wikimedia /
mediawiki
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | /** |
||
| 3 | * Formatter for user rights log entries. |
||
| 4 | * |
||
| 5 | * This program is free software; you can redistribute it and/or modify |
||
| 6 | * it under the terms of the GNU General Public License as published by |
||
| 7 | * the Free Software Foundation; either version 2 of the License, or |
||
| 8 | * (at your option) any later version. |
||
| 9 | * |
||
| 10 | * This program is distributed in the hope that it will be useful, |
||
| 11 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
||
| 12 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||
| 13 | * GNU General Public License for more details. |
||
| 14 | * |
||
| 15 | * You should have received a copy of the GNU General Public License along |
||
| 16 | * with this program; if not, write to the Free Software Foundation, Inc., |
||
| 17 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. |
||
| 18 | * http://www.gnu.org/copyleft/gpl.html |
||
| 19 | * |
||
| 20 | * @file |
||
| 21 | * @author Alexandre Emsenhuber |
||
| 22 | * @license http://www.gnu.org/copyleft/gpl.html GNU General Public License 2.0 or later |
||
| 23 | * @since 1.22 |
||
| 24 | */ |
||
| 25 | |||
| 26 | /** |
||
| 27 | * This class formats rights log entries. |
||
| 28 | * |
||
| 29 | * @since 1.21 |
||
| 30 | */ |
||
| 31 | class RightsLogFormatter extends LogFormatter { |
||
| 32 | protected function makePageLink( Title $title = null, $parameters = [], $html = null ) { |
||
| 33 | global $wgContLang, $wgUserrightsInterwikiDelimiter; |
||
| 34 | |||
| 35 | if ( !$this->plaintext ) { |
||
| 36 | $text = $wgContLang->ucfirst( $title->getDBkey() ); |
||
|
0 ignored issues
–
show
|
|||
| 37 | $parts = explode( $wgUserrightsInterwikiDelimiter, $text, 2 ); |
||
| 38 | |||
| 39 | if ( count( $parts ) === 2 ) { |
||
| 40 | $titleLink = WikiMap::foreignUserLink( |
||
| 41 | $parts[1], |
||
| 42 | $parts[0], |
||
| 43 | htmlspecialchars( |
||
| 44 | strtr( $parts[0], '_', ' ' ) . |
||
| 45 | $wgUserrightsInterwikiDelimiter . |
||
| 46 | $parts[1] |
||
| 47 | ) |
||
| 48 | ); |
||
| 49 | |||
| 50 | if ( $titleLink !== false ) { |
||
| 51 | return $titleLink; |
||
| 52 | } |
||
| 53 | } |
||
| 54 | } |
||
| 55 | |||
| 56 | return parent::makePageLink( $title, $parameters, $title ? $title->getText() : null ); |
||
| 57 | } |
||
| 58 | |||
| 59 | View Code Duplication | protected function getMessageKey() { |
|
| 60 | $key = parent::getMessageKey(); |
||
| 61 | $params = $this->getMessageParameters(); |
||
| 62 | if ( !isset( $params[3] ) && !isset( $params[4] ) ) { |
||
| 63 | // Messages: logentry-rights-rights-legacy |
||
| 64 | $key .= '-legacy'; |
||
| 65 | } |
||
| 66 | |||
| 67 | return $key; |
||
| 68 | } |
||
| 69 | |||
| 70 | protected function getMessageParameters() { |
||
| 71 | $params = parent::getMessageParameters(); |
||
| 72 | |||
| 73 | // Really old entries |
||
| 74 | if ( !isset( $params[3] ) && !isset( $params[4] ) ) { |
||
| 75 | return $params; |
||
| 76 | } |
||
| 77 | |||
| 78 | $oldGroups = $this->makeGroupArray( $params[3] ); |
||
| 79 | $newGroups = $this->makeGroupArray( $params[4] ); |
||
| 80 | |||
| 81 | $userName = $this->entry->getTarget()->getText(); |
||
| 82 | View Code Duplication | if ( !$this->plaintext && count( $oldGroups ) ) { |
|
| 83 | foreach ( $oldGroups as &$group ) { |
||
| 84 | $group = User::getGroupMember( $group, $userName ); |
||
| 85 | } |
||
| 86 | } |
||
| 87 | View Code Duplication | if ( !$this->plaintext && count( $newGroups ) ) { |
|
| 88 | foreach ( $newGroups as &$group ) { |
||
| 89 | $group = User::getGroupMember( $group, $userName ); |
||
| 90 | } |
||
| 91 | } |
||
| 92 | |||
| 93 | $lang = $this->context->getLanguage(); |
||
| 94 | if ( count( $oldGroups ) ) { |
||
| 95 | $params[3] = $lang->listToText( $oldGroups ); |
||
| 96 | } else { |
||
| 97 | $params[3] = $this->msg( 'rightsnone' )->text(); |
||
| 98 | } |
||
| 99 | if ( count( $newGroups ) ) { |
||
| 100 | // Array_values is used here because of T44211 |
||
| 101 | // see use of array_unique in UserrightsPage::doSaveUserGroups on $newGroups. |
||
| 102 | $params[4] = $lang->listToText( array_values( $newGroups ) ); |
||
| 103 | } else { |
||
| 104 | $params[4] = $this->msg( 'rightsnone' )->text(); |
||
| 105 | } |
||
| 106 | |||
| 107 | $params[5] = $userName; |
||
| 108 | |||
| 109 | return $params; |
||
| 110 | } |
||
| 111 | |||
| 112 | protected function getParametersForApi() { |
||
| 113 | $entry = $this->entry; |
||
| 114 | $params = $entry->getParameters(); |
||
| 115 | |||
| 116 | static $map = [ |
||
| 117 | '4:array:oldgroups', |
||
| 118 | '5:array:newgroups', |
||
| 119 | '4::oldgroups' => '4:array:oldgroups', |
||
| 120 | '5::newgroups' => '5:array:newgroups', |
||
| 121 | ]; |
||
| 122 | View Code Duplication | foreach ( $map as $index => $key ) { |
|
| 123 | if ( isset( $params[$index] ) ) { |
||
| 124 | $params[$key] = $params[$index]; |
||
| 125 | unset( $params[$index] ); |
||
| 126 | } |
||
| 127 | } |
||
| 128 | |||
| 129 | // Really old entries does not have log params |
||
| 130 | if ( isset( $params['4:array:oldgroups'] ) ) { |
||
| 131 | $params['4:array:oldgroups'] = $this->makeGroupArray( $params['4:array:oldgroups'] ); |
||
| 132 | } |
||
| 133 | if ( isset( $params['5:array:newgroups'] ) ) { |
||
| 134 | $params['5:array:newgroups'] = $this->makeGroupArray( $params['5:array:newgroups'] ); |
||
| 135 | } |
||
| 136 | |||
| 137 | return $params; |
||
| 138 | } |
||
| 139 | |||
| 140 | public function formatParametersForApi() { |
||
| 141 | $ret = parent::formatParametersForApi(); |
||
| 142 | if ( isset( $ret['oldgroups'] ) ) { |
||
| 143 | ApiResult::setIndexedTagName( $ret['oldgroups'], 'g' ); |
||
| 144 | } |
||
| 145 | if ( isset( $ret['newgroups'] ) ) { |
||
| 146 | ApiResult::setIndexedTagName( $ret['newgroups'], 'g' ); |
||
| 147 | } |
||
| 148 | return $ret; |
||
| 149 | } |
||
| 150 | |||
| 151 | private function makeGroupArray( $group ) { |
||
| 152 | // Migrate old group params from string to array |
||
| 153 | if ( $group === '' ) { |
||
| 154 | $group = []; |
||
| 155 | } elseif ( is_string( $group ) ) { |
||
| 156 | $group = array_map( 'trim', explode( ',', $group ) ); |
||
| 157 | } |
||
| 158 | return $group; |
||
| 159 | } |
||
| 160 | } |
||
| 161 |
If a variable is not always an object, we recommend to add an additional type check to ensure your method call is safe: