This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | /** |
||
3 | * Helper functions for feeds. |
||
4 | * |
||
5 | * This program is free software; you can redistribute it and/or modify |
||
6 | * it under the terms of the GNU General Public License as published by |
||
7 | * the Free Software Foundation; either version 2 of the License, or |
||
8 | * (at your option) any later version. |
||
9 | * |
||
10 | * This program is distributed in the hope that it will be useful, |
||
11 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
||
12 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||
13 | * GNU General Public License for more details. |
||
14 | * |
||
15 | * You should have received a copy of the GNU General Public License along |
||
16 | * with this program; if not, write to the Free Software Foundation, Inc., |
||
17 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. |
||
18 | * http://www.gnu.org/copyleft/gpl.html |
||
19 | * |
||
20 | * @file |
||
21 | * @ingroup Feed |
||
22 | */ |
||
23 | |||
24 | /** |
||
25 | * Helper functions for feeds |
||
26 | * |
||
27 | * @ingroup Feed |
||
28 | */ |
||
29 | class FeedUtils { |
||
30 | |||
31 | /** |
||
32 | * Check whether feed's cache should be cleared; for changes feeds |
||
33 | * If the feed should be purged; $timekey and $key will be removed from cache |
||
34 | * |
||
35 | * @param string $timekey Cache key of the timestamp of the last item |
||
36 | * @param string $key Cache key of feed's content |
||
37 | */ |
||
38 | public static function checkPurge( $timekey, $key ) { |
||
39 | global $wgRequest, $wgUser; |
||
40 | |||
41 | $purge = $wgRequest->getVal( 'action' ) === 'purge'; |
||
42 | // Allow users with 'purge' right to clear feed caches |
||
43 | if ( $purge && $wgUser->isAllowed( 'purge' ) ) { |
||
44 | $cache = ObjectCache::getMainWANInstance(); |
||
45 | $cache->delete( $timekey, 1 ); |
||
46 | $cache->delete( $key, 1 ); |
||
47 | } |
||
48 | } |
||
49 | |||
50 | /** |
||
51 | * Check whether feeds can be used and that $type is a valid feed type |
||
52 | * |
||
53 | * @param string $type Feed type, as requested by the user |
||
54 | * @return bool |
||
55 | */ |
||
56 | public static function checkFeedOutput( $type ) { |
||
57 | global $wgOut, $wgFeed, $wgFeedClasses; |
||
58 | |||
59 | if ( !$wgFeed ) { |
||
60 | $wgOut->addWikiMsg( 'feed-unavailable' ); |
||
61 | return false; |
||
62 | } |
||
63 | |||
64 | if ( !isset( $wgFeedClasses[$type] ) ) { |
||
65 | $wgOut->addWikiMsg( 'feed-invalid' ); |
||
66 | return false; |
||
67 | } |
||
68 | |||
69 | return true; |
||
70 | } |
||
71 | |||
72 | /** |
||
73 | * Format a diff for the newsfeed |
||
74 | * |
||
75 | * @param object $row Row from the recentchanges table |
||
76 | * @return string |
||
77 | */ |
||
78 | public static function formatDiff( $row ) { |
||
79 | $titleObj = Title::makeTitle( $row->rc_namespace, $row->rc_title ); |
||
80 | $timestamp = wfTimestamp( TS_MW, $row->rc_timestamp ); |
||
81 | $actiontext = ''; |
||
82 | if ( $row->rc_type == RC_LOG ) { |
||
83 | $rcRow = (array)$row; // newFromRow() only accepts arrays for RC rows |
||
84 | $actiontext = LogFormatter::newFromRow( $rcRow )->getActionText(); |
||
85 | } |
||
86 | return self::formatDiffRow( $titleObj, |
||
87 | $row->rc_last_oldid, $row->rc_this_oldid, |
||
88 | $timestamp, |
||
89 | $row->rc_deleted & Revision::DELETED_COMMENT |
||
90 | ? wfMessage( 'rev-deleted-comment' )->escaped() |
||
91 | : $row->rc_comment, |
||
92 | $actiontext |
||
93 | ); |
||
94 | } |
||
95 | |||
96 | /** |
||
97 | * Really format a diff for the newsfeed |
||
98 | * |
||
99 | * @param Title $title Title object |
||
100 | * @param int $oldid Old revision's id |
||
101 | * @param int $newid New revision's id |
||
102 | * @param int $timestamp New revision's timestamp |
||
103 | * @param string $comment New revision's comment |
||
104 | * @param string $actiontext Text of the action; in case of log event |
||
105 | * @return string |
||
106 | */ |
||
107 | public static function formatDiffRow( $title, $oldid, $newid, $timestamp, |
||
108 | $comment, $actiontext = '' |
||
109 | ) { |
||
110 | global $wgFeedDiffCutoff, $wgLang; |
||
111 | |||
112 | // log entries |
||
113 | $completeText = '<p>' . implode( ' ', |
||
114 | array_filter( |
||
115 | [ |
||
116 | $actiontext, |
||
117 | Linker::formatComment( $comment ) ] ) ) . "</p>\n"; |
||
118 | |||
119 | // NOTE: Check permissions for anonymous users, not current user. |
||
120 | // No "privileged" version should end up in the cache. |
||
121 | // Most feed readers will not log in anyway. |
||
122 | $anon = new User(); |
||
123 | $accErrors = $title->getUserPermissionsErrors( 'read', $anon, true ); |
||
124 | |||
125 | // Can't diff special pages, unreadable pages or pages with no new revision |
||
126 | // to compare against: just return the text. |
||
127 | if ( $title->getNamespace() < 0 || $accErrors || !$newid ) { |
||
128 | return $completeText; |
||
129 | } |
||
130 | |||
131 | if ( $oldid ) { |
||
132 | |||
133 | # $diffText = $de->getDiff( wfMessage( 'revisionasof', |
||
134 | # $wgLang->timeanddate( $timestamp ), |
||
135 | # $wgLang->date( $timestamp ), |
||
136 | # $wgLang->time( $timestamp ) )->text(), |
||
137 | # wfMessage( 'currentrev' )->text() ); |
||
138 | |||
139 | $diffText = ''; |
||
140 | // Don't bother generating the diff if we won't be able to show it |
||
141 | if ( $wgFeedDiffCutoff > 0 ) { |
||
142 | $rev = Revision::newFromId( $oldid ); |
||
143 | |||
144 | if ( !$rev ) { |
||
145 | $diffText = false; |
||
146 | } else { |
||
147 | $context = clone RequestContext::getMain(); |
||
148 | $context->setTitle( $title ); |
||
149 | |||
150 | $contentHandler = $rev->getContentHandler(); |
||
151 | $de = $contentHandler->createDifferenceEngine( $context, $oldid, $newid ); |
||
152 | $diffText = $de->getDiff( |
||
153 | wfMessage( 'previousrevision' )->text(), // hack |
||
154 | wfMessage( 'revisionasof', |
||
155 | $wgLang->timeanddate( $timestamp ), |
||
156 | $wgLang->date( $timestamp ), |
||
157 | $wgLang->time( $timestamp ) )->text() ); |
||
158 | } |
||
159 | } |
||
160 | |||
161 | if ( $wgFeedDiffCutoff <= 0 || ( strlen( $diffText ) > $wgFeedDiffCutoff ) ) { |
||
162 | // Omit large diffs |
||
163 | $diffText = self::getDiffLink( $title, $newid, $oldid ); |
||
164 | } elseif ( $diffText === false ) { |
||
165 | // Error in diff engine, probably a missing revision |
||
166 | $diffText = "<p>Can't load revision $newid</p>"; |
||
167 | } else { |
||
168 | // Diff output fine, clean up any illegal UTF-8 |
||
169 | $diffText = UtfNormal\Validator::cleanUp( $diffText ); |
||
170 | $diffText = self::applyDiffStyle( $diffText ); |
||
171 | } |
||
172 | } else { |
||
173 | $rev = Revision::newFromId( $newid ); |
||
174 | if ( $wgFeedDiffCutoff <= 0 || is_null( $rev ) ) { |
||
175 | $newContent = ContentHandler::getForTitle( $title )->makeEmptyContent(); |
||
176 | } else { |
||
177 | $newContent = $rev->getContent(); |
||
178 | } |
||
179 | |||
180 | if ( $newContent instanceof TextContent ) { |
||
181 | // only textual content has a "source view". |
||
182 | $text = $newContent->getNativeData(); |
||
183 | |||
184 | if ( $wgFeedDiffCutoff <= 0 || strlen( $text ) > $wgFeedDiffCutoff ) { |
||
185 | $html = null; |
||
