Completed
Branch master (227f0c)
by
unknown
30:54
created

WebRequest::getSession()   A

Complexity

Conditions 3
Paths 3

Size

Total Lines 12
Code Lines 8

Duplication

Lines 0
Ratio 0 %

Importance

Changes 0
Metric Value
cc 3
eloc 8
nc 3
nop 0
dl 0
loc 12
rs 9.4285
c 0
b 0
f 0
1
<?php
2
/**
3
 * Deal with importing all those nasty globals and things
4
 *
5
 * Copyright © 2003 Brion Vibber <[email protected]>
6
 * https://www.mediawiki.org/
7
 *
8
 * This program is free software; you can redistribute it and/or modify
9
 * it under the terms of the GNU General Public License as published by
10
 * the Free Software Foundation; either version 2 of the License, or
11
 * (at your option) any later version.
12
 *
13
 * This program is distributed in the hope that it will be useful,
14
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16
 * GNU General Public License for more details.
17
 *
18
 * You should have received a copy of the GNU General Public License along
19
 * with this program; if not, write to the Free Software Foundation, Inc.,
20
 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
21
 * http://www.gnu.org/copyleft/gpl.html
22
 *
23
 * @file
24
 */
25
26
use MediaWiki\Session\Session;
27
use MediaWiki\Session\SessionId;
28
use MediaWiki\Session\SessionManager;
29
30
/**
31
 * The WebRequest class encapsulates getting at data passed in the
32
 * URL or via a POSTed form stripping illegal input characters and
33
 * normalizing Unicode sequences.
34
 *
35
 * @ingroup HTTP
36
 */
37
class WebRequest {
38
	protected $data, $headers = [];
0 ignored issues
show
Coding Style introduced by
It is generally advisable to only define one property per statement.

Only declaring a single property per statement allows you to later on add doc comments more easily.

It is also recommended by PSR2, so it is a common style that many people expect.

Loading history...
39
40
	/**
41
	 * Flag to make WebRequest::getHeader return an array of values.
42
	 * @since 1.26
43
	 */
44
	const GETHEADER_LIST = 1;
45
46
	/**
47
	 * The unique request ID.
48
	 * @var string
49
	 */
50
	private static $reqId;
51
52
	/**
53
	 * Lazy-init response object
54
	 * @var WebResponse
55
	 */
56
	private $response;
57
58
	/**
59
	 * Cached client IP address
60
	 * @var string
61
	 */
62
	private $ip;
63
64
	/**
65
	 * The timestamp of the start of the request, with microsecond precision.
66
	 * @var float
67
	 */
68
	protected $requestTime;
69
70
	/**
71
	 * Cached URL protocol
72
	 * @var string
73
	 */
74
	protected $protocol;
75
76
	/**
77
	 * @var SessionId|null Session ID to use for this
78
	 *  request. We can't save the session directly due to reference cycles not
79
	 *  working too well (slow GC in Zend and never collected in HHVM).
80
	 */
81
	protected $sessionId = null;
82
83
	/** @var bool Whether this HTTP request is "safe" (even if it is an HTTP post) */
84
	protected $markedAsSafe = false;
85
86
	public function __construct() {
0 ignored issues
show
Coding Style introduced by
__construct uses the super-global variable $_SERVER which is generally not recommended.

Instead of super-globals, we recommend to explicitly inject the dependencies of your class. This makes your code less dependent on global state and it becomes generally more testable:

// Bad
class Router
{
    public function generate($path)
    {
        return $_SERVER['HOST'].$path;
    }
}

// Better
class Router
{
    private $host;

    public function __construct($host)
    {
        $this->host = $host;
    }

    public function generate($path)
    {
        return $this->host.$path;
    }
}

class Controller
{
    public function myAction(Request $request)
    {
        // Instead of
        $page = isset($_GET['page']) ? intval($_GET['page']) : 1;

        // Better (assuming you use the Symfony2 request)
        $page = $request->query->get('page', 1);
    }
}
Loading history...
Coding Style introduced by
__construct uses the super-global variable $_POST which is generally not recommended.

Instead of super-globals, we recommend to explicitly inject the dependencies of your class. This makes your code less dependent on global state and it becomes generally more testable:

// Bad
class Router
{
    public function generate($path)
    {
        return $_SERVER['HOST'].$path;
    }
}

// Better
class Router
{
    private $host;

    public function __construct($host)
    {
        $this->host = $host;
    }

    public function generate($path)
    {
        return $this->host.$path;
    }
}

class Controller
{
    public function myAction(Request $request)
    {
        // Instead of
        $page = isset($_GET['page']) ? intval($_GET['page']) : 1;

        // Better (assuming you use the Symfony2 request)
        $page = $request->query->get('page', 1);
    }
}
Loading history...
Coding Style introduced by
__construct uses the super-global variable $_GET which is generally not recommended.

Instead of super-globals, we recommend to explicitly inject the dependencies of your class. This makes your code less dependent on global state and it becomes generally more testable:

// Bad
class Router
{
    public function generate($path)
    {
        return $_SERVER['HOST'].$path;
    }
}

// Better
class Router
{
    private $host;

    public function __construct($host)
    {
        $this->host = $host;
    }

    public function generate($path)
    {
        return $this->host.$path;
    }
}

class Controller
{
    public function myAction(Request $request)
    {
        // Instead of
        $page = isset($_GET['page']) ? intval($_GET['page']) : 1;

        // Better (assuming you use the Symfony2 request)
        $page = $request->query->get('page', 1);
    }
}
Loading history...
87
		$this->requestTime = isset( $_SERVER['REQUEST_TIME_FLOAT'] )
88
			? $_SERVER['REQUEST_TIME_FLOAT'] : microtime( true );
89
90
		// POST overrides GET data
91
		// We don't use $_REQUEST here to avoid interference from cookies...
92
		$this->data = $_POST + $_GET;
93
	}
94
95
	/**
96
	 * Extract relevant query arguments from the http request uri's path
97
	 * to be merged with the normal php provided query arguments.
98
	 * Tries to use the REQUEST_URI data if available and parses it
99
	 * according to the wiki's configuration looking for any known pattern.
100
	 *
101
	 * If the REQUEST_URI is not provided we'll fall back on the PATH_INFO
102
	 * provided by the server if any and use that to set a 'title' parameter.
103
	 *
104
	 * @param string $want If this is not 'all', then the function
105
	 * will return an empty array if it determines that the URL is
106
	 * inside a rewrite path.
107
	 *
108
	 * @return array Any query arguments found in path matches.
109
	 */
110
	public static function getPathInfo( $want = 'all' ) {
0 ignored issues
show
Coding Style introduced by
getPathInfo uses the super-global variable $_SERVER which is generally not recommended.

Instead of super-globals, we recommend to explicitly inject the dependencies of your class. This makes your code less dependent on global state and it becomes generally more testable:

// Bad
class Router
{
    public function generate($path)
    {
        return $_SERVER['HOST'].$path;
    }
}

// Better
class Router
{
    private $host;

    public function __construct($host)
    {
        $this->host = $host;
    }

    public function generate($path)
    {
        return $this->host.$path;
    }
}

class Controller
{
    public function myAction(Request $request)
    {
        // Instead of
        $page = isset($_GET['page']) ? intval($_GET['page']) : 1;

