aboutsummaryrefslogtreecommitdiffstats
path: root/includes/session/Session.php
Commit message (Collapse)AuthorAgeFilesLines
* session: Inline some local variables in Session::getSecretKeysUmherirrender2025-01-221-5/+3
| | | | | | Not all values are used always Change-Id: Id3591d8e1972c6a2d44f66b5936cb3ac36b472ab
* Remove 2-line PHPDocs that just repeat the types from the codethiemowmde2025-01-171-1/+0
| | | | | | | | | | | | | | | | Same as Ia294bf4 did for 1-line comments. This patch removes slightly more complex 2-line PHPDoc comments that don't add any new information to the code, but literally repeat what the code already says. They say "don't document the code, code the documentation", and we are doing this more and more. We just tend to forget to remove the obsolete comments. Note I'm also removing a line of text in a few cases when it's very short and literally says the same as the method name. Again, such comments add zero new information. Change-Id: I01535404bab458c6c47e48e5456403b7a64198ed
* Use real type hints for services etc. in includes/auth/, session/, user/Bartosz Dziewoński2024-11-021-3/+2
| | | | | | | | | | | | | | | | | | | Mostly used find-and-replace: Find: /\*[\*\s]+@var (I?[A-Z](\w+)(?:Interface)?)[\s\*]+/\s*(private|protected|public) (\$[a-z]\w+;\n)((?=\s*/\*[\*\s]+@var (I?[A-Z](\w+)(?:Interface)?))\n|) Replace with: \3 \1 \4 More could be done, but to keep this patch reasonably sized, I only changed the most obvious and unambiguously correct cases. In some cases, I also removed redundant doc comments on the constructor, and re-ordered the properties to match the constructor. Bonus: Fix some todos in AuthManagerTest. Change-Id: Ife5313b821cf537984f6de364bfe1d9b4b992a07
* Use OpenSSL for session secret hashingAlexander Vorwerk2024-05-091-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The OpenSSL implementation of the PBKDF2 hashing algorithm implements an optimization where it hashes the HMAC key blocks only once rather than on each iteration[1]. PHP does not implement this optimization[2][3]. Some very rough benchmarking on mwmaint shows it takes ~25 ms less to run this code now, which is not the world but still something. PHP: $result = 0; for ( $i = 1 ; $i <= 100 ; $i++ ) { $time = microtime( true ); hash_pbkdf2( 'sha256', $wikiSecret, $userSecret, $iterations, 64, true ); $result += microtime( true ) - $time; } echo $result / 100; result: 0.03978999376297 OpenSSL: $result = 0; for ( $i = 1 ; $i <= 100 ; $i++ ) { $time = microtime( true ); openssl_pbkdf2( $wikiSecret, $userSecret, 64, $iterations, 'sha256' ); $result += microtime( true ) - $time; } echo $result / 100; result: 0.014276416301727 The optimization is available from OpenSSL 1.0.1f (released 2014-01-06) onward. For all users running an older version of OpenSSL, this patch has basically no effect. There are even faster implementations, but those would require adding a new library dependency. But since OpenSSL is a required library und thus available anyway, changing this is an easy thing to do. [1] - https://github.com/openssl/openssl/commit/c10e3f0cffb3820d [2] - https://jbp.io/2015/08/11/pbkdf2-performance-matters.html [3] - https://github.com/php/php-src/issues/9604 Change-Id: I89c2450769f8ba4c3982bc22afe14b28f322675b
* Move ext-openssl from suggest to requireAlexander Vorwerk2024-05-051-26/+1
| | | | | | | openssl provides the proper password hashing algorithm, so it is needed in order to have safe and efficent password hashing. Change-Id: I61498275c7f7cf19787f0aee50dc4884c57b82b2
* build: Upgrade mediawiki/mediawiki-phan-config from 0.13.0 to 0.14.0 manuallyJames D. Forrester2024-02-101-8/+11
| | | | | | | | | | | * Switch out raw Exceptions, mostly for InvalidArgumentExceptions. * Fake exceptions triggered to give Monolog a backtrace are for some reason "traditionally" RuntimeExceptions, instead, so we continue to use that pattern in remaining locations. * Just entirely give up on PostgresResultWrapper's resource vs. object mess. * Drop now-unneeded false positive hits. Change-Id: Id183ab60994cd9c6dc80401d4ce4de0ddf2b3da0
* Use UserFactory::newAnonymousUmherirrender2024-01-221-1/+1
| | | | | Bug: T325686 Change-Id: Ia7ce7df94c233a4534625d250229806fb21d8017
* Allow setting page restrictions on BotPassword grantsSiddharth VP2023-12-051-0/+10
| | | | | | | | | | | | | | | Helps bot operators adhere to the principle of least privileges. Grants can now be restricted to allow editing (and other write operations) for upto 25 listed pages. The page IDs are persisted within the bp_restrictions field of bot_passwords table, and in the session metadata. This restriction is checked only as part of expensive checks in PermissionManager, since they are not applicable for UI actions. Bug: T349957 Change-Id: I3d228eb97664d040a160c5b742d9176fdfae9a43
* Namespace User under \MediaWiki\UserJames D. Forrester2023-09-191-1/+1
| | | | | Bug: T166010 Change-Id: I7257302b485588af31384d4f7fc8e30551f161f1
* Reorg: Move WebRequest to includes\RequestAmir Sarabadani2023-09-111-1/+1
| | | | | | | This has been approved as part of RFC T166010 Bug: T321882 Change-Id: I6bbdbbe6ea48cc1f50bc568bb8780fc7c5361a6f
* Make it possible to override the session in REST API testsDaimona Eaytoy2023-02-061-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The current signature of the various execute methods only takes a boolean parameter to determine if the session should be safe against CSRF, but that does not give callers fine-grained control over the Session object, including setting a specific token. Also, do not use createNoOpMock in getSession(), since it implies strong assertions on what methods are called. This way, getSession can also be used to get a simple mock session that tests may further manipulate. Make $csrfSafe parameter of SessionHelperTestTrait::getSession mandatory. This way, callers are forced to think what makes sense in each use case. The various methods in HandlerTestTrait now default to a session that is safe against CSRF. This assumes that most REST handlers don't care about the session, and that any handler that does care about the session and where someone needs to test the behaviour in case of bad/missing token will explicitly provide a Session that is NOT safe against CSRF. Typehint the return value of Session(Backend)::getUser so that PHPUnit will automatically make it return a mock User object even if the method is not explicitly mocked. Remove a useless PHPUnit assertion -- setting the return value to be X and then veryfing that is equal to X is a tautology, and can only fail if the test itself is flawed (as was the case, since it was using stdClass as the return type for all methods). Remove the getUser test case altogether, there's no way to make it work given the DummySessionBackend, and the test isn't that helpful anyway. More and more methods will have the same issue as soon as their return value is typehinted. Follow-up: I2a9215bf909b83564247ded95ecdb4ead0615150 Change-Id: Ic51dc3e7bf47c81f2ac4705308bb9ecd8275bbaf
* Revert "Reorg: Move some of request related classes to MediaWiki/Request"Zabe2022-10-271-6/+6
| | | | | | | | | This reverts commit 2bdc0b2b7209441a42a784157633a8a01b321922. Reason for revert: T166010#8349431 Bug: T166010 Change-Id: Idcd3025647aec99532f5d69b9c1718c531761283
* Reorg: Move some of request related classes to MediaWiki/RequestAmir Sarabadani2022-10-261-6/+6
| | | | | | | | | | | | | Moving: - DerivativeRequest - FauxRequest - FauxRequestUpload - PathRouter - WebRequest - WebRequestUpload Bug: T166010 Change-Id: I5ea70120d745f2876ae31d039f3f8a51e49e9ad8
* Use short array destructuring instead of list()Tim Starling2022-10-211-3/+3
| | | | | | | | Introduced in PHP 7.1. Because it's shorter and looks nice. I used regex replacement. Change-Id: I0555e199d126cd44501f859cb4589f8bd49694da
* Get rid of warnings on PHP 8.1Aryeh Gregor2022-06-131-8/+4
| | | | | | | | | | | This is mostly about adding return types to methods that implement PHP interfaces, and not passing null to core functions that want a string. After this patch, and an update to return types in RemexHtml, tests/phpunit/integration/ has no more errors than in PHP 8.0. Bug: T289879 Bug: T289926 Change-Id: Ia424f5cc897070f4188ae126b5bf6a1f552db0e1
* Address deprecations for php8.1 and REL1_38Mark A. Hershberger2022-04-301-0/+6
| | | | | | | See https://phabricator.wikimedia.org/T289879#7893656 Bug: T289879 Change-Id: I8240e56147a15dba293d577a22e36b7f7dc97cf3
* Use MainConfigNames instead of string literals, #4Aryeh Gregor2022-04-261-4/+6
| | | | | | | | | | | | | | | | | | | | | Now largely automated: VARS=$(grep -o "'[A-Za-z0-9_]*'" includes/MainConfigNames.php | \ tr "\n" '|' | sed "s/|$/\n/;s/'//g") sed -i -E "s/'($VARS)'/MainConfigNames::\1/g" \ $(grep -ERIl "'($VARS)'" includes/) Then git add -p with lots of error-prone manual checking. Then semi-manually add all the necessary "use" lines: vim $(grep -L 'use MediaWiki\\MainConfigNames;' \ $(git diff --cached --name-only --diff-filter=M HEAD^)) I didn't bother fixing lines that were over 100 characters unless they were over 120 and triggered phpcs. Bug: T305805 Change-Id: I74e0ab511abecb276717ad4276a124760a268147
* Type hints for ArrayAccess and JsonSerializableAryeh Gregor2022-04-111-3/+4
| | | | | | | | | | | These two interfaces' methods have tentative return types in PHP 8.1, which causes code without the type hints to raise warnings. Where the type hint is "mixed", we need to use the special declaration [\ReturnTypeWillChange] in a comment to suppress the warning as long as we still support PHP < 8.0, which doesn't have a "mixed" type hint. Bug: T289879 Change-Id: I1a126e602e92b8d13c7795eb6d790effd5ddc986
* Refactor global variables to use MediaWikiServices insteadTChin2022-01-101-6/+9
| | | | | | | | | | | | Automatically refactors wg prefixed globals to use MediaWikiServices config using Rector. Doesn't include files that set globals or files that fail CI. Rector Gist: https://gist.github.com/tchin25/7cc54f6d23aedef010b22e4dfbead228 * This patch uses a modified source code rector library for our specific use case and the rector will have different effects without it. A writeup for future reference is here: https://meta.wikimedia.org/wiki/User:TChin_(WMF)/Using_Rector_On_MediaWiki Change-Id: I1a691f01cd82e60bf41207d32501edb4b9835e37
* Move CRSF token generation to CsrfTokenSetPetr Pchelko2021-06-181-0/+15
| | | | Change-Id: Idf68f1cc63fb2e01e004ff353fcda026fa4ec10f
* Improve custom folding and groupingTim Starling2020-12-231-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | PHPStorm can use custom folding regions defined in either the VisualStudio style or the NetBeans style. The VisualStudio style is more pleasing to the eye and also works as a vim foldmarker. So get rid of the previous vim foldmarkers, and use region/endregion. region/endregion need to be in a single-line comment which is not a doc comment, and the rest of the comment is used as a region heading (by both PHPStorm and vim). So to retain Doxygen @name tags, it is necessary to repeat the section heading, once in a @name and once in a region. Establish a standard style for this, with a divider and three spaces before the heading, to better set off the heading name in plain text. Besides being the previous vim foldmarker, @{ is also a Doxygen grouping command. However, almost all prior usages of @{ ... @} in this sense were broken for one reason or another. It's necessary for the @{ to be in a doc comment, and DISTRIBUTE_GROUP_DOC doesn't work if any of the individual members in the group are separately documented. @name alone is sufficient to create a Doxygen section when the sections are adjacent, but if there is ungrouped content after the section, it is necessary to use @{ ... @} to avoid having the Doxygen group run on. So I retained, fixed or added @{ ... @} in certain cases. I wasn't able to test the changes to the trait documentation in Doxygen since trait syntax is not recognised and the output is badly broken. Change-Id: I7d819fdb376c861f40bfc01aed74cd3706141b20
* Remove documentation that literally repeats the codeThiemo Kreuz2020-10-271-5/+0
| | | | | | | | | | | | | | | For example, documenting the method getUser() with "get the User object" does not add any information that's not already there. But I have to read the text first to understand that it doesn't document anything that's not already obvious from the code. Some of this is from a time when we had a PHPCS sniff that was complaining when a line like `@param User $user` doesn't end with some descriptive text. Some users started adding text like `@param User $user The User` back then. Let's please remove this. Change-Id: I0ea8d051bc732466c73940de9259f87ffb86ce7a
* Fix typos related to repeated wordsUmherirrender2020-09-271-1/+1
| | | | Change-Id: Ibc187d95b003017255bc87adf56afae7a59bd3db
* Introduce $wgForceHTTPSTim Starling2020-06-301-2/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add $wgForceHTTPS. When set to true: * It makes the HTTP to HTTPS redirect unconditional and suppresses the forceHTTPS cookie. * It makes session cookies be secure. * In the Action API, it triggers the existing deprecation warning and avoids more expensive user/session checks. * In login and signup, it suppresses the old hidden form fields for protocol switching. * It hides the prefershttps user preference. Other changes: * Factor out the HTTPS redirect in MediaWiki::main() into maybeDoHttpsRedirect() and shouldDoHttpRedirect(). Improve documentation. * User::requiresHTTPS() reflects $wgForceHTTPS whereas the Session concept of "force HTTPS" does not. The documentation of User::requiresHTTPS() says that it includes configuration, and retaining this definition was beneficial for some callers. Whereas Session::shouldForceHTTPS() was used fairly narrowly as the value of the forceHTTPS cookie, and injecting configuration into it is not so easy or beneficial, so I left it as it was, except for clarifying the documentation. * Deprecate the following hooks: BeforeHttpsRedirect, UserRequiresHTTPS, CanIPUseHTTPS. No known extension uses them, and they're not compatible with the long-term goal of ending support for mixed-protocol wikis. BeforeHttpsRedirect was documented as unstable from its inception. CanIPUseHTTPS was a WMF config hack now superseded by GFOC's SNI sniffing. * For tests which failed with $wgForceHTTPS=true, I mostly split the tests, testing each configuration value separately. * Add ArrayUtils::cartesianProduct() as a helper for generating combinations of boolean options in the session tests. Bug: T256095 Change-Id: Iefb5ba55af35350dfc7c050f9fb8f4e8a79751cb
* Replace @protected tagdaniel2020-06-261-1/+1
| | | | | | | | | | | This patch replaces all usages of @protected in core. The @protected tag was removed in cases where it was redundant or contradictory. It has been replaced by @internal where usage outside of core is not desired, and with @note for cases where use by extensions is desired, but should be limited. Bug: T247862 Change-Id: I5da208e5cb4504dde4113afb3a44922fd01325a3
* Use @internal instead of @private per policydaniel2020-06-261-1/+1
| | | | | | | | https://www.mediawiki.org/wiki/Stable_interface_policy mandates the use of @internal. The semantics of @private was never properly defined. Bug: T247862 Change-Id: I4c7c6e7b5a80e86456965521f88d1dfa7d698f84
* REST: page/ endpoints: don't use tokens with OAuthdaniel2020-03-271-1/+1
| | | | | | | | | | | | | CSRF tokens should only be required (and only be allowed) if the current session isn't already inherently safe against CSRF due to the way the authentication mechanism works. This allows (and requires) tokens to be omitted for requests that use an OAuth Authorization header. Bug: T230843 Bug: T230842 Bug: T237852 Change-Id: Ib2922d556ff2470d4bf8c386c18986ca9f37d1b5
* Session: Remove mcrypt support, dropped from PHP 7.2Max Semenik2019-10-071-40/+2
| | | | Change-Id: I46d04f4b31730ee1b368f2c2646638fa59234f66
* Clean up spacing of doc commentsUmherirrender2019-08-051-1/+1
| | | | | | Align the doc stars and normalize start and end tokens Change-Id: Ib0d92e128e7b882bb5b838bd00c74fc16ef14303
* Add some more missing limit parameters to explode() callsThiemo Kreuz2019-04-051-1/+1
| | | | | | | | | | I benchmarked this again. The runtime of an unlimited explode() can be quite high. This is not really a DoS attack vector as it would require to post megabytes worth of input to the code, which will hit many other limits before. I still consider it good practice to use unlimited explode() only when it is actually allowed to return an unlimited amount of elements. Change-Id: I30f8ca5dba7b317bb4a046b9740fd736b4eea291
* Fix PhanTypeMismatchDeclaredParamUmherirrender2018-07-071-2/+2
| | | | | | Auto fix MediaWiki.Commenting.FunctionComment.DefaultNullTypeParam sniff Change-Id: I865323fd0295aabd06f3e3c75e0e5043fb31069e
* Clean up CSPRNG support for PHP7Max Semenik2018-06-101-1/+1
| | | | | | | Replace it all with random_bytes(), leave only MWCryptRand::generateHex() as a convenience helper. Change-Id: Ic30376a90e66d8f00dab86e7e6466fb3a750b87d
* build: Updating mediawiki/mediawiki-codesniffer to 13.0.0Umherirrender2017-09-251-0/+8
| | | | Change-Id: Ia24dbf015f2b4781683ca980a460d0ac3e85674e
* Improve some parameter docsUmherirrender2017-09-101-0/+2
| | | | | | Add missing @return and @param to function docs and fixed some @param Change-Id: I810727961057cfdcc274428b239af5975c57468d
* Use namespaced ScopedCallbackKunal Mehta2016-10-171-1/+1
| | | | | | The un-namespaced \ScopedCallback is deprecated. Change-Id: Ie014d5a775ead66335a24acac9d339915884d1a4
* Expand SessionManager / AuthManager documentationGergő Tisza2016-08-301-0/+8
| | | | | | Bug: T110628 Bug: T142154 Change-Id: Ib0a41f01b3d12267b2a94ea1375e6d13cacd2b69
* Session: Improvements to encryption functionalityBrad Jorsch2016-07-011-18/+49
| | | | | | | | | | | | * Use CBC mode if CTR is unavailable, since the older method should be more commonly supported. * Apply PKCS7 padding manually when using mcrypt, since mcrypt zero-pads instead. This didn't matter for CTR because the effective blocksize is 1, but it does for CBC. OpenSSL uses PKCS7 padding for CBC mode by default, so we don't have to worry about it there. Bug: T136587 Change-Id: I7290b1a7aa64df70f4ab10eee2080141528c4788
* Fix encryption code in SessionGergő Tisza2016-05-311-57/+82
| | | | | | | | * verify that the algorithm that's about to be used is available * fix exception namespace Bug: T136587 Change-Id: I9f8636bef0e10b4f2b8bfe232a26a8c33376ca04
* Make number of PBKDF2 iterations used for deriving session secret configurableOri Livneh2016-05-281-2/+7
| | | | | | | | | | | | The intent is both to allow the number of iterations to be dialed up (either as computational power increases, or on the basis of security needs) and dialed down for the unit tests, where hash_pbkdf2() calls account for 15-40% of wall time. The number of iterations is stored in the session, so changing the number of iterations does not cause existing sessions to become invalid or corrupt. Sessions that do not have wsSessionPbkdf2Iterations set (i.e., sessions which precede this change) are transparently upgraded. Change-Id: I084a97487ef4147eea0f0ce0cdf4b39ca569ef52
* SessionManager: Add provision for encrypting session dataBrad Jorsch2016-04-291-0/+150
| | | | | | | | | | | | This follows the model Chris Steipp implemented for OATHAuth. At the moment, this avoids the need to require a crypto PHP extension by adding a configuration variable to enable plaintext storage. Someday when there's time for the necessary code review, we should probably import a pure-PHP implementation of AES to fall back to when the crypto extensions are unavailable. Change-Id: Ie9cae1526d3b8bf3f517f3226ddd888893f65656
* Change \\ to \ in phpdocGergő Tisza2016-04-081-1/+1
| | | | | | | | | | | | | | Remove "\\" in namespacing. This is a Doxygen compatibility hack but does not seem needed anymore, Doxygen reads namespaced class names correctly, see e.g. https://doc.wikimedia.org/mediawiki-core/master/php/classMediaWiki_1_1Services_1_1ServiceContainer.html PHP IDEs, on the other hand, were broken by the double backslash. As an unrelated small doc fix, add parameter docs to PermissionError constructor (parent has different arguments so the inherited documentation is wrong). Change-Id: I6da0f512b8c84f65fd20e90e4617108fe6a8fcd2
* Fix Session::getToken phpdocGergő Tisza2016-04-011-1/+1
| | | | Change-Id: I332c623b08bbc980494c9ba01da77bad5c205038
* Replace uses of join() by implode()Siebrand Mazeland2016-03-081-1/+1
| | | | | | All of core uses implode() consistently now. Change-Id: Iba50898c64c43f356d1caf8869f484e90d9ff651
* Unpersist the session on logoutBrad Jorsch2016-02-291-0/+7
| | | | | | | | | | Clearing the cookies in this case is probably a good idea. This also clears cookies when a non-persisted session's metadata is dirty, for parallelism with what happens to persisted sessions. Bug: T127436 Change-Id: I76897eaac063e5e3c3563398d0f4cb36cf93783b
* Convert all array() syntax to []Kunal Mehta2016-02-171-3/+3
| | | | | | | | | | Per wikitech-l consensus: https://lists.wikimedia.org/pipermail/wikitech-l/2016-February/084821.html Notes: * Disabled CallTimePassByReference due to false positives (T127163) Change-Id: I2c8ce713ce6600a0bb7bf67537c87044c7a45c4b
* Session: Implement ArrayAccessBrad Jorsch2016-02-161-4/+43
| | | | | | | | | | Now that we dropped support for PHP 5.3.3, we can do this. The behavior of $session['foo'] when that key doesn't already exist is a little unexpected (it implicitly assigns null), but it's the best we can do. Change-Id: Ibef878867d46591a8bf542139a1719dfec3b83ab