186 | } else { |
||
187 | $html = nl2br( htmlspecialchars( $text ) ); |
||
188 | } |
||
189 | } else { |
||
190 | // XXX: we could get an HTML representation of the content via getParserOutput, but that may |
||
191 | // contain JS magic and generally may not be suitable for inclusion in a feed. |
||
192 | // Perhaps Content should have a getDescriptiveHtml method and/or a getSourceText method. |
||
193 | // Compare also ApiFeedContributions::feedItemDesc |
||
194 | $html = null; |
||
195 | } |
||
196 | |||
197 | if ( $html === null ) { |
||
198 | |||
199 | // Omit large new page diffs, bug 29110 |
||
200 | // Also use diff link for non-textual content |
||
201 | $diffText = self::getDiffLink( $title, $newid ); |
||
202 | } else { |
||
203 | $diffText = '<p><b>' . wfMessage( 'newpage' )->text() . '</b></p>' . |
||
204 | '<div>' . $html . '</div>'; |
||
205 | } |
||
206 | } |
||
207 | $completeText .= $diffText; |
||
208 | |||
209 | return $completeText; |
||
210 | } |
||
211 | |||
212 | /** |
||
213 | * Generates a diff link. Used when the full diff is not wanted for example |
||
214 | * when $wgFeedDiffCutoff is 0. |
||
215 | * |
||
216 | * @param Title $title Title object: used to generate the diff URL |
||
217 | * @param int $newid Newid for this diff |
||
218 | * @param int|null $oldid Oldid for the diff. Null means it is a new article |
||
219 | * @return string |
||
220 | */ |
||
221 | protected static function getDiffLink( Title $title, $newid, $oldid = null ) { |
||
222 | $queryParameters = [ 'diff' => $newid ]; |
||
223 | if ( $oldid != null ) { |
||
0 ignored issues
–
show
Bug
Best Practice
introduced
by
![]() |
|||
224 | $queryParameters['oldid'] = $oldid; |
||
225 | } |
||
226 | $diffUrl = $title->getFullURL( $queryParameters ); |
||
227 | |||
228 | $diffLink = Html::element( 'a', [ 'href' => $diffUrl ], |
||
229 | wfMessage( 'showdiff' )->inContentLanguage()->text() ); |
||
230 | |||
231 | return $diffLink; |
||
232 | } |
||
233 | |||
234 | /** |
||
235 | * Hacky application of diff styles for the feeds. |
||
236 | * Might be 'cleaner' to use DOM or XSLT or something, |
||
237 | * but *gack* it's a pain in the ass. |
||
238 | * |
||
239 | * @param string $text Diff's HTML output |
||
240 | * @return string Modified HTML |
||
241 | */ |
||
242 | public static function applyDiffStyle( $text ) { |
||
243 | $styles = [ |
||
244 | 'diff' => 'background-color: white; color:black;', |
||
245 | 'diff-otitle' => 'background-color: white; color:black; text-align: center;', |
||
246 | 'diff-ntitle' => 'background-color: white; color:black; text-align: center;', |
||
247 | 'diff-addedline' => 'color:black; font-size: 88%; border-style: solid; ' |
||
248 | . 'border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; ' |
||
249 | . 'vertical-align: top; white-space: pre-wrap;', |
||
250 | 'diff-deletedline' => 'color:black; font-size: 88%; border-style: solid; ' |
||
251 | . 'border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; ' |
||
252 | . 'vertical-align: top; white-space: pre-wrap;', |
||
253 | 'diff-context' => 'background-color: #f9f9f9; color: #333333; font-size: 88%; ' |
||
254 | . 'border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; ' |
||
255 | . 'border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;', |
||
256 | 'diffchange' => 'font-weight: bold; text-decoration: none;', |
||
257 | ]; |
||
258 | |||
259 | foreach ( $styles as $class => $style ) { |
||
260 | $text = preg_replace( "/(<[^>]+)class=(['\"])$class\\2([^>]*>)/", |
||
261 | "\\1style=\"$style\"\\3", $text ); |
||
262 | } |
||
263 | |||
264 | return $text; |
||
265 | } |
||
266 | |||
267 | } |
||
268 |