This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | /** |
||
3 | * Formatter for user rights log entries. |
||
4 | * |
||
5 | * This program is free software; you can redistribute it and/or modify |
||
6 | * it under the terms of the GNU General Public License as published by |
||
7 | * the Free Software Foundation; either version 2 of the License, or |
||
8 | * (at your option) any later version. |
||
9 | * |
||
10 | * This program is distributed in the hope that it will be useful, |
||
11 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
||
12 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||
13 | * GNU General Public License for more details. |
||
14 | * |
||
15 | * You should have received a copy of the GNU General Public License along |
||
16 | * with this program; if not, write to the Free Software Foundation, Inc., |
||
17 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. |
||
18 | * http://www.gnu.org/copyleft/gpl.html |
||
19 | * |
||
20 | * @file |
||
21 | * @author Alexandre Emsenhuber |
||
22 | * @license http://www.gnu.org/copyleft/gpl.html GNU General Public License 2.0 or later |
||
23 | * @since 1.22 |
||
24 | */ |
||
25 | |||
26 | /** |
||
27 | * This class formats rights log entries. |
||
28 | * |
||
29 | * @since 1.21 |
||
30 | */ |
||
31 | class RightsLogFormatter extends LogFormatter { |
||
32 | protected function makePageLink( Title $title = null, $parameters = [], $html = null ) { |
||
33 | global $wgContLang, $wgUserrightsInterwikiDelimiter; |
||
34 | |||
35 | if ( !$this->plaintext ) { |
||
36 | $text = $wgContLang->ucfirst( $title->getDBkey() ); |
||
0 ignored issues
–
show
|
|||
37 | $parts = explode( $wgUserrightsInterwikiDelimiter, $text, 2 ); |
||
38 | |||
39 | if ( count( $parts ) === 2 ) { |
||
40 | $titleLink = WikiMap::foreignUserLink( |
||
41 | $parts[1], |
||
42 | $parts[0], |
||
43 | htmlspecialchars( |
||
44 | strtr( $parts[0], '_', ' ' ) . |
||
45 | $wgUserrightsInterwikiDelimiter . |
||
46 | $parts[1] |
||
47 | ) |
||
48 | ); |
||
49 | |||
50 | if ( $titleLink !== false ) { |
||
51 | return $titleLink; |
||
52 | } |
||
53 | } |
||
54 | } |
||
55 | |||
56 | return parent::makePageLink( $title, $parameters, $title ? $title->getText() : null ); |
||
57 | } |
||
58 | |||
59 | View Code Duplication | protected function getMessageKey() { |
|
60 | $key = parent::getMessageKey(); |
||
61 | $params = $this->getMessageParameters(); |
||
62 | if ( !isset( $params[3] ) && !isset( $params[4] ) ) { |
||
63 | // Messages: logentry-rights-rights-legacy |
||
64 | $key .= '-legacy'; |
||
65 | } |
||
66 | |||
67 | return $key; |
||
68 | } |
||
69 | |||
70 | protected function getMessageParameters() { |
||
71 | $params = parent::getMessageParameters(); |
||
72 | |||
73 | // Really old entries |
||
74 | if ( !isset( $params[3] ) && !isset( $params[4] ) ) { |
||
75 | return $params; |
||
76 | } |
||
77 | |||
78 | $oldGroups = $this->makeGroupArray( $params[3] ); |
||
79 | $newGroups = $this->makeGroupArray( $params[4] ); |
||
80 | |||
81 | $userName = $this->entry->getTarget()->getText(); |
||
82 | View Code Duplication | if ( !$this->plaintext && count( $oldGroups ) ) { |
|
83 | foreach ( $oldGroups as &$group ) { |
||
84 | $group = User::getGroupMember( $group, $userName ); |
||
85 | } |
||
86 | } |
||
87 | View Code Duplication | if ( !$this->plaintext && count( $newGroups ) ) { |
|
88 | foreach ( $newGroups as &$group ) { |
||
89 | $group = User::getGroupMember( $group, $userName ); |
||
90 | } |
||
91 | } |
||
92 | |||
93 | $lang = $this->context->getLanguage(); |
||
94 | if ( count( $oldGroups ) ) { |
||
95 | $params[3] = $lang->listToText( $oldGroups ); |
||
96 | } else { |
||
97 | $params[3] = $this->msg( 'rightsnone' )->text(); |
||
98 | } |
||
99 | if ( count( $newGroups ) ) { |
||
100 | // Array_values is used here because of T44211 |
||
101 | // see use of array_unique in UserrightsPage::doSaveUserGroups on $newGroups. |
||
102 | $params[4] = $lang->listToText( array_values( $newGroups ) ); |
||
103 | } else { |
||
104 | $params[4] = $this->msg( 'rightsnone' )->text(); |
||
105 | } |
||
106 | |||
107 | $params[5] = $userName; |
||
108 | |||
109 | return $params; |
||
110 | } |
||
111 | |||
112 | protected function getParametersForApi() { |
||
113 | $entry = $this->entry; |
||
114 | $params = $entry->getParameters(); |
||
115 | |||
116 | static $map = [ |
||
117 | '4:array:oldgroups', |
||
118 | '5:array:newgroups', |
||
119 | '4::oldgroups' => '4:array:oldgroups', |
||
120 | '5::newgroups' => '5:array:newgroups', |
||
121 | ]; |
||
122 | View Code Duplication | foreach ( $map as $index => $key ) { |
|
123 | if ( isset( $params[$index] ) ) { |
||
124 | $params[$key] = $params[$index]; |
||
125 | unset( $params[$index] ); |
||
126 | } |
||
127 | } |
||
128 | |||
129 | // Really old entries does not have log params |
||
130 | if ( isset( $params['4:array:oldgroups'] ) ) { |
||
131 | $params['4:array:oldgroups'] = $this->makeGroupArray( $params['4:array:oldgroups'] ); |
||
132 | } |
||
133 | if ( isset( $params['5:array:newgroups'] ) ) { |
||
134 | $params['5:array:newgroups'] = $this->makeGroupArray( $params['5:array:newgroups'] ); |
||
135 | } |
||
136 | |||
137 | return $params; |
||
138 | } |
||
139 | |||
140 | public function formatParametersForApi() { |
||
141 | $ret = parent::formatParametersForApi(); |
||
142 | if ( isset( $ret['oldgroups'] ) ) { |
||
143 | ApiResult::setIndexedTagName( $ret['oldgroups'], 'g' ); |
||
144 | } |
||
145 | if ( isset( $ret['newgroups'] ) ) { |
||
146 | ApiResult::setIndexedTagName( $ret['newgroups'], 'g' ); |
||
147 | } |
||
148 | return $ret; |
||
149 | } |
||
150 | |||
151 | private function makeGroupArray( $group ) { |
||
152 | // Migrate old group params from string to array |
||
153 | if ( $group === '' ) { |
||
154 | $group = []; |
||
155 | } elseif ( is_string( $group ) ) { |
||
156 | $group = array_map( 'trim', explode( ',', $group ) ); |
||
157 | } |
||
158 | return $group; |
||
159 | } |
||
160 | } |
||
161 |
If a variable is not always an object, we recommend to add an additional type check to ensure your method call is safe: