw new Exception("Invalid transaction isolation level");
-            }
-
-            // set the transaction isolation level for every transaction.
-            // string substitution is safe here; values can only be one of the above constants
-            parent::exec("SET TRANSACTION ISOLATION LEVEL ${isolationLevel}, ${accessMode};");
-
-            // start a new transaction, and return whether the start was successful
-            $this->hasActiveTransaction = parent::beginTransaction();
-
-            return $this->hasActiveTransaction;
-        }
-    }
-
-    /**
-     * Commits the active transaction
-     */
-    public function commit()
-    {
-        if ($this->hasActiveTransaction) {
-            parent::commit();
-            $this->hasActiveTransaction = false;
-        }
-    }
-
-    /**
-     * Rolls back a transaction
-     */
-    public function rollBack()
-    {
-        if ($this->hasActiveTransaction) {
-            parent::rollback();
-            $this->hasActiveTransaction = false;
-        }
-    }
+	public const ISOLATION_SERIALIZABLE = 'SERIALIZABLE';
+	public const ISOLATION_READ_COMMITTED = 'READ COMMITTED';
+	public const ISOLATION_READ_ONLY = 'READ ONLY';
+
+	/**
+	 * @var PdoDatabase[]
+	 */
+	private static $connections = array();
+	/**
+	 * @var bool True if a transaction is active
+	 */
+	protected $hasActiveTransaction = false;
+
+	/**
+	 * Unless you're doing low-level work, this is not the function you want.
+	 *
+	 * @param string $connectionName
+	 *
+	 * @return PdoDatabase
+	 * @throws Exception
+	 */
+	public static function getDatabaseConnection($connectionName)
+	{
+		if (!isset(self::$connections[$connectionName])) {
+			global $cDatabaseConfig;
+
+			if (!array_key_exists($connectionName, $cDatabaseConfig)) {
+				throw new Exception("Database configuration not found for alias $connectionName");
+			}
+
+			try {
+				$databaseObject = new PdoDatabase(
+					$cDatabaseConfig[$connectionName]["dsrcname"],
+					$cDatabaseConfig[$connectionName]["username"],
+					$cDatabaseConfig[$connectionName]["password"],
+					$cDatabaseConfig[$connectionName]["options"]
+				);
+			}
+			catch (PDOException $ex) {
+				// wrap around any potential stack traces which may include passwords
+				throw new EnvironmentException("Error connecting to database '$connectionName': " . $ex->getMessage());
+			}
+
+			$databaseObject->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
+
+			// emulating prepared statements gives a performance boost on MySQL.
+			//
+			// however, our version of PDO doesn't seem to understand parameter types when emulating
+			// the prepared statements, so we're forced to turn this off for now.
+			// -- stw 2014-02-11
+			$databaseObject->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);
+
+			// Set the default transaction mode
+			$databaseObject->exec("SET SESSION TRANSACTION ISOLATION LEVEL READ COMMITTED;");
+
+			self::$connections[$connectionName] = $databaseObject;
+		}
+
+		return self::$connections[$connectionName];
+	}
+
+	/**
+	 * Determines if this connection has a transaction in progress or not
+	 * @return boolean true if there is a transaction in progress.
+	 */
+	public function hasActiveTransaction()
+	{
+		return $this->hasActiveTransaction;
+	}
+
+	/**
+	 * Summary of beginTransaction
+	 * @return bool
+	 */
+	public function beginTransaction(string $isolationLevel = self::ISOLATION_READ_COMMITTED)
+	{
+		// Override the pre-existing method, which doesn't stop you from
+		// starting transactions within transactions - which doesn't work and
+		// will throw an exception. This eliminates the need to catch exceptions
+		// all over the rest of the code
+		if ($this->hasActiveTransaction) {
+			return false;
+		}
+		else {
+			$accessMode = 'READ WRITE';
+
+			switch ($isolationLevel) {
+				case self::ISOLATION_SERIALIZABLE:
+				case self::ISOLATION_READ_COMMITTED:
+					break;
+				case self::ISOLATION_READ_ONLY:
+					$isolationLevel = self::ISOLATION_READ_COMMITTED;
+					$accessMode = 'READ ONLY';
+					break;
+				default:
+					throw new Exception("Invalid transaction isolation level");
+			}
+
+			// set the transaction isolation level for every transaction.
+			// string substitution is safe here; values can only be one of the above constants
+			parent::exec("SET TRANSACTION ISOLATION LEVEL ${isolationLevel}, ${accessMode};");
+
+			// start a new transaction, and return whether the start was successful
+			$this->hasActiveTransaction = parent::beginTransaction();
+
+			return $this->hasActiveTransaction;
+		}
+	}
+
+	/**
+	 * Commits the active transaction
+	 */
+	public function commit()
+	{
+		if ($this->hasActiveTransaction) {
+			parent::commit();
+			$this->hasActiveTransaction = false;
+		}
+	}
+
+	/**
+	 * Rolls back a transaction
+	 */
+	public function rollBack()
+	{
+		if ($this->hasActiveTransaction) {
+			parent::rollback();
+			$this->hasActiveTransaction = false;
+		}
+	}
 }

includes/Offline.php

Indentation +48 added lines, -48 removed lines

@@ -17,60 +17,60 @@
  */
 class Offline
 {
-    /**
-     * Determines if the tool is offline
-     * @return bool
-     */
-    public static function isOffline()
-    {
-        global $dontUseDb;
+	/**
+	 * Determines if the tool is offline
+	 * @return bool
+	 */
+	public static function isOffline()
+	{
+		global $dontUseDb;
 
-        return (bool)$dontUseDb;
-    }
+		return (bool)$dontUseDb;
+	}
 
-    /**
-     * Gets the offline message
-     *
-     * @param bool        $external
-     * @param null|string $message
-     *
-     * @return string
-     * @throws SmartyException
-     */
-    public static function getOfflineMessage($external, $message = null)
-    {
-        global $dontUseDbCulprit, $dontUseDbReason, $baseurl;
+	/**
+	 * Gets the offline message
+	 *
+	 * @param bool        $external
+	 * @param null|string $message
+	 *
+	 * @return string
+	 * @throws SmartyException
+	 */
+	public static function getOfflineMessage($external, $message = null)
+	{
+		global $dontUseDbCulprit, $dontUseDbReason, $baseurl;
 
-        $smarty = new Smarty();
-        $smarty->assign("baseurl", $baseurl);
-        $smarty->assign("resourceCacheEpoch", 0);
-        $smarty->assign("alerts", []);
-        $smarty->assign("toolversion", Environment::getToolVersion());
+		$smarty = new Smarty();
+		$smarty->assign("baseurl", $baseurl);
+		$smarty->assign("resourceCacheEpoch", 0);
+		$smarty->assign("alerts", []);
+		$smarty->assign("toolversion", Environment::getToolVersion());
 
-        if (!headers_sent()) {
-            header("HTTP/1.1 503 Service Unavailable");
-        }
+		if (!headers_sent()) {
+			header("HTTP/1.1 503 Service Unavailable");
+		}
 
-        if ($external) {
-            return $smarty->fetch("offline/external.tpl");
-        }
-        else {
-            $hideCulprit = true;
+		if ($external) {
+			return $smarty->fetch("offline/external.tpl");
+		}
+		else {
+			$hideCulprit = true;
 
-            // Use the provided message if possible
-            if ($message === null) {
-                $hideCulprit = false;
-                $message = $dontUseDbReason;
-            }
+			// Use the provided message if possible
+			if ($message === null) {
+				$hideCulprit = false;
+				$message = $dontUseDbReason;
+			}
 
-            $smarty->assign("hideCulprit", $hideCulprit);
-            $smarty->assign("dontUseDbCulprit", $dontUseDbCulprit);
-            $smarty->assign("dontUseDbReason", $message);
-            $smarty->assign("alerts", array());
-            $smarty->assign('currentUser', User::getCommunity());
-            $smarty->assign('currentDomain', null);
+			$smarty->assign("hideCulprit", $hideCulprit);
+			$smarty->assign("dontUseDbCulprit", $dontUseDbCulprit);
+			$smarty->assign("dontUseDbReason", $message);
+			$smarty->assign("alerts", array());
+			$smarty->assign('currentUser', User::getCommunity());
+			$smarty->assign('currentDomain', null);
 
-            return $smarty->fetch("offline/internal.tpl");
-        }
-    }
+			return $smarty->fetch("offline/internal.tpl");
+		}
+	}
 }