        // Better (assuming you use the Symfony2 request)
        $page = $request->query->get('page', 1);
    }
}
Loading history...
111
		global $wgUsePathInfo;
112
		// PATH_INFO is mangled due to http://bugs.php.net/bug.php?id=31892
113
		// And also by Apache 2.x, double slashes are converted to single slashes.
114
		// So we will use REQUEST_URI if possible.
115
		$matches = [];
116
		if ( !empty( $_SERVER['REQUEST_URI'] ) ) {
117
			// Slurp out the path portion to examine...
118
			$url = $_SERVER['REQUEST_URI'];
119
			if ( !preg_match( '!^https?://!', $url ) ) {
120
				$url = 'http://unused' . $url;
121
			}
122
			MediaWiki\suppressWarnings();
123
			$a = parse_url( $url );
124
			MediaWiki\restoreWarnings();
125
			if ( $a ) {
126
				$path = isset( $a['path'] ) ? $a['path'] : '';
127
128
				global $wgScript;
129
				if ( $path == $wgScript && $want !== 'all' ) {
130
					// Script inside a rewrite path?
131
					// Abort to keep from breaking...
132
					return $matches;
133
				}
134
135
				$router = new PathRouter;
136
137
				// Raw PATH_INFO style
138
				$router->add( "$wgScript/$1" );
139
140
				if ( isset( $_SERVER['SCRIPT_NAME'] )
141
					&& preg_match( '/\.php5?/', $_SERVER['SCRIPT_NAME'] )
142
				) {
143
					# Check for SCRIPT_NAME, we handle index.php explicitly
144
					# But we do have some other .php files such as img_auth.php
145
					# Don't let root article paths clober the parsing for them
146
					$router->add( $_SERVER['SCRIPT_NAME'] . "/$1" );
147
				}
148
149
				global $wgArticlePath;
150
				if ( $wgArticlePath ) {
151
					$router->add( $wgArticlePath );
152
				}
153
154
				global $wgActionPaths;
155
				if ( $wgActionPaths ) {
156
					$router->add( $wgActionPaths, [ 'action' => '$key' ] );
157
				}
158
159
				global $wgVariantArticlePath, $wgContLang;
160
				if ( $wgVariantArticlePath ) {
161
					$router->add( $wgVariantArticlePath,
162
						[ 'variant' => '$2' ],
163
						[ '$2' => $wgContLang->getVariants() ]
164
					);
165
				}
166
167
				Hooks::run( 'WebRequestPathInfoRouter', [ $router ] );
168
169
				$matches = $router->parse( $path );
170
			}
171
		} elseif ( $wgUsePathInfo ) {
172
			if ( isset( $_SERVER['ORIG_PATH_INFO'] ) && $_SERVER['ORIG_PATH_INFO'] != '' ) {
173
				// Mangled PATH_INFO
174
				// http://bugs.php.net/bug.php?id=31892
175
				// Also reported when ini_get('cgi.fix_pathinfo')==false
176
				$matches['title'] = substr( $_SERVER['ORIG_PATH_INFO'], 1 );
177
178
			} elseif ( isset( $_SERVER['PATH_INFO'] ) && $_SERVER['PATH_INFO'] != '' ) {
179
				// Regular old PATH_INFO yay
180
				$matches['title'] = substr( $_SERVER['PATH_INFO'], 1 );
181
			}
182
		}
183
184
		return $matches;
185
	}
186
187
	/**
188
	 * Work out an appropriate URL prefix containing scheme and host, based on
189
	 * information detected from $_SERVER
190
	 *
191
	 * @return string
192
	 */
193
	public static function detectServer() {
0 ignored issues
show
Coding Style introduced by
detectServer uses the super-global variable $_SERVER which is generally not recommended.

Instead of super-globals, we recommend to explicitly inject the dependencies of your class. This makes your code less dependent on global state and it becomes generally more testable:

// Bad
class Router
{
    public function generate($path)
    {
        return $_SERVER['HOST'].$path;
    }
}

// Better
class Router
{
    private $host;

    public function __construct($host)
    {
        $this->host = $host;
    }

    public function generate($path)
    {
        return $this->host.$path;
    }
}

class Controller
{
    public function myAction(Request $request)
    {
        // Instead of
        $page = isset($_GET['page']) ? intval($_GET['page']) : 1;

        // Better (assuming you use the Symfony2 request)
        $page = $request->query->get('page', 1);
    }
}
Loading history...
194
		global $wgAssumeProxiesUseDefaultProtocolPorts;
195
196
		$proto = self::detectProtocol();
197
		$stdPort = $proto === 'https' ? 443 : 80;
198
199
		$varNames = [ 'HTTP_HOST', 'SERVER_NAME', 'HOSTNAME', 'SERVER_ADDR' ];
200
		$host = 'localhost';
201
		$port = $stdPort;
202
		foreach ( $varNames as $varName ) {
203
			if ( !isset( $_SERVER[$varName] ) ) {
204
				continue;
205
			}
206
207
			$parts = IP::splitHostAndPort( $_SERVER[$varName] );
208
			if ( !$parts ) {
209
				// Invalid, do not use
210
				continue;
211
			}
212
213
			$host = $parts[0];
214
			if ( $wgAssumeProxiesUseDefaultProtocolPorts && isset( $_SERVER['HTTP_X_FORWARDED_PROTO'] ) ) {
215
				// Bug 70021: Assume that upstream proxy is running on the default
216
				// port based on the protocol. We have no reliable way to determine
217
				// the actual port in use upstream.
218
				$port = $stdPort;
219
			} elseif ( $parts[1] === false ) {
220
				if ( isset( $_SERVER['SERVER_PORT'] ) ) {
221
					$port = $_SERVER['SERVER_PORT'];
222
				} // else leave it as $stdPort
223
			} else {
224
				$port = $parts[1];
225
			}
226
			break;
227
		}
228
229
		return $proto . '://' . IP::combineHostAndPort( $host, $port, $stdPort );
230
	}
231
232
	/**
233
	 * Detect the protocol from $_SERVER.
234
	 * This is for use prior to Setup.php, when no WebRequest object is available.
235
	 * At other times, use the non-static function getProtocol().
236
	 *
237
	 * @return array
238
	 */
239
	public static function detectProtocol() {
0 ignored issues
show
Coding Style introduced by
detectProtocol uses the super-global variable $_SERVER which is generally not recommended.

Instead of super-globals, we recommend to explicitly inject the dependencies of your class. This makes your code less dependent on global state and it becomes generally more testable:

// Bad
class Router
{
    public function generate($path)
    {
        return $_SERVER['HOST'].$path;
    }
}

// Better
class Router
{
    private $host;

    public function __construct($host)
    {
        $this->host = $host;
    }

    public function generate($path)
    {
        return $this->host.$path;
    }
}

class Controller
{
    public function myAction(Request $request)
    {
        // Instead of
        $page = isset($_GET['page']) ? intval($_GET['page']) : 1;

        // Better (assuming you use the Symfony2 request)
        $page = $request->query->get('page', 1);
    }
}
Loading history...
240
		if ( ( !empty( $_SERVER['HTTPS'] ) && $_SERVER['HTTPS'] !== 'off' ) ||
241
			( isset( $_SERVER['HTTP_X_FORWARDED_PROTO'] ) &&
242
			$_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https' ) ) {
243
			return 'https';
244
		} else {
245
			return 'http';
246
		}
247
	}
248
249
	/**
250
	 * Get the number of seconds to have elapsed since request start,
251
	 * in fractional seconds, with microsecond resolution.
252
	 *
253
	 * @return float
254
	 * @since 1.25
255
	 */
256
	public function getElapsedTime() {
257
		return microtime( true ) - $this->requestTime;
258
	}
259
260
	/**
261
	 * Get the unique request ID.
262
	 * This is either the value of the UNIQUE_ID envvar (if present) or a
263
	 * randomly-generated 24-character string.
264
	 *
265
	 * @return string
266
	 * @since 1.27
267
	 */
268
	public static function getRequestId() {
0 ignored issues
show
Coding Style introduced by
getRequestId uses the super-global variable $_SERVER which is generally not recommended.

Instead of super-globals, we recommend to explicitly inject the dependencies of your class. This makes your code less dependent on global state and it becomes generally more testable:

// Bad
class Router
{
    public function generate($path)
    {
        return $_SERVER['HOST'].$path;
    }
}

// Better
class Router
{
    private $host;

    public function __construct($host)
    {
        $this->host = $host;
    }

    public function generate($path)
    {
        return $this->host.$path;
    }
}

class Controller
{
    public function myAction(Request $request)
    {
        // Instead of
        $page = isset($_GET['page']) ? intval($_GET['page']) : 1;

        // Better (assuming you use the Symfony2 request)
        $page = $request->query->get('page', 1);
    }
}
Loading history...
269
		if ( !self::$reqId ) {
270
			self::$reqId = isset( $_SERVER['UNIQUE_ID'] )
271
				? $_SERVER['UNIQUE_ID'] : wfRandomString( 24 );
272
		}
273
274
		return self::$reqId;
275
	}
276
277
	/**
278
	 * Override the unique request ID. This is for sub-requests, such as jobs,
279
	 * that wish to use the same id but are not part of the same execution context.
280
	 *
281
	 * @param string $id
282
	 * @since 1.27
283
	 */
284
	public static function overrideRequestId( $id ) {
285
		self::$reqId = $id;
286
	}
287
288
	/**
289
	 * Get the current URL protocol (http or https)
290
	 * @return string
291
	 */
292
	public function getProtocol() {
293
		if ( $this->protocol === null ) {
294
			$this->protocol = self::detectProtocol();
295
		}
296
		return $this->protocol;
297
	}
298
299
	/**
300
	 * Check for title, action, and/or variant data in the URL
301
	 * and interpolate it into the GET variables.
302
	 * This should only be run after $wgContLang is available,
303
	 * as we may need the list of language variants to determine
304
	 * available variant URLs.
305
	 */
306
	public function interpolateTitle() {
0 ignored issues
show
Coding Style introduced by
interpolateTitle uses the super-global variable $_GET which is generally not recommended.

Instead of super-globals, we recommend to explicitly inject the dependencies of your class. This makes your code less dependent on global state and it becomes generally more testable:

// Bad
class Router
{
    public function generate($path)
    {
        return $_SERVER['HOST'].$path;
    }
}

// Better
class Router
{
    private $host;

    public function __construct($host)
    {
        $this->host = $host;
    }

    public function generate($path)
    {
        return $this->host.$path;
    }
}

class Controller
{
    public function myAction(Request $request)
    {
        // Instead of
        $page = isset($_GET['page']) ? intval($_GET['page']) : 1;

        // Better (assuming you use the Symfony2 request)
        $page = $request->query->get('page', 1);
    }
}
Loading history...
Coding Style introduced by
interpolateTitle uses the super-global variable $_REQUEST which is generally not recommended.

Instead of super-globals, we recommend to explicitly inject the dependencies of your class. This makes your code less dependent on global state and it becomes generally more testable:

// Bad
class Router
{
    public function generate($path)
    {
        return $_SERVER['HOST'].$path;
    }
}

// Better
class Router
{
    private $host;

    public function __construct($host)
    {
        $this->host = $host;
    }

    public function generate($path)
    {
        return $this->host.$path;
    }
}

class Controller
{
    public function myAction(Request $request)
    {
        // Instead of
        $page = isset($_GET['page']) ? intval($_GET['page']) : 1;

        // Better (assuming you use the Symfony2 request)
        $page = $request->query->get('page', 1);
    }
}
Loading history...
307
		// bug 16019: title interpolation on API queries is useless and sometimes harmful
308
		if ( defined( 'MW_API' ) ) {
309
			return;
310
		}
311
312
		$matches = self::getPathInfo( 'title' );
313
		foreach ( $matches as $key => $val ) {
314
			$this->data[$key] = $_GET[$key] = $_REQUEST[$key] = $val;
315
		}
316
	}
317
318
	/**
319
	 * URL rewriting function; tries to extract page title and,
320
	 * optionally, one other fixed parameter value from a URL path.
321
	 *
322
	 * @param string $path The URL path given from the client
323
	 * @param array $bases One or more URLs, optionally with $1 at the end
324
	 * @param string|bool $key If provided, the matching key in $bases will be
325
	 *    passed on as the value of this URL parameter
326
	 * @return array Array of URL variables to interpolate; empty if no match
327
	 */
328
	static function extractTitle( $path, $bases, $key = false ) {
329
		foreach ( (array)$bases as $keyValue => $base ) {
330
			// Find the part after $wgArticlePath
331
			$base = str_replace( '$1', '', $base );
332
			$baseLen = strlen( $base );
333
			if ( substr( $path, 0, $baseLen ) == $base ) {
334
				$raw = substr( $path, $baseLen );
335
				if ( $raw !== '' ) {
336
					$matches = [ 'title' => rawurldecode( $raw ) ];
337
					if ( $key ) {
338
						$matches[$key] = $keyValue;
339
					}
340
					return $matches;
341
				}
342
			}
343
		}
344
		return [];
345
	}
346
347
	/**
348
	 * Recursively normalizes UTF-8 strings in the given array.
349
	 *
350
	 * @param string|array $data
351
	 * @return array|string Cleaned-up version of the given
352
	 * @private
353
	 */
354
	function normalizeUnicode( $data ) {
355
		if ( is_array( $data ) ) {
356
			foreach ( $data as $key => $val ) {
357
				$data[$key] = $this->normalizeUnicode( $val );
358
			}
359
		} else {
360
			global $wgContLang;
361
			$data = isset( $wgContLang ) ?
362
				$wgContLang->normalize( $data ) :
363
				UtfNormal\Validator::cleanUp( $data );
364
		}
365
		return $data;
366
	}
367
368
	/**
369
	 * Fetch a value from the given array or return $default if it's not set.
370
	 *
371
	 * @param array $arr
372
	 * @param string $name
373
	 * @param mixed $default
374
	 * @return mixed
375
	 */
376
	private function getGPCVal( $arr, $name, $default ) {
0 ignored issues
show
Coding Style introduced by
getGPCVal uses the super-global variable $_GET which is generally not recommended.

Instead of super-globals, we recommend to explicitly inject the dependencies of your class. This makes your code less dependent on global state and it becomes generally more testable:

// Bad
class Router
{
    public function generate($path)
    {
        return $_SERVER['HOST'].$path;
    }
}

// Better
class Router
{
    private $host;

    public function __construct($host)
    {
        $this->host = $host;
    }

    public function generate($path)
    {
        return $this->host.$path;
    }
}

class Controller
{
    public function myAction(Request $request)
    {
        // Instead of
        $page = isset($_GET['page']) ? intval($_GET['page']) : 1;

        // Better (assuming you use the Symfony2 request)
        $page = $request->query->get('page', 1);
    }
}
Loading history...
377
		# PHP is so nice to not touch input data, except sometimes:
378
		# http://us2.php.net/variables.external#language.variables.external.dot-in-names
379
		# Work around PHP *feature* to avoid *bugs* elsewhere.
380
		$name = strtr( $name, '.', '_' );
381
		if ( isset( $arr[$name] ) ) {
382
			global $wgContLang;
383
			$data = $arr[$name];
384
			if ( isset( $_GET[$name] ) && !is_array( $data ) ) {
385
				# Check for alternate/legacy character encoding.
386
				if ( isset( $wgContLang ) ) {
387
					$data = $wgContLang->checkTitleEncoding( $data );
388
				}
389
			}
390
			$data = $this->normalizeUnicode( $data );
391
			return $data;
392
		} else {
393
			return $default;
394
		}
395
	}
396
397
	/**
398
	 * Fetch a scalar from the input or return $default if it's not set.
399
	 * Returns a string. Arrays are discarded. Useful for
400
	 * non-freeform text inputs (e.g. predefined internal text keys
401
	 * selected by a drop-down menu). For freeform input, see getText().
402
	 *
403
	 * @param string $name
404
	 * @param string $default Optional default (or null)
405
	 * @return string
406
	 */
407
	public function getVal( $name, $default = null ) {
408
		$val = $this->getGPCVal( $this->data, $name, $default );
409
		if ( is_array( $val ) ) {
410
			$val = $default;
411
		}
412
		if ( is_null( $val ) ) {
413
			return $val;
414
		} else {
415
			return (string)$val;
416
		}
417
	}
418
419
	/**
420
	 * Set an arbitrary value into our get/post data.
421
	 *
422
	 * @param string $key Key name to use
423
	 * @param mixed $value Value to set
424
	 * @return mixed Old value if one was present, null otherwise
425
	 */
426
	public function setVal( $key, $value ) {
427
		$ret = isset( $this->data[$key] ) ? $this->data[$key] : null;
428
		$this->data[$key] = $value;
429
		return $ret;
430
	}
431
432
	/**
433
	 * Unset an arbitrary value from our get/post data.
434
	 *
435
	 * @param string $key Key name to use
436
	 * @return mixed Old value if one was present, null otherwise
437
	 */
438
	public function unsetVal( $key ) {
439 View Code Duplication
		if ( !isset( $this->data[$key] ) ) {
440
			$ret = null;
441
		} else {
442
			$ret = $this->data[$key];
443
			unset( $this->data[$key] );
444
		}
445
		return $ret;
446
	}
447
448
	/**
449
	 * Fetch an array from the input or return $default if it's not set.
450
	 * If source was scalar, will return an array with a single element.
451
	 * If no source and no default, returns null.
452
	 *
453
	 * @param string $name
454
	 * @param array $default Optional default (or null)
455
	 * @return array
456
	 */
457
	public function getArray( $name, $default = null ) {
458
		$val = $this->getGPCVal( $this->data, $name, $default );
459
		if ( is_null( $val ) ) {
460
			return null;
461
		} else {
462
			return (array)$val;
463
		}
464
	}
465
466
	/**
467
	 * Fetch an array of integers, or return $default if it's not set.
468
	 * If source was scalar, will return an array with a single element.
469
	 * If no source and no default, returns null.
470
	 * If an array is returned, contents are guaranteed to be integers.
471
	 *
472
	 * @param string $name
473
	 * @param array $default Option default (or null)
474
	 * @return array Array of ints
475
	 */
476
	public function getIntArray( $name, $default = null ) {
477
		$val = $this->getArray( $name, $default );
478
		if ( is_array( $val ) ) {
479
			$val = array_map( 'intval', $val );
480
		}
481
		return $val;
482
	}
483
484
	/**
485
	 * Fetch an integer value from the input or return $default if not set.
486
	 * Guaranteed to return an integer; non-numeric input will typically
487
	 * return 0.
488
	 *
489
	 * @param string $name
490
	 * @param int $default
491
	 * @return int
492
	 */
493
	public function getInt( $name, $default = 0 ) {
494
		return intval( $this->getVal( $name, $default ) );
495
	}
496
497
	/**
498
	 * Fetch an integer value from the input or return null if empty.
499
	 * Guaranteed to return an integer or null; non-numeric input will
500
	 * typically return null.
501
	 *
502
	 * @param string $name
503
	 * @return int|null
504
	 */
505
	public function getIntOrNull( $name ) {
506
		$val = $this->getVal( $name );
507
		return is_numeric( $val )
508
			? intval( $val )
509
			: null;
510
	}
511
512
	/**
513
	 * Fetch a floating point value from the input or return $default if not set.
514
	 * Guaranteed to return a float; non-numeric input will typically
515
	 * return 0.
516
	 *
517
	 * @since 1.23
518
	 * @param string $name
519
	 * @param float $default
520
	 * @return float
521
	 */
522
	public function getFloat( $name, $default = 0.0 ) {
523
		return floatval( $this->getVal( $name, $default ) );
524
	}
525
526
	/**
527
	 * Fetch a boolean value from the input or return $default if not set.
528
	 * Guaranteed to return true or false, with normal PHP semantics for
529
	 * boolean interpretation of strings.
530
	 *
531
	 * @param string $name
532
	 * @param bool $default
533
	 * @return bool
534
	 */
535
	public function getBool( $name, $default = false ) {
536
		return (bool)$this->getVal( $name, $default );
537
	}
538
539
	/**
540
	 * Fetch a boolean value from the input or return $default if not set.
541
	 * Unlike getBool, the string "false" will result in boolean false, which is
542
	 * useful when interpreting information sent from JavaScript.
543
	 *
544
	 * @param string $name
545
	 * @param bool $default
546
	 * @return bool
547
	 */
548
	public function getFuzzyBool( $name, $default = false ) {
549
		return $this->getBool( $name, $default ) && strcasecmp( $this->getVal( $name ), 'false' ) !== 0;
550
	}
551
552
	/**
553
	 * Return true if the named value is set in the input, whatever that
554
	 * value is (even "0"). Return false if the named value is not set.
555
	 * Example use is checking for the presence of check boxes in forms.
556
	 *
557
	 * @param string $name
558
	 * @return bool
559
	 */
560
	public function getCheck( $name ) {
561
		# Checkboxes and buttons are only present when clicked
562
		# Presence connotes truth, absence false
563
		return $this->getVal( $name, null ) !== null;
564
	}
565
566
	/**
567
	 * Fetch a text string from the given array or return $default if it's not
568
	 * set. Carriage returns are stripped from the text, and with some language
569
	 * modules there is an input transliteration applied. This should generally
570
	 * be used for form "<textarea>" and "<input>" fields. Used for
571
	 * user-supplied freeform text input (for which input transformations may
572
	 * be required - e.g.  Esperanto x-coding).
573
	 *
574
	 * @param string $name
575
	 * @param string $default Optional
576
	 * @return string
577
	 */
578
	public function getText( $name, $default = '' ) {
579
		global $wgContLang;
580
		$val = $this->getVal( $name, $default );
581
		return str_replace( "\r\n", "\n",
582
			$wgContLang->recodeInput( $val ) );
583
	}
584
585
	/**
586
	 * Extracts the given named values into an array.
587
	 * If no arguments are given, returns all input values.
588
	 * No transformation is performed on the values.
589
	 *
590
	 * @return array
591
	 */
592
	public function getValues() {
593
		$names = func_get_args();
594
		if ( count( $names ) == 0 ) {
595
			$names = array_keys( $this->data );
596
		}
597
598
		$retVal = [];
599
		foreach ( $names as $name ) {
600
			$value = $this->getGPCVal( $this->data, $name, null );
601
			if ( !is_null( $value ) ) {
602
				$retVal[$name] = $value;
603
			}
604
		}
605
		return $retVal;
606
	}
607
608
	/**
609
	 * Returns the names of all input values excluding those in $exclude.
610
	 *
611
	 * @param array $exclude
612
	 * @return array
613
	 */
614
	public function getValueNames( $exclude = [] ) {
615
		return array_diff( array_keys( $this->getValues() ), $exclude );
616
	}
617
618
	/**
619
	 * Get the values passed in the query string.
620
	 * No transformation is performed on the values.
621
	 *
622
	 * @return array
623
	 */
624
	public function getQueryValues() {
0 ignored issues
show
Coding Style introduced by
getQueryValues uses the super-global variable $_GET which is generally not recommended.

Instead of super-globals, we recommend to explicitly inject the dependencies of your class. This makes your code less dependent on global state and it becomes generally more testable:

// Bad
class Router
{
    public function generate($path)
    {
        return $_SERVER['HOST'].$path;
    }
}

// Better
class Router
{
    private $host;

    public function __construct($host)
    {
        $this->host = $host;
    }

    public function generate($path)
    {
        return $this->host.$path;
    }
}

class Controller
{
    public function myAction(Request $request)
    {
        // Instead of
        $page = isset($_GET['page']) ? intval($_GET['page']) : 1;

        // Better (assuming you use the Symfony2 request)
        $page = $request->query->get('page', 1);
    }
}
Loading history...
625
		return $_GET;
626
	}
627
628
	/**
629
	 * Return the contents of the Query with no decoding. Use when you need to
630
	 * know exactly what was sent, e.g. for an OAuth signature over the elements.
631
	 *
632
	 * @return string
633
	 */
634
	public function getRawQueryString() {
0 ignored issues
show
Coding Style introduced by
getRawQueryString uses the super-global variable $_SERVER which is generally not recommended.

Instead of super-globals, we recommend to explicitly inject the dependencies of your class. This makes your code less dependent on global state and it becomes generally more testable:

// Bad
class Router
{
    public function generate($path)
    {
        return $_SERVER['HOST'].$path;
    }
}

// Better
class Router
{
    private $host;

    public function __construct($host)
    {
        $this->host = $host;
    }

    public function generate($path)
    {
        return $this->host.$path;
    }
}

class Controller
{
    public function myAction(Request $request)
    {
        // Instead of
        $page = isset($_GET['page']) ? intval($_GET['page']) : 1;

        // Better (assuming you use the Symfony2 request)
        $page = $request->query->get('page', 1);
    }
}
Loading history...
635
		return $_SERVER['QUERY_STRING'];
636
	}
637
638
	/**
639
	 * Return the contents of the POST with no decoding. Use when you need to
640
	 * know exactly what was sent, e.g. for an OAuth signature over the elements.
641
	 *
642
	 * @return string
643
	 */
644
	public function getRawPostString() {
645
		if ( !$this->wasPosted() ) {
646
			return '';
647
		}
648
		return $this->getRawInput();
649
	}
650
651
	/**
652
	 * Return the raw request body, with no processing. Cached since some methods
653
	 * disallow reading the stream more than once. As stated in the php docs, this
654
	 * does not work with enctype="multipart/form-data".
655
	 *
656
	 * @return string
657
	 */
658
	public function getRawInput() {
659
		static $input = null;
660
		if ( $input === null ) {
661
			$input = file_get_contents( 'php://input' );
662
		}
663
		return $input;
664
	}
665
666
	/**
667
	 * Get the HTTP method used for this request.
668
	 *
669
	 * @return string
670
	 */
671
	public function getMethod() {
0 ignored issues
show
Coding Style introduced by
getMethod uses the super-global variable $_SERVER which is generally not recommended.

