aboutsummaryrefslogtreecommitdiffstats
path: root/includes/resourceloader/ResourceLoaderUserTokensModule.php
Commit message (Collapse)AuthorAgeFilesLines
* resourceloader: Merge 'user.tokens' module into 'user.options'Timo Tijhof2020-03-171-74/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For back-compat, keep 'user.tokens' as deprecated alias to 'user.options' for one release cycle (to be removed in MW 1.36). == user.options == As before, 'user.options' arrives immediately on every page view, embedded in the HTML. It has an async dependency on 'user.defaults', which is not downloaded until there is a known demand on 'user.options'. Once that arrives, the implementation closure of 'user.options' will execute, and the module becomes 'ready'. == user.options "empty" == Before this change, UserOptionsModule used isKnownEmpty to consider the module "empty" for logged-out users (as well as for logged-in users that haven't yet set any preferences). This was a mistake. It is invalid in ResourceLoader to mark a module as "empty" if that module has dependencies (see also T191596 and c3f200849). This broke the state machine. The impact was minimal given that it is unlikely for features to read keys from mw.user.options for logged-out users, which if attempted would have simply returned null for all keys. == New HTML == The user.options module is always embedded (never empty), and always has a dependency on user.defaults. == Cached HTML == The cached HTML for anons sets user.options's state to ready without waiting for any dependency. Per the above, this was already causing subtle bugs with mw.user.options.get() likely returning null for anons, which was fairly innocent. For tokens a bottom value of null would be problematic as the default for tokens must be "+\" instead. To make sure that is available for cached page views, set this directly in mediawiki.base.js. The cached HTML does contain an implement call for 'user.tokens' that contains the same defaults, but new code will not be asking for or waiting for user.tokens, so that is unused. Bug: T235457 Change-Id: I51e01d6fa604578cd2906337bde5a4760633c027
* resourceloader: Remove 'editToken' from mw.user.tokensTimo Tijhof2019-10-041-1/+0
| | | | | | | | | Deprecated since MW 1.27. Mainly for internal use only by the `mediawiki.api` module, but several uses emerged elsewhere too. These have been migrated as of T233442 (Thanks @TheSandDoctor!) Bug: T234576 Change-Id: Id7bb031ed1680f1a3671d338726eecb8e9152b6d
* Merge "resourceloader: Add $context to static functions in ResourceLoader"jenkins-bot2019-09-271-1/+1
|\
| * resourceloader: Add $context to static functions in ResourceLoaderFomafix2019-09-271-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This change allows to use the context in the functions. The following internal static functions from ResourceLoader get now a reference to the ResourceLoaderContext object: * makeLoaderImplementScript * makeLoaderStateScript * makeLoaderRegisterScript * makeLoaderSourcesScript ResouceLoader::encodeJsonForScript is duplicated to ResourceLoaderContext::encodeJson loading the debug mode from context. ResourceLoader::encodeJsonForScript is kept for other usages without context. The debug mode is loaded from $context->getDebug() instead of from ResourceLoader::inDebugMode(). This does not support to enable the debug mode by setting the cookie 'resourceLoaderDebug' or the configuration variable wgResourceLoaderDebug. Only the URL parameter debug=true enables the debug mode. This should be sufficient for the subsequent ResourceLoader requests. The tests don't need the global variable wgResourceLoaderDebug anymore. The initial ResourceLoader context in OutputPage still uses ResourceLoader::inDebugMode() with cookie and global configuration variable. This change adds the parameter $context with a ResourceLoaderContext object to ResourceLoaderModule::getDeprecationInformation and deprecates omitting the parameter. Ifa1a3bb56b731b83864022a358916c6aca5d7c10 updates this in extension ExtJSBase. Bug: T229311 Change-Id: I5341f18625209446a6d006f60244990f65530319
* | resourceloader: Add Doxygen group and improve overall docsTimo Tijhof2019-09-141-4/+4
|/ | | | | | | | | | | | | | | | | | | * Add license header where missing. * Add missing `@since` (1.17 for most classes), except ResourceLoaderLessVarFileModule since 1.32 (1bc62c548c). * Remove duplicate file-level description for class-only files, merge with the class description instead. * Remove my own `@author` annotation from one file. * Mark core's own FileModule subclasses as `@internal`, except for the following which we support use of in extensions: ResourceLoaderLessVarFileModule, ResourceLoaderOOUIIconPackModule, and ResourceLoaderWikiModule. Change-Id: I336af2e4ccdbe2512594e8861b72628d24194e41
* resourceloader: Replace Xml::encodeJsCall by encodeJsonForScriptFomafix2019-09-101-5/+4
| | | | | | | | Also document that encodeJsonForScript can return false on invalid UTF-8 characters. Bug: T32956 Change-Id: I9c2fd33fb2130ada67fa70ff176e5488f1a014bf
* resourceloader: Move FILTER_NOMIN annotation to the beginning of outputBartosz Dziewoński2018-01-301-6/+3
| | | | | | | | | | | | | | | This allows ResourceLoader::filter() to handle this case slightly faster, since it searches for this annotation from the beginning. In practice this is a negligible performance optimization, but let's set a good example for the future. Also tweak the comments and whitespace: * Move comment about the FILTER_NOMIN from doc comment to code comment, it's an implementation detail and not meant for public documentation * Remove duplicated documentation from the parent class * Change whitespace to be identical in both cases Change-Id: I624914ff28d903027ba58710708ccc3c66af9e24
* Remove self-explaining "section heading" comments from classesThiemo Mättig2017-12-281-4/+0
| | | | | | | | I can see that "parent::__construct" literally calls the parent constructor. I can see that stuff preceeded by the keyword "protected" is protected. I really (really) don't need comments explaining such. Change-Id: I7458e714976a6acd3ba6a7c93fdc27d03903df83
* Document return string as JavaScript code for getScriptFomafix2017-04-031-1/+1
| | | | Change-Id: I01055c2b6a11dbe6284d1aff2352ba428ed9bee2
* resourceloader: Remove unused getPosition() codeTimo Tijhof2016-11-181-7/+0
| | | | | | Unused as of bc374082fa (T109837). Change-Id: I1d8f7109bbe49700f1824fdce0439e958e84f6fa
* resourceloader: Move queue formatting out of OutputPageTimo Tijhof2016-08-081-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | HTML formatting of the queue was distributed over several OutputPage methods. Each method demanding a snippet of HTML by calling makeResourceLoaderLink() with a limited amount of information. As such, makeResourceLoaderLink() was unable to provide the client with the proper state information. Centralising it also allows it to better reduce duplication in HTML output and maintain a more accurate state. Problems fixed by centralising: 1. The 'user' module is special (due to per-user 'version' and 'user' params). It is manually requested via script-src. To avoid a separate (and wrong) request from something that requires it, we set state=loading directly. However, because the module is in the bottom, the old HTML formatter could only put state=loading in the bottom also. This sometimes caused a wrong request to be fired for modules=user if something in the top queue triggered a requirement for it. 2. Since a464d1d4 (T87871) we track states of page-style modules, with purpose of allowing dependencies on style modules without risking duplicate loading on pages where the styles are loaded already. This didn't work, because the state information about page-style modules is output near the stylesheet, which is after the script tag with mw.loader.load(). That runs first, and mw.loader would still make a duplicate request before it learns the state. Changes: * Document reasons for style/script tag order in getHeadHtml (per 09537e83). * Pass $type from getModuleStyles() to getAllowedModules(). This wasn't needed before since a duplicate check in makeResourceLoaderLink() verified the origin a second time. * Declare explicit position 'top' on 'user.options' and 'user.tokens' module. Previously, OutputPage hardcoded them in the top. The new formatter doesn't. * Remove getHeadScripts(). * Remove getInlineHeadScripts(). * Remove getExternalHeadScripts(). * Remove buildCssLinks(). * Remove getScriptsForBottomQueue(). * Change where Skin::setupSkinUserCss() is called. This methods lets the skin add modules to the queue. Previously it was called from buildCssLinks(), via headElement(), via prepareQuickTemplate(), via OutputPage::output(). It's now in OutputPage::output() directly (slightly earlier). This is needed because prepareQuickTemplate() calls bottomScripts() before headElement(). And bottomScript() would lazy-initialise the queue and lock it before setupSkinUserCss() is called from headElement(). This makes execution order more predictable instead of being dependent on the arbitrary order of data extraction in prepareQuickTemplate (which varies from one skin to another). * Compute isUserModulePreview() and isKnownEmpty() for the 'user' module early on so. This avoids wrongful loading and fixes problem 1. Effective changes in output: * mw.loader.state() is now before mw.loader.load(). This fixes problem 2. * mw.loader.state() now sets 'user.options' and 'user.tokens' to "loading". * mw.loader.state() now sets 'user' (as "loading" or "ready"). Fixes problem 1. * The <script async src> tag for 'startup' changed position (slightly). Previously it was after all inline scripts and stylesheets. It's still after all inline scripts and after most stylesheets, but before any user styles. Since the queue is now formatted outside OutputPage, it can't inject the meta-ResourceLoaderDynamicStyles tag and user-stylesheet hack in the middle of existing output. This shouldn't have any noticable impact. Bug: T87871 Change-Id: I605b8cd1e1fc009b4662a0edbc54d09dd65ee1df
* OutputPage: Minor clean up of <head> and HTMLTimo Tijhof2016-03-241-2/+1
| | | | | | | | | | | | | | * Remove trailing space in self-closing tag. Brings parserTest output of Parser and Parsoid closer together. * Remove various line breaks at begin and end of script contents. * Remove FILTER_NOMIN from makeConfigSetScript() output. This isn't part of any user- or page-dependent module and not minified. And Xml::encodeJsCall already ensures compact output for prod mode. Bug: T127328 Change-Id: I85a5a59fd0955c1a112e8b24b933f0d9e983a156
* Convert all array() syntax to []Kunal Mehta2016-02-171-4/+4
| | | | | | | | | | Per wikitech-l consensus: https://lists.wikimedia.org/pipermail/wikitech-l/2016-February/084821.html Notes: * Disabled CallTimePassByReference due to false positives (T127163) Change-Id: I2c8ce713ce6600a0bb7bf67537c87044c7a45c4b
* mediawiki.api: Use action=query&meta=tokens instead of action=tokensTimo Tijhof2015-11-181-0/+1
| | | | | | | | | | | | | | Follows-up aacdb664a1, which was reverted. API action=query&meta=tokens has different token types than the old action=tokens values. Use a map to maintain support in the JavaScript API for old token types that now fold into the generic 'csrf'. Aside from core token types, those added by extensions are no longer actively used from the old token API. Bug: T72059 Change-Id: Iec3a9f0f51d64d90c81a147cc18097dcf679c7c9
* resourceloader: Consistently refer to the framework as ResourceLoaderTimo Tijhof2015-10-281-1/+1
| | | | Change-Id: Ia59e4eac9662723e80d62f7cfcb9e4292e3ee4de
* resourceloader: cache minified user and site modulesOri Livneh2015-10-031-2/+8
| | | | | | | | | | | | * Add support for a '/* @nomin */' annotation in ResourceLoader. If present in JavaScript or CSS, the code will not be minified or cached. This allows modules like the ResourceLoaderUserTokensModule to declare themselves unfit for minification / caching without requiring a complicated refactor. * Make ResourceLoader::filter() static, at the cost of not having minifier errors in the ResourceLoader log bucket. (They will continue to be logged as exceptions, however). Change-Id: Ic1d802ee20565e61046bfbd8fd209bc56a4cbd6c
* Revert "mediawiki.api: Use action=query&meta=tokens instead of action=tokens"Nemo bis2014-11-251-1/+0
| | | | | | | This reverts commit aacdb664a10d5eca2b55891e5a75ca8c0368a11b, which unintentionally broke backwards-compatibility, affecting at least four extensions of which two deployed in Wikimedia projects. Change-Id: I2e7e761281dae6a22fc520c9153734b55403b120
* mediawiki.api: Use action=query&meta=tokens instead of action=tokensFomafix2014-11-211-0/+1
| | | | | | | | api.php?action=query&meta=tokens has different token types. A mapping keeps the JavaScript API stable. Bug: 72094 Change-Id: I429b609b626af35ae0abcdf6f1c13e8afb6503b9
* resourceloader: Add ResourceLoaderContext::getUserObj and replace use of $wgUserKunal Mehta2014-10-231-6/+7
| | | | | | | | | Introduces ResourceLoaderContext::getUserObj(), which gets a (possibly cached) User object for the context's username. Use this instead of the $wgUser global. Change-Id: Ifd9f634db145381625ab68067ae67791a3f494b8
* API: Overhaul token handlingBrad Jorsch2014-08-261-2/+2
| | | | | | | | | | | | | | | | | | | | The current token handling is a mess. This simplifies things greatly: * *All* tokens are obtained from action=query&meta=tokens, rather than being spread over action=tokens, action=query&prop=info, action=query&prop=revisions, action=query&prop=recentchanges, and action=query&prop=users. All these old methods are deprecated. * Similarly, there is only one hook to register new token types. All old hooks are deprecated. * All tokens are cacheable. * Most token types are dropped in favor of a 'csrf' token. They already were returning the same token anyway. * All token-using modules will document the required token type in a standard manner in action=help and are documented in machine-readable fashion in action=paraminfo. Note this will require updates to all extensions using tokens. Change-Id: I2793a3f2dd64a4bebb0b4d065e09af1e9f63fb89
* Fixed some @params documentation (includes/*)umherirrender2014-04-201-2/+2
| | | | | | | | Swapped some "$var type" to "type $var" or added missing types before the $var. Changed some other types to match the more common spelling. Makes beginning of some text in captial. Change-Id: Ifbb1da2a6278b0bde2a6f6ce2e7bd383ee3fb28a
* Add mobile as a target on VisualEditor dependencies.Rob Moen2013-11-221-0/+2
| | | | Change-Id: I708006fd6733cac89128bc76a1cd34c0d091c371
* phpcs: Pass includes/resourceloader/Timo Tijhof2013-04-031-4/+3
| | | | | | | | | - A cast statement must not be followed by a space. - The method parameter $context is never used. - Avoid function calls in a FOR loop test part. - Opening brace should be on the same line as closing parenthesis. Change-Id: I0eba7fcc9ceab372003d1134857346690c525e87
* Combine JavaScript and JSON encoding logicKevin Israel2013-03-271-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | This will help with improving human readability of JS and JSON objects encoded by both ResourceLoader and the API. This patch also adds new "utf8" parameter to the JSON formatter of the API. Changes to FormatJson class: * Added escaping of '<', '>', and '&' by default to protect against XSS. * Removed unnecessary escaping of '/' and added an additional option to unescape non-ASCII characters (those above U+007F) as well. * Added PHP 5.3 pretty printing code (to replace Services_JSON) that uses a four-space indent as PHP 5.4 does. Changes to Xml class: * Defined Xml::encodeJsVar() in terms of FormatJson::encode() and added a pretty printing option. Also added a pretty printing option to Xml::encodeJsCall() as well. * Deprecated Xml::escapeJsString() and QuickTemplate::jstext(); callers have to add quotes themselves, hence the escaping of both double quotes and apostrophes. Bug: 26818 Change-Id: I1987190f1ba5bf41738e7bd611209706c1f6bb5c
* (bug 7851) Implement mediawiki.page.patrol.ajaxMarius Hoch2012-11-131-1/+2
| | | | | | | | | | | | | | | | | | | Implement AJAX patrolling with the new mediawiki.page.patrol.ajax module, which makes use of the API via mediawiki.api. During the patrol process a spinner (created by jquery.spinner) shows up and after it a suitable message gets shown via mediawiki.notify. Depending on whether we had success or not the link then turns up again or the brackets completely disappear just like on a normal page view. On top of adding the module, I've changed the following: - Added the patrol token to the ResourceLoaderUserTokensModule. - Registered messages 'markedaspatrollednotify' and 'markedaspatrollederrornotify'. Change-Id: I472357566dda0ab572c20e2e4b87508b0f2f4c73
* Added missing GPLv2 headers in some places.Alexandre Emsenhuber2012-04-301-0/+2
| | | | | | Also made file/class documentation more consistent. Change-Id: I1815587ab2eeb24623ce4bf1c695088bd3f1c2ea
* Adds a supportsURLLoading method which returns false to user tokens and user ↵Trevor Parscal2012-02-211-0/+7
| | | | | | | options modules. This prevents them from being linked to direction which fixes an issue where in debug mode logged in users were being served anon tokens and options. This should resolve bug #34469. Notes: http://mediawiki.org/wiki/Special:Code/MediaWiki/112052
* Since I'm sick of all the mw.user-induced problems, break the dependency ↵Roan Kattouw2012-02-161-7/+0
| | | | | | | between mw.user.{options,tokens} and mw.user . With this change, mediawiki.js defines a skeleton object for mw.user containing just the options and tokens maps, and mediawiki.user.js copies those when it sets up the full mw.user object. This way of doing extending is kind of ugly but I don't have time to work on something nicer without breaking backwards compatibility. Because mw.user.{options,tokens} are loaded very early, this also means they're now guaranteed to be available to everything everywhere. Notes: http://mediawiki.org/wiki/Special:Code/MediaWiki/111695
* Following r100264, update usages in coreJohn Du Hart2011-11-161-1/+1
| | | | Notes: http://mediawiki.org/wiki/Special:Code/MediaWiki/103294
* DocumentationSam Reed2011-10-141-3/+6
| | | | | | | | | Trim trailing whitespace Make returns return values where appropriate (ie other paths in the same method do) Notes: http://mediawiki.org/wiki/Special:Code/MediaWiki/99760
* Make mw.user.options and mw.user.tokens work in debug mode in IE. Now that ↵Roan Kattouw2011-07-281-0/+4
| | | | | | | | | | | | | | mw.user is a separate module, we have to make these depend on that and make sure dependencies are actually processed. * Make ResourceLoaderUserOptionsModule and ResourceLoaderUserTokensModule depend on mw.user * Load mw.user.{tokens,options,groups} load as TYPE_COMBINED instead of TYPE_SCRIPT. The latter wouldn't wrap the code in mw.loader.implement() ** ...but make sure 'user' (user scripts) is excluded, that one needs to not be wrapped in a closure * Make TYPE_COMBINED actually work in makeResourceLoaderLink() * Add a comment in makeModuleResponse() to explain what the weird is_array( $scripts ) stuff is all about * Add FIXME about how mw.user.options should split off the CSS part into a separate module Notes: http://mediawiki.org/wiki/Special:Code/MediaWiki/93363
* Follow-up r88554: Passing null for now, fixed php error about missing arguments.Krinkle2011-05-211-1/+1
| | | | Notes: http://mediawiki.org/wiki/Special:Code/MediaWiki/88557
* Passing token paremeter in mw.action.watch.ajax since this is required as of ↵Krinkle2011-05-211-0/+1
| | | | | | | | | r88522. Follow-up: r88511, r88522, r88527, r88553 Notes: http://mediawiki.org/wiki/Special:Code/MediaWiki/88554
* Adding user.tokens module and loading by default. ↵Krinkle2011-05-211-0/+62
(ResourceLoaderUserTokensModule Class) Notes: http://mediawiki.org/wiki/Special:Code/MediaWiki/88553
generated by cgit v1.2.3 (git 2.25.1) at 2025-04-29 09:18:52 +0000