wikimedia /
mediawiki
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | /** |
||
| 3 | * Helper functions for feeds. |
||
| 4 | * |
||
| 5 | * This program is free software; you can redistribute it and/or modify |
||
| 6 | * it under the terms of the GNU General Public License as published by |
||
| 7 | * the Free Software Foundation; either version 2 of the License, or |
||
| 8 | * (at your option) any later version. |
||
| 9 | * |
||
| 10 | * This program is distributed in the hope that it will be useful, |
||
| 11 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
||
| 12 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||
| 13 | * GNU General Public License for more details. |
||
| 14 | * |
||
| 15 | * You should have received a copy of the GNU General Public License along |
||
| 16 | * with this program; if not, write to the Free Software Foundation, Inc., |
||
| 17 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. |
||
| 18 | * http://www.gnu.org/copyleft/gpl.html |
||
| 19 | * |
||
| 20 | * @file |
||
| 21 | * @ingroup Feed |
||
| 22 | */ |
||
| 23 | |||
| 24 | /** |
||
| 25 | * Helper functions for feeds |
||
| 26 | * |
||
| 27 | * @ingroup Feed |
||
| 28 | */ |
||
| 29 | class FeedUtils { |
||
| 30 | |||
| 31 | /** |
||
| 32 | * Check whether feed's cache should be cleared; for changes feeds |
||
| 33 | * If the feed should be purged; $timekey and $key will be removed from cache |
||
| 34 | * |
||
| 35 | * @param string $timekey Cache key of the timestamp of the last item |
||
| 36 | * @param string $key Cache key of feed's content |
||
| 37 | */ |
||
| 38 | public static function checkPurge( $timekey, $key ) { |
||
| 39 | global $wgRequest, $wgUser; |
||
| 40 | |||
| 41 | $purge = $wgRequest->getVal( 'action' ) === 'purge'; |
||
| 42 | // Allow users with 'purge' right to clear feed caches |
||
| 43 | if ( $purge && $wgUser->isAllowed( 'purge' ) ) { |
||
| 44 | $cache = ObjectCache::getMainWANInstance(); |
||
| 45 | $cache->delete( $timekey, 1 ); |
||
| 46 | $cache->delete( $key, 1 ); |
||
| 47 | } |
||
| 48 | } |
||
| 49 | |||
| 50 | /** |
||
| 51 | * Check whether feeds can be used and that $type is a valid feed type |
||
| 52 | * |
||
| 53 | * @param string $type Feed type, as requested by the user |
||
| 54 | * @return bool |
||
| 55 | */ |
||
| 56 | public static function checkFeedOutput( $type ) { |
||
| 57 | global $wgOut, $wgFeed, $wgFeedClasses; |
||
| 58 | |||
| 59 | if ( !$wgFeed ) { |
||
| 60 | $wgOut->addWikiMsg( 'feed-unavailable' ); |
||
| 61 | return false; |
||
| 62 | } |
||
| 63 | |||
| 64 | if ( !isset( $wgFeedClasses[$type] ) ) { |
||
| 65 | $wgOut->addWikiMsg( 'feed-invalid' ); |
||
| 66 | return false; |
||
| 67 | } |
||
| 68 | |||
| 69 | return true; |
||
| 70 | } |
||
| 71 | |||
| 72 | /** |
||
| 73 | * Format a diff for the newsfeed |
||
| 74 | * |
||
| 75 | * @param object $row Row from the recentchanges table |
||
| 76 | * @return string |
||
| 77 | */ |
||
| 78 | public static function formatDiff( $row ) { |
||
| 79 | $titleObj = Title::makeTitle( $row->rc_namespace, $row->rc_title ); |
||
| 80 | $timestamp = wfTimestamp( TS_MW, $row->rc_timestamp ); |
||
| 81 | $actiontext = ''; |
||
| 82 | if ( $row->rc_type == RC_LOG ) { |
||
| 83 | $rcRow = (array)$row; // newFromRow() only accepts arrays for RC rows |
||
| 84 | $actiontext = LogFormatter::newFromRow( $rcRow )->getActionText(); |
||
| 85 | } |
||
| 86 | return self::formatDiffRow( $titleObj, |
||
| 87 | $row->rc_last_oldid, $row->rc_this_oldid, |
||
| 88 | $timestamp, |
||
| 89 | $row->rc_deleted & Revision::DELETED_COMMENT |
||
| 90 | ? wfMessage( 'rev-deleted-comment' )->escaped() |
||
| 91 | : $row->rc_comment, |
||
| 92 | $actiontext |
||
| 93 | ); |
||
| 94 | } |
||
| 95 | |||
| 96 | /** |
||
| 97 | * Really format a diff for the newsfeed |
||
| 98 | * |
||
| 99 | * @param Title $title Title object |
||
| 100 | * @param int $oldid Old revision's id |
||
| 101 | * @param int $newid New revision's id |
||
| 102 | * @param int $timestamp New revision's timestamp |
||
| 103 | * @param string $comment New revision's comment |
||
| 104 | * @param string $actiontext Text of the action; in case of log event |
||
| 105 | * @return string |
||
| 106 | */ |
||
| 107 | public static function formatDiffRow( $title, $oldid, $newid, $timestamp, |
||
| 108 | $comment, $actiontext = '' |
||
| 109 | ) { |
||
| 110 | global $wgFeedDiffCutoff, $wgLang; |
||
| 111 | |||
| 112 | // log entries |
||
| 113 | $completeText = '<p>' . implode( ' ', |
||
| 114 | array_filter( |
||
| 115 | [ |
||
| 116 | $actiontext, |
||
| 117 | Linker::formatComment( $comment ) ] ) ) . "</p>\n"; |
||
| 118 | |||
| 119 | // NOTE: Check permissions for anonymous users, not current user. |
||
| 120 | // No "privileged" version should end up in the cache. |
||
| 121 | // Most feed readers will not log in anyway. |
||
| 122 | $anon = new User(); |
||
| 123 | $accErrors = $title->getUserPermissionsErrors( 'read', $anon, true ); |
||
| 124 | |||
| 125 | // Can't diff special pages, unreadable pages or pages with no new revision |
||
| 126 | // to compare against: just return the text. |
||
| 127 | if ( $title->getNamespace() < 0 || $accErrors || !$newid ) { |
||
| 128 | return $completeText; |
||
| 129 | } |
||
| 130 | |||
| 131 | if ( $oldid ) { |
||
| 132 | |||
| 133 | # $diffText = $de->getDiff( wfMessage( 'revisionasof', |
||
| 134 | # $wgLang->timeanddate( $timestamp ), |
||
| 135 | # $wgLang->date( $timestamp ), |
||
| 136 | # $wgLang->time( $timestamp ) )->text(), |
||
| 137 | # wfMessage( 'currentrev' )->text() ); |
||
| 138 | |||
| 139 | $diffText = ''; |
||
| 140 | // Don't bother generating the diff if we won't be able to show it |
||
| 141 | if ( $wgFeedDiffCutoff > 0 ) { |
||
| 142 | $rev = Revision::newFromId( $oldid ); |
||
| 143 | |||
| 144 | if ( !$rev ) { |
||
| 145 | $diffText = false; |
||
| 146 | } else { |
||
| 147 | $context = clone RequestContext::getMain(); |
||
| 148 | $context->setTitle( $title ); |
||
| 149 | |||
| 150 | $contentHandler = $rev->getContentHandler(); |
||
| 151 | $de = $contentHandler->createDifferenceEngine( $context, $oldid, $newid ); |
||
| 152 | $diffText = $de->getDiff( |
||
| 153 | wfMessage( 'previousrevision' )->text(), // hack |
||
| 154 | wfMessage( 'revisionasof', |
||
| 155 | $wgLang->timeanddate( $timestamp ), |
||
| 156 | $wgLang->date( $timestamp ), |
||
| 157 | $wgLang->time( $timestamp ) )->text() ); |
||
| 158 | } |
||
| 159 | } |
||
| 160 | |||
| 161 | if ( $wgFeedDiffCutoff <= 0 || ( strlen( $diffText ) > $wgFeedDiffCutoff ) ) { |
||
| 162 | // Omit large diffs |
||
| 163 | $diffText = self::getDiffLink( $title, $newid, $oldid ); |
||
| 164 | } elseif ( $diffText === false ) { |
||
| 165 | // Error in diff engine, probably a missing revision |
||
| 166 | $diffText = "<p>Can't load revision $newid</p>"; |
||
| 167 | } else { |
||
| 168 | // Diff output fine, clean up any illegal UTF-8 |
||
| 169 | $diffText = UtfNormal\Validator::cleanUp( $diffText ); |
||
| 170 | $diffText = self::applyDiffStyle( $diffText ); |
||
| 171 | } |
||
| 172 | } else { |
||
| 173 | $rev = Revision::newFromId( $newid ); |
||
| 174 | if ( $wgFeedDiffCutoff <= 0 || is_null( $rev ) ) { |
||
| 175 | $newContent = ContentHandler::getForTitle( $title )->makeEmptyContent(); |
||
| 176 | } else { |
||
| 177 | $newContent = $rev->getContent(); |
||
| 178 | } |
||
| 179 | |||
| 180 | if ( $newContent instanceof TextContent ) { |
||
| 181 | // only textual content has a "source view". |
||
| 182 | $text = $newContent->getNativeData(); |
||
| 183 | |||
| 184 | if ( $wgFeedDiffCutoff <= 0 || strlen( $text ) > $wgFeedDiffCutoff ) { |
||
| 185 | $html = null; |
||
| 186 | } else { |
||
| 187 | $html = nl2br( htmlspecialchars( $text ) ); |
||
| 188 | } |
||
| 189 | } else { |
||
| 190 | // XXX: we could get an HTML representation of the content via getParserOutput, but that may |
||
| 191 | // contain JS magic and generally may not be suitable for inclusion in a feed. |
||
| 192 | // Perhaps Content should have a getDescriptiveHtml method and/or a getSourceText method. |
||
| 193 | // Compare also ApiFeedContributions::feedItemDesc |
||
| 194 | $html = null; |
||
| 195 | } |
||
| 196 | |||
| 197 | if ( $html === null ) { |
||
| 198 | |||
| 199 | // Omit large new page diffs, bug 29110 |
||
| 200 | // Also use diff link for non-textual content |
||
| 201 | $diffText = self::getDiffLink( $title, $newid ); |
||
| 202 | } else { |
||
| 203 | $diffText = '<p><b>' . wfMessage( 'newpage' )->text() . '</b></p>' . |
||
| 204 | '<div>' . $html . '</div>'; |
||
| 205 | } |
||
| 206 | } |
||
| 207 | $completeText .= $diffText; |
||
| 208 | |||
| 209 | return $completeText; |
||
| 210 | } |
||
| 211 | |||
| 212 | /** |
||
| 213 | * Generates a diff link. Used when the full diff is not wanted for example |
||
| 214 | * when $wgFeedDiffCutoff is 0. |
||
| 215 | * |
||
| 216 | * @param Title $title Title object: used to generate the diff URL |
||
| 217 | * @param int $newid Newid for this diff |
||
| 218 | * @param int|null $oldid Oldid for the diff. Null means it is a new article |
||
| 219 | * @return string |
||
| 220 | */ |
||
| 221 | protected static function getDiffLink( Title $title, $newid, $oldid = null ) { |
||
| 222 | $queryParameters = [ 'diff' => $newid ]; |
||
| 223 | if ( $oldid != null ) { |
||
|
0 ignored issues
–
show
Bug
Best Practice
introduced
by
Loading history...
|
|||
| 224 | $queryParameters['oldid'] = $oldid; |
||
| 225 | } |
||
| 226 | $diffUrl = $title->getFullURL( $queryParameters ); |
||
| 227 | |||
| 228 | $diffLink = Html::element( 'a', [ 'href' => $diffUrl ], |
||
| 229 | wfMessage( 'showdiff' )->inContentLanguage()->text() ); |
||
| 230 | |||
| 231 | return $diffLink; |
||
| 232 | } |
||
| 233 | |||
| 234 | /** |
||
| 235 | * Hacky application of diff styles for the feeds. |
||
| 236 | * Might be 'cleaner' to use DOM or XSLT or something, |
||
| 237 | * but *gack* it's a pain in the ass. |
||
| 238 | * |
||
| 239 | * @param string $text Diff's HTML output |
||
| 240 | * @return string Modified HTML |
||
| 241 | */ |
||
| 242 | public static function applyDiffStyle( $text ) { |
||
| 243 | $styles = [ |
||
| 244 | 'diff' => 'background-color: white; color:black;', |
||
| 245 | 'diff-otitle' => 'background-color: white; color:black; text-align: center;', |
||
| 246 | 'diff-ntitle' => 'background-color: white; color:black; text-align: center;', |
||
| 247 | 'diff-addedline' => 'color:black; font-size: 88%; border-style: solid; ' |
||
| 248 | . 'border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; ' |
||
| 249 | . 'vertical-align: top; white-space: pre-wrap;', |
||
| 250 | 'diff-deletedline' => 'color:black; font-size: 88%; border-style: solid; ' |
||
| 251 | . 'border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; ' |
||
| 252 | . 'vertical-align: top; white-space: pre-wrap;', |
||
| 253 | 'diff-context' => 'background-color: #f9f9f9; color: #333333; font-size: 88%; ' |
||
| 254 | . 'border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; ' |
||
| 255 | . 'border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;', |
||
| 256 | 'diffchange' => 'font-weight: bold; text-decoration: none;', |
||
| 257 | ]; |
||
| 258 | |||
| 259 | foreach ( $styles as $class => $style ) { |
||
| 260 | $text = preg_replace( "/(<[^>]+)class=(['\"])$class\\2([^>]*>)/", |
||
| 261 | "\\1style=\"$style\"\\3", $text ); |
||
| 262 | } |
||
| 263 | |||
| 264 | return $text; |
||
| 265 | } |
||
| 266 | |||
| 267 | } |
||
| 268 |