Instead of super-globals, we recommend to explicitly inject the dependencies of your class. This makes your code less dependent on global state and it becomes generally more testable:

// Bad
class Router
{
    public function generate($path)
    {
        return $_SERVER['HOST'].$path;
    }
}

// Better
class Router
{
    private $host;

    public function __construct($host)
    {
        $this->host = $host;
    }

    public function generate($path)
    {
        return $this->host.$path;
    }
}

class Controller
{
    public function myAction(Request $request)
    {
        // Instead of
        $page = isset($_GET['page']) ? intval($_GET['page']) : 1;

        // Better (assuming you use the Symfony2 request)
        $page = $request->query->get('page', 1);
    }
}
Loading history...
672
		return isset( $_SERVER['REQUEST_METHOD'] ) ? $_SERVER['REQUEST_METHOD'] : 'GET';
673
	}
674
675
	/**
676
	 * Returns true if the present request was reached by a POST operation,
677
	 * false otherwise (GET, HEAD, or command-line).
678
	 *
679
	 * Note that values retrieved by the object may come from the
680
	 * GET URL etc even on a POST request.
681
	 *
682
	 * @return bool
683
	 */
684
	public function wasPosted() {
685
		return $this->getMethod() == 'POST';
686
	}
687
688
	/**
689
	 * Return the session for this request
690
	 * @since 1.27
691
	 * @note For performance, keep the session locally if you will be making
692
	 *  much use of it instead of calling this method repeatedly.
693
	 * @return Session
694
	 */
695
	public function getSession() {
696
		if ( $this->sessionId !== null ) {
697
			$session = SessionManager::singleton()->getSessionById( (string)$this->sessionId, true, $this );
698
			if ( $session ) {
699
				return $session;
700
			}
701
		}
702
703
		$session = SessionManager::singleton()->getSessionForRequest( $this );
704
		$this->sessionId = $session->getSessionId();
705
		return $session;
706
	}
707
708
	/**
709
	 * Set the session for this request
710
	 * @since 1.27
711
	 * @private For use by MediaWiki\Session classes only
712
	 * @param SessionId $sessionId
713
	 */
714
	public function setSessionId( SessionId $sessionId ) {
715
		$this->sessionId = $sessionId;
716
	}
717
718
	/**
719
	 * Get the session id for this request, if any
720
	 * @since 1.27
721
	 * @private For use by MediaWiki\Session classes only
722
	 * @return SessionId|null
723
	 */
724
	public function getSessionId() {
725
		return $this->sessionId;
726
	}
727
728
	/**
729
	 * Returns true if the request has a persistent session.
730
	 * This does not necessarily mean that the user is logged in!
731
	 *
732
	 * @deprecated since 1.27, use
733
	 *  \MediaWiki\Session\SessionManager::singleton()->getPersistedSessionId()
734
	 *  instead.
735
	 * @return bool
736
	 */
737
	public function checkSessionCookie() {
738
		global $wgInitialSessionId;
739
		wfDeprecated( __METHOD__, '1.27' );
740
		return $wgInitialSessionId !== null &&
741
			$this->getSession()->getId() === (string)$wgInitialSessionId;
742
	}
743
744
	/**
745
	 * Get a cookie from the $_COOKIE jar
746
	 *
747
	 * @param string $key The name of the cookie
748
	 * @param string $prefix A prefix to use for the cookie name, if not $wgCookiePrefix
749
	 * @param mixed $default What to return if the value isn't found
750
	 * @return mixed Cookie value or $default if the cookie not set
751
	 */
752
	public function getCookie( $key, $prefix = null, $default = null ) {
0 ignored issues
show
Coding Style introduced by
getCookie uses the super-global variable $_COOKIE which is generally not recommended.

Instead of super-globals, we recommend to explicitly inject the dependencies of your class. This makes your code less dependent on global state and it becomes generally more testable:

// Bad
class Router
{
    public function generate($path)
    {
        return $_SERVER['HOST'].$path;
    }
}

// Better
class Router
{
    private $host;

    public function __construct($host)
    {
        $this->host = $host;
    }

    public function generate($path)
    {
        return $this->host.$path;
    }
}

class Controller
{
    public function myAction(Request $request)
    {
        // Instead of
        $page = isset($_GET['page']) ? intval($_GET['page']) : 1;

        // Better (assuming you use the Symfony2 request)
        $page = $request->query->get('page', 1);
    }
}
Loading history...
753
		if ( $prefix === null ) {
754
			global $wgCookiePrefix;
755
			$prefix = $wgCookiePrefix;
756
		}
757
		return $this->getGPCVal( $_COOKIE, $prefix . $key, $default );
758
	}
759
760
	/**
761
	 * Return the path and query string portion of the main request URI.
762
	 * This will be suitable for use as a relative link in HTML output.
763
	 *
764
	 * @throws MWException
765
	 * @return string
766
	 */
767
	public static function getGlobalRequestURL() {
0 ignored issues
show
Coding Style introduced by
getGlobalRequestURL uses the super-global variable $_SERVER which is generally not recommended.

Instead of super-globals, we recommend to explicitly inject the dependencies of your class. This makes your code less dependent on global state and it becomes generally more testable:

// Bad
class Router
{
    public function generate($path)
    {
        return $_SERVER['HOST'].$path;
    }
}

// Better
class Router
{
    private $host;

    public function __construct($host)
    {
        $this->host = $host;
    }

    public function generate($path)
    {
        return $this->host.$path;
    }
}

class Controller
{
    public function myAction(Request $request)
    {
        // Instead of
        $page = isset($_GET['page']) ? intval($_GET['page']) : 1;

        // Better (assuming you use the Symfony2 request)
        $page = $request->query->get('page', 1);
    }
}
Loading history...
768
		if ( isset( $_SERVER['REQUEST_URI'] ) && strlen( $_SERVER['REQUEST_URI'] ) ) {
769
			$base = $_SERVER['REQUEST_URI'];
770
		} elseif ( isset( $_SERVER['HTTP_X_ORIGINAL_URL'] )
771
			&& strlen( $_SERVER['HTTP_X_ORIGINAL_URL'] )
772
		) {
773
			// Probably IIS; doesn't set REQUEST_URI
774
			$base = $_SERVER['HTTP_X_ORIGINAL_URL'];
775
		} elseif ( isset( $_SERVER['SCRIPT_NAME'] ) ) {
776
			$base = $_SERVER['SCRIPT_NAME'];
777
			if ( isset( $_SERVER['QUERY_STRING'] ) && $_SERVER['QUERY_STRING'] != '' ) {
778
				$base .= '?' . $_SERVER['QUERY_STRING'];
779
			}
780
		} else {
781
			// This shouldn't happen!
782
			throw new MWException( "Web server doesn't provide either " .
783
				"REQUEST_URI, HTTP_X_ORIGINAL_URL or SCRIPT_NAME. Report details " .
784
				"of your web server configuration to https://phabricator.wikimedia.org/" );
785
		}
786
		// User-agents should not send a fragment with the URI, but
787
		// if they do, and the web server passes it on to us, we
788
		// need to strip it or we get false-positive redirect loops
789
		// or weird output URLs
790
		$hash = strpos( $base, '#' );
791
		if ( $hash !== false ) {
792
			$base = substr( $base, 0, $hash );
793
		}
794
795
		if ( $base[0] == '/' ) {
796
			// More than one slash will look like it is protocol relative
797
			return preg_replace( '!^/+!', '/', $base );
798
		} else {
799
			// We may get paths with a host prepended; strip it.
800
			return preg_replace( '!^[^:]+://[^/]+/+!', '/', $base );
801
		}
802
	}
803
804
	/**
805
	 * Return the path and query string portion of the request URI.
806
	 * This will be suitable for use as a relative link in HTML output.
807
	 *
808
	 * @throws MWException
809
	 * @return string
810
	 */
811
	public function getRequestURL() {
812
		return self::getGlobalRequestURL();
813
	}
814
815
	/**
816
	 * Return the request URI with the canonical service and hostname, path,
817
	 * and query string. This will be suitable for use as an absolute link
818
	 * in HTML or other output.
819
	 *
820
	 * If $wgServer is protocol-relative, this will return a fully
821
	 * qualified URL with the protocol that was used for this request.
822
	 *
823
	 * @return string
824
	 */
825
	public function getFullRequestURL() {
826
		return wfExpandUrl( $this->getRequestURL(), PROTO_CURRENT );
827
	}
828
829
	/**
830
	 * @param string $key
831
	 * @param string $value
832
	 * @return string
833
	 */
834
	public function appendQueryValue( $key, $value ) {
835
		return $this->appendQueryArray( [ $key => $value ] );
836
	}
837
838
	/**
839
	 * Appends or replaces value of query variables.
840
	 *
841
	 * @param array $array Array of values to replace/add to query
842
	 * @return string
843
	 */
844
	public function appendQueryArray( $array ) {
845
		$newquery = $this->getQueryValues();
846
		unset( $newquery['title'] );
847
		$newquery = array_merge( $newquery, $array );
848
849
		return wfArrayToCgi( $newquery );
850
	}
851
852
	/**
853
	 * Check for limit and offset parameters on the input, and return sensible
854
	 * defaults if not given. The limit must be positive and is capped at 5000.
855
	 * Offset must be positive but is not capped.
856
	 *
857
	 * @param int $deflimit Limit to use if no input and the user hasn't set the option.
858
	 * @param string $optionname To specify an option other than rclimit to pull from.
859
	 * @return int[] First element is limit, second is offset
860
	 */
861
	public function getLimitOffset( $deflimit = 50, $optionname = 'rclimit' ) {
862
		global $wgUser;
863
864
		$limit = $this->getInt( 'limit', 0 );
865
		if ( $limit < 0 ) {
866
			$limit = 0;
867
		}
868
		if ( ( $limit == 0 ) && ( $optionname != '' ) ) {
869
			$limit = $wgUser->getIntOption( $optionname );
870
		}
871
		if ( $limit <= 0 ) {
872
			$limit = $deflimit;
873
		}
874
		if ( $limit > 5000 ) {
875
			$limit = 5000; # We have *some* limits...
876
		}
877
878
		$offset = $this->getInt( 'offset', 0 );
879
		if ( $offset < 0 ) {
880
			$offset = 0;
881
		}
882
883
		return [ $limit, $offset ];
884
	}
885
886
	/**
887
	 * Return the path to the temporary file where PHP has stored the upload.
888
	 *
889
	 * @param string $key
890
	 * @return string|null String or null if no such file.
891
	 */
892
	public function getFileTempname( $key ) {
893
		$file = new WebRequestUpload( $this, $key );
894
		return $file->getTempName();
895
	}
896
897
	/**
898
	 * Return the upload error or 0
899
	 *
900
	 * @param string $key
901
	 * @return int
902
	 */
903
	public function getUploadError( $key ) {
904
		$file = new WebRequestUpload( $this, $key );
905
		return $file->getError();
906
	}
907
908
	/**
909
	 * Return the original filename of the uploaded file, as reported by
910
	 * the submitting user agent. HTML-style character entities are
911
	 * interpreted and normalized to Unicode normalization form C, in part
912
	 * to deal with weird input from Safari with non-ASCII filenames.
913
	 *
914
	 * Other than this the name is not verified for being a safe filename.
915
	 *
916
	 * @param string $key
917
	 * @return string|null String or null if no such file.
918
	 */
919
	public function getFileName( $key ) {
920
		$file = new WebRequestUpload( $this, $key );
921
		return $file->getName();
922
	}
923
924
	/**
925
	 * Return a WebRequestUpload object corresponding to the key
926
	 *
927
	 * @param string $key
928
	 * @return WebRequestUpload
929
	 */
930
	public function getUpload( $key ) {
931
		return new WebRequestUpload( $this, $key );
932
	}
933
934
	/**
935
	 * Return a handle to WebResponse style object, for setting cookies,
936
	 * headers and other stuff, for Request being worked on.
937
	 *
938
	 * @return WebResponse
939
	 */
940
	public function response() {
941
		/* Lazy initialization of response object for this request */
942
		if ( !is_object( $this->response ) ) {
943
			$class = ( $this instanceof FauxRequest ) ? 'FauxResponse' : 'WebResponse';
944
			$this->response = new $class();
945
		}
946
		return $this->response;
947
	}
948
949
	/**
950
	 * Initialise the header list
951
	 */
952
	protected function initHeaders() {
0 ignored issues
show
Coding Style introduced by
initHeaders uses the super-global variable $_SERVER which is generally not recommended.

Instead of super-globals, we recommend to explicitly inject the dependencies of your class. This makes your code less dependent on global state and it becomes generally more testable:

// Bad
class Router
{
    public function generate($path)
    {
        return $_SERVER['HOST'].$path;
    }
}

// Better
class Router
{
    private $host;

    public function __construct($host)
    {
        $this->host = $host;
    }

    public function generate($path)
    {
        return $this->host.$path;
    }
}

class Controller
{
    public function myAction(Request $request)
    {
        // Instead of
        $page = isset($_GET['page']) ? intval($_GET['page']) : 1;

        // Better (assuming you use the Symfony2 request)
        $page = $request->query->get('page', 1);
    }
}
Loading history...
953
		if ( count( $this->headers ) ) {
954
			return;
955
		}
956
957
		$apacheHeaders = function_exists( 'apache_request_headers' ) ? apache_request_headers() : false;
958
		if ( $apacheHeaders ) {
959
			foreach ( $apacheHeaders as $tempName => $tempValue ) {
960
				$this->headers[strtoupper( $tempName )] = $tempValue;
961
			}
962
		} else {
963
			foreach ( $_SERVER as $name => $value ) {
964
				if ( substr( $name, 0, 5 ) === 'HTTP_' ) {
965
					$name = str_replace( '_', '-', substr( $name, 5 ) );
966
					$this->headers[$name] = $value;
967
				} elseif ( $name === 'CONTENT_LENGTH' ) {
968
					$this->headers['CONTENT-LENGTH'] = $value;
969
				}
970
			}
971
		}
972
	}
973
974
	/**
975
	 * Get an array containing all request headers
976
	 *
977
	 * @return array Mapping header name to its value
978
	 */
979
	public function getAllHeaders() {
980
		$this->initHeaders();
981
		return $this->headers;
982
	}
983
984
	/**
985
	 * Get a request header, or false if it isn't set.
986
	 *
987
	 * @param string $name Case-insensitive header name
988
	 * @param int $flags Bitwise combination of:
989
	 *   WebRequest::GETHEADER_LIST  Treat the header as a comma-separated list
990
	 *                               of values, as described in RFC 2616 § 4.2.
991
	 *                               (since 1.26).
992
	 * @return string|array|bool False if header is unset; otherwise the
993
	 *  header value(s) as either a string (the default) or an array, if
994
	 *  WebRequest::GETHEADER_LIST flag was set.
995
	 */
996
	public function getHeader( $name, $flags = 0 ) {
997
		$this->initHeaders();
998
		$name = strtoupper( $name );
999
		if ( !isset( $this->headers[$name] ) ) {
1000
			return false;
1001
		}
1002
		$value = $this->headers[$name];
1003
		if ( $flags & self::GETHEADER_LIST ) {
1004
			$value = array_map( 'trim', explode( ',', $value ) );
1005
		}
1006
		return $value;
1007
	}
1008
1009
	/**
1010
	 * Get data from the session
1011
	 *
1012
	 * @note Prefer $this->getSession() instead if making multiple calls.
1013
	 * @param string $key Name of key in the session
1014
	 * @return mixed
1015
	 */
1016
	public function getSessionData( $key ) {
1017
		return $this->getSession()->get( $key );
1018
	}
1019
1020
	/**
1021
	 * Set session data
1022
	 *
1023
	 * @note Prefer $this->getSession() instead if making multiple calls.
1024
	 * @param string $key Name of key in the session
1025
	 * @param mixed $data
1026
	 */
1027
	public function setSessionData( $key, $data ) {
1028
		$this->getSession()->set( $key, $data );
1029
	}
1030
1031
	/**
1032
	 * Check if Internet Explorer will detect an incorrect cache extension in
1033
	 * PATH_INFO or QUERY_STRING. If the request can't be allowed, show an error
1034
	 * message or redirect to a safer URL. Returns true if the URL is OK, and
1035
	 * false if an error message has been shown and the request should be aborted.
1036
	 *
1037
	 * @param array $extWhitelist
1038
	 * @throws HttpError
1039
	 * @return bool
1040
	 */
1041
	public function checkUrlExtension( $extWhitelist = [] ) {
0 ignored issues
show
Coding Style introduced by
checkUrlExtension uses the super-global variable $_SERVER which is generally not recommended.

Instead of super-globals, we recommend to explicitly inject the dependencies of your class. This makes your code less dependent on global state and it becomes generally more testable:

// Bad
class Router
{
    public function generate($path)
    {
        return $_SERVER['HOST'].$path;
    }
}

// Better
class Router
{
    private $host;

    public function __construct($host)
    {
        $this->host = $host;
    }

    public function generate($path)
    {
        return $this->host.$path;
    }
}

class Controller
{
    public function myAction(Request $request)
    {
        // Instead of
        $page = isset($_GET['page']) ? intval($_GET['page']) : 1;

        // Better (assuming you use the Symfony2 request)
        $page = $request->query->get('page', 1);
    }
}
Loading history...
1042
		$extWhitelist[] = 'php';
1043
		if ( IEUrlExtension::areServerVarsBad( $_SERVER, $extWhitelist ) ) {
1044
			if ( !$this->wasPosted() ) {
1045
				$newUrl = IEUrlExtension::fixUrlForIE6(
1046
					$this->getFullRequestURL(), $extWhitelist );
1047
				if ( $newUrl !== false ) {
1048
					$this->doSecurityRedirect( $newUrl );
1049
					return false;
1050
				}
1051
			}
1052
			throw new HttpError( 403,
1053
				'Invalid file extension found in the path info or query string.' );
1054
		}
1055
		return true;
1056
	}
1057
1058
	/**
1059
	 * Attempt to redirect to a URL with a QUERY_STRING that's not dangerous in
1060
	 * IE 6. Returns true if it was successful, false otherwise.
1061
	 *
1062
	 * @param string $url
1063
	 * @return bool
1064
	 */
1065
	protected function doSecurityRedirect( $url ) {
1066
		header( 'Location: ' . $url );
1067
		header( 'Content-Type: text/html' );
1068
		$encUrl = htmlspecialchars( $url );
1069
		echo <<<HTML
1070
<html>
1071
<head>
1072
<title>Security redirect</title>
1073
</head>
1074
<body>
1075
<h1>Security redirect</h1>
1076
<p>
1077
We can't serve non-HTML content from the URL you have requested, because
1078
Internet Explorer would interpret it as an incorrect and potentially dangerous
1079
content type.</p>
1080
<p>Instead, please use <a href="$encUrl">this URL</a>, which is the same as the
1081
URL you have requested, except that "&amp;*" is appended. This prevents Internet
1082
Explorer from seeing a bogus file extension.
1083
</p>
1084
</body>
1085
</html>
1086
HTML;
1087
		echo "\n";
1088
		return true;
1089
	}
1090
1091
	/**
1092
	 * Parse the Accept-Language header sent by the client into an array
1093
	 *
1094
	 * @return array Array( languageCode => q-value ) sorted by q-value in
1095
	 *   descending order then appearing time in the header in ascending order.
1096
	 * May contain the "language" '*', which applies to languages other than those explicitly listed.
1097
	 * This is aligned with rfc2616 section 14.4
1098
	 * Preference for earlier languages appears in rfc3282 as an extension to HTTP/1.1.
1099
	 */
1100
	public function getAcceptLang() {
1101
		// Modified version of code found at
1102
		// http://www.thefutureoftheweb.com/blog/use-accept-language-header
1103
		$acceptLang = $this->getHeader( 'Accept-Language' );
1104
		if ( !$acceptLang ) {
1105
			return [];
1106
		}
1107
1108
		// Return the language codes in lower case
1109
		$acceptLang = strtolower( $acceptLang );
1110
1111
		// Break up string into pieces (languages and q factors)
1112
		$lang_parse = null;
1113
		preg_match_all(
1114
			'/([a-z]{1,8}(-[a-z]{1,8})*|\*)\s*(;\s*q\s*=\s*(1(\.0{0,3})?|0(\.[0-9]{0,3})?)?)?/',
1115
			$acceptLang,
1116
			$lang_parse
1117
		);
1118
1119
		if ( !count( $lang_parse[1] ) ) {
1120
			return [];
1121
		}
1122
1123
		$langcodes = $lang_parse[1];
1124
		$qvalues = $lang_parse[4];
1125
		$indices = range( 0, count( $lang_parse[1] ) - 1 );
1126
1127
		// Set default q factor to 1
1128
		foreach ( $indices as $index ) {
1129
			if ( $qvalues[$index] === '' ) {
1130
				$qvalues[$index] = 1;
1131
			} elseif ( $qvalues[$index] == 0 ) {
1132
				unset( $langcodes[$index], $qvalues[$index], $indices[$index] );
1133
			}
1134
		}
1135
1136
		// Sort list. First by $qvalues, then by order. Reorder $langcodes the same way
1137
		array_multisort( $qvalues, SORT_DESC, SORT_NUMERIC, $indices, $langcodes );
1138
1139
		// Create a list like "en" => 0.8
1140
		$langs = array_combine( $langcodes, $qvalues );
1141
1142
		return $langs;
1143
	}
1144
1145
	/**
1146
	 * Fetch the raw IP from the request
1147
	 *
1148
	 * @since 1.19
1149
	 *
1150
	 * @throws MWException
1151
	 * @return string
1152
	 */
1153
	protected function getRawIP() {
0 ignored issues
show
Coding Style introduced by
getRawIP uses the super-global variable $_SERVER which is generally not recommended.

Instead of super-globals, we recommend to explicitly inject the dependencies of your class. This makes your code less dependent on global state and it becomes generally more testable:

// Bad
class Router
{
    public function generate($path)
    {
        return $_SERVER['HOST'].$path;
    }
}

// Better
class Router
{
    private $host;

    public function __construct($host)
    {
        $this->host = $host;
    }

    public function generate($path)
    {
        return $this->host.$path;
    }
}

class Controller
{
    public function myAction(Request $request)
    {
        // Instead of
        $page = isset($_GET['page']) ? intval($_GET['page']) : 1;

        // Better (assuming you use the Symfony2 request)
        $page = $request->query->get('page', 1);
    }
}
Loading history...
1154
		if ( !isset( $_SERVER['REMOTE_ADDR'] ) ) {
1155
			return null;
1156
		}
1157
1158
		if ( is_array( $_SERVER['REMOTE_ADDR'] ) || strpos( $_SERVER['REMOTE_ADDR'], ',' ) !== false ) {
1159
			throw new MWException( __METHOD__
1160
				. " : Could not determine the remote IP address due to multiple values." );
1161
		} else {
1162
			$ipchain = $_SERVER['REMOTE_ADDR'];
1163
		}
1164
1165
		return IP::canonicalize( $ipchain );
1166
	}
1167
1168
	/**
1169
	 * Work out the IP address based on various globals
1170
	 * For trusted proxies, use the XFF client IP (first of the chain)
1171
	 *
1172
	 * @since 1.19
1173
	 *
1174
	 * @throws MWException
1175
	 * @return string
1176
	 */
1177
	public function getIP() {
1178
		global $wgUsePrivateIPs;
1179
1180
		# Return cached result
1181
		if ( $this->ip !== null ) {
1182
			return $this->ip;
1183
		}
1184
1185
		# collect the originating ips
1186
		$ip = $this->getRawIP();
1187
		if ( !$ip ) {
0 ignored issues
show
Bug Best Practice introduced by
The expression $ip of type null|string is loosely compared to false; this is ambiguous if the string can be empty. You might want to explicitly use === null instead.

In PHP, under loose comparison (like ==, or !=, or switch conditions), values of different types might be equal.

For string values, the empty string '' is a special case, in particular the following results might be unexpected:

''   == false // true
''   == null  // true
'ab' == false // false
'ab' == null  // false

// It is often better to use strict comparison
'' === false // false
'' === null  // false
Loading history...
1188
			throw new MWException( 'Unable to determine IP.' );
1189
		}
1190
1191
		# Append XFF
1192
		$forwardedFor = $this->getHeader( 'X-Forwarded-For' );
1193
		if ( $forwardedFor !== false ) {
1194
			$isConfigured = IP::isConfiguredProxy( $ip );
1195
			$ipchain = array_map( 'trim', explode( ',', $forwardedFor ) );
1196
			$ipchain = array_reverse( $ipchain );
1197
			array_unshift( $ipchain, $ip );
1198
1199
			# Step through XFF list and find the last address in the list which is a
1200
			# trusted server. Set $ip to the IP address given by that trusted server,
1201
			# unless the address is not sensible (e.g. private). However, prefer private
1202
			# IP addresses over proxy servers controlled by this site (more sensible).
1203
			# Note that some XFF values might be "unknown" with Squid/Varnish.
1204
			foreach ( $ipchain as $i => $curIP ) {
1205
				$curIP = IP::sanitizeIP( IP::canonicalize( $curIP ) );
1206
				if ( !$curIP || !isset( $ipchain[$i + 1] ) || $ipchain[$i + 1] === 'unknown'
0 ignored issues
show
Bug Best Practice introduced by
The expression $curIP of type null|string is loosely compared to false; this is ambiguous if the string can be empty. You might want to explicitly use === null instead.

In PHP, under loose comparison (like ==, or !=, or switch conditions), values of different types might be equal.

For string values, the empty string '' is a special case, in particular the following results might be unexpected:

''   == false // true
''   == null  // true
'ab' == false // false
'ab' == null  // false

// It is often better to use strict comparison
'' === false // false
'' === null  // false
Loading history...
1207
					|| !IP::isTrustedProxy( $curIP )
1208
				) {
1209
					break; // IP is not valid/trusted or does not point to anything
1210
				}
1211
				if (
1212
					IP::isPublic( $ipchain[$i + 1] ) ||
1213
					$wgUsePrivateIPs ||
1214
					IP::isConfiguredProxy( $curIP ) // bug 48919; treat IP as sane
1215
				) {
1216
					// Follow the next IP according to the proxy
1217
					$nextIP = IP::canonicalize( $ipchain[$i + 1] );
1218
					if ( !$nextIP && $isConfigured ) {
0 ignored issues
show
Bug Best Practice introduced by
The expression $nextIP of type string|null is loosely compared to false; this is ambiguous if the string can be empty. You might want to explicitly use === null instead.

In PHP, under loose comparison (like ==, or !=, or switch conditions), values of different types might be equal.

For string values, the empty string '' is a special case, in particular the following results might be unexpected:

''   == false // true
''   == null  // true
'ab' == false // false
'ab' == null  // false

// It is often better to use strict comparison
'' === false // false
'' === null  // false
Loading history...
1219
						// We have not yet made it past CDN/proxy servers of this site,
1220
						// so either they are misconfigured or there is some IP spoofing.
1221
						throw new MWException( "Invalid IP given in XFF '$forwardedFor'." );
1222
					}
1223
					$ip = $nextIP;
1224
					// keep traversing the chain
1225
					continue;
1226
				}
1227
				break;
1228
			}
1229
		}
1230
1231
		# Allow extensions to improve our guess
1232
		Hooks::run( 'GetIP', [ &$ip ] );
1233
1234
		if ( !$ip ) {
0 ignored issues
show
Bug Best Practice introduced by
The expression $ip of type string|null is loosely compared to false; this is ambiguous if the string can be empty. You might want to explicitly use === null instead.

In PHP, under loose comparison (like ==, or !=, or switch conditions), values of different types might be equal.

For string values, the empty string '' is a special case, in particular the following results might be unexpected:

''   == false // true
''   == null  // true
'ab' == false // false
'ab' == null  // false

// It is often better to use strict comparison
'' === false // false
'' === null  // false
Loading history...
1235
			throw new MWException( "Unable to determine IP." );
1236
		}
1237
1238
		wfDebug( "IP: $ip\n" );
1239
		$this->ip = $ip;
1240
		return $ip;
1241
	}
1242
1243
	/**
1244
	 * @param string $ip
1245
	 * @return void
1246
	 * @since 1.21
1247
	 */
1248
	public function setIP( $ip ) {
1249
		$this->ip = $ip;
1250
	}
1251
1252
	/**
1253
	 * Check if this request uses a "safe" HTTP method
1254
	 *
1255
	 * Safe methods are verbs (e.g. GET/HEAD/OPTIONS) used for obtaining content. Such requests
1256
	 * are not expected to mutate content, especially in ways attributable to the client. Verbs
1257
	 * like POST and PUT are typical of non-safe requests which often change content.
1258
	 *
1259
	 * @return bool
1260
	 * @see https://tools.ietf.org/html/rfc7231#section-4.2.1
1261
	 * @see https://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html
1262
	 * @since 1.28
1263
	 */
1264
	public function hasSafeMethod() {
0 ignored issues
show
Coding Style introduced by
hasSafeMethod uses the super-global variable $_SERVER which is generally not recommended.

Instead of super-globals, we recommend to explicitly inject the dependencies of your class. This makes your code less dependent on global state and it becomes generally more testable:

// Bad
class Router
{
    public function generate($path)
    {
        return $_SERVER['HOST'].$path;
    }
}

// Better
class Router
{
    private $host;

    public function __construct($host)
    {
        $this->host = $host;
    }

    public function generate($path)
    {
        return $this->host.$path;
    }
}

class Controller
{
    public function myAction(Request $request)
    {
        // Instead of
        $page = isset($_GET['page']) ? intval($_GET['page']) : 1;

        // Better (assuming you use the Symfony2 request)
        $page = $request->query->get('page', 1);
    }
}
Loading history...
1265
		if ( !isset( $_SERVER['REQUEST_METHOD'] ) ) {
1266
			return false; // CLI mode
1267
		}
1268
1269
		return in_array( $_SERVER['REQUEST_METHOD'], [ 'GET', 'HEAD', 'OPTIONS', 'TRACE' ] );
1270
	}
1271
1272
	/**
1273
	 * Whether this request should be identified as being "safe"
1274
	 *
1275
	 * This means that the client is not requesting any state changes and that database writes
1276
	 * are not inherently required. Ideally, no visible updates would happen at all. If they
1277
	 * must, then they should not be publically attributed to the end user.
1278
	 *
1279
	 * In more detail:
1280
	 *   - Cache populations and refreshes MAY occur.
1281
	 *   - Private user session updates and private server logging MAY occur.
1282
	 *   - Updates to private viewing activity data MAY occur via DeferredUpdates.
1283
	 *   - Other updates SHOULD NOT occur (e.g. modifying content assets).
1284
	 *
1285
	 * @return bool
1286
	 * @see https://tools.ietf.org/html/rfc7231#section-4.2.1
1287
	 * @see https://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html
1288
	 * @since 1.28
1289
	 */
1290
	public function isSafeRequest() {
1291
		if ( $this->markedAsSafe && $this->wasPosted() ) {
1292
			return true; // marked as a "safe" POST
1293
		}
1294
1295
		return $this->hasSafeMethod();
1296
	}
1297
1298
	/**
1299
	 * Mark this request as identified as being nullipotent even if it is a POST request
1300
	 *
1301
	 * POST requests are often used due to the need for a client payload, even if the request
1302
	 * is otherwise equivalent to a "safe method" request.
1303
	 *
1304
	 * @see https://tools.ietf.org/html/rfc7231#section-4.2.1
1305
	 * @see https://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html
1306
	 * @since 1.28
1307
	 */
1308
	public function markAsSafeRequest() {
1309
		$this->markedAsSafe = true;
1310
	}
1311
}
1312