* Revert "Remove SessionManager, temporarily"Brad Jorsch2016-02-031-0/+424
| | | | | | This reverts commit 823db5d63dd5200d04c63da50ba6bf16f928e70b. Change-Id: Ibb3e023e4eb6715295586dea87d0725c344a8271
* Remove SessionManager, temporarilyBrad Jorsch2016-02-011-424/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The plan here is to take it out of 1.27.0-wmf.12 and put it back in 1.27.0-wmf.13. Since BotPasswords depends on SessionManager, that's getting temporarily removed too. This reverts the following commits: * 6acd424e0dbc322e8b9a141bd2625453c1b9b6f1 SessionManager: Notify AuthPlugin before calling hooks * 4d1ad32d8acbd443346253d2f6a95024c833295c Close a loophole in CookieSessionProvider * fcdd643a46d87b677f6cdcc3ba9440e1472d8df7 SessionManager: Don't save non-persisted sessions to backend storage * 058aec4c76129b7ee8541692a8a48f8046e15bb6 MessageCache: Don't get a ParserOptions for $wgUser before the end of Setup.php * b5c0c03bb708f8dad6e404969df8addc123984db SessionManager: Save user name to metadata even if the user doesn't exist locally * 13f2f09a193215aa7a061d10a1955e172d06fa0a SECURITY: Fix User::setToken() call on User::newSystemUser * 305bc75b27903237a9683ec1f329bcbec0ecd266 SessionManager: Don't generate user tokens when checking the tokens * 7c4bd85d2152fd9fa975ea0fb5ffb1a0b804f99b RequestContext::exportSession() should only export persisted session IDs * 296ccfd4a9a6ad3ae412db7e2408c923aaa61f64 SessionManager: Save 'persisted' flag in session metadata * 94ba53f67731b0553a6178841d9506e384f74496 Move CSRF token handling into MediaWiki\Session\Session * 46a565d6b00174e631d2022b47677e1a78e73897 Avoid false "added in both Session and $_SESSION" when value is null * c00d0b5d94c946b8883dd7062bf7160a199aa5c2 Log backtrace for "User::loadFromSession called before the end of Setup.php" * 4eeff5b559e2ae7b8fa1f45572968ba28573a421 Use $wgSecureCookie to decide whether to actually mark secure cookies as 'secure' * 7491b52f700e220814a8190781fd794b4dd88a20 Call session_cache_limiter() before starting a session * 2c34aeea72471f9a598e67bdbf34bc5f9fb3f0c5 SessionManager: Abstract forceHTTPS cookie setting * 9aa53627a53aabec0273cecf45a86e77927ef406 Ignore auth cookies with value 'deleted' * 43f904b51a746d7f71ea2ab9951c5c98d269765b SessionManager: Kill getPersistedSessionId() * 50c52563528ba3d765c3762211f98d6f3c0e39fd SessionManager: Add SessionBackend::setProviderMetadata() * f640d403154bc0a2b4f6d399582797a9e3bc6fcb SessionManager: Notify AuthPlugin when auto-creating accounts * 70b05d1ac1e859bac2185b246e9b93ec9051e4d8 Add checks of $wgEnableBotPasswords in more places * bfed32eb78b6c720b16bc7ed60153fd2fe257a9e Do not raise a PHP warning when session write fails * 722a7331ad8d98228511f8da38adc7a3c64dd617 Only check LoggedOut timestamp on the user loaded from session * 4f5057b84b36eccd16627a6b29831dfdb4483b02 SessionManager: Change behavior of getSessionById() * 66e82e614e157e39b03d813e71ddf23f53cf640b Fix typo in [[MediaWiki:Botpasswords-editexisting/en]] * f9fd9516d922d36291037baca7205a2b0ac9f15f Add "bot passwords" * d7716f1df0b692902571bf415a0984071e3e9a60 Add missing argument for wfDebugLog * a73c5b7395a07d490f7052fd3b2491ebd656b190 Add SessionManager Change-Id: I2389a8133e25ab929e9f27f41fa9a05df8147a50
* Move CSRF token handling into MediaWiki\Session\SessionBrad Jorsch2016-01-271-0/+52
| | | | | | | User keeps most of its token-related methods because anon edit tokens are special. Login and createaccount tokens are completely moved. Change-Id: I524218fab7e2d78fd24482ad364428e98dc48bdf
* Move grant and IP restriction logic from OAuth to coreBrad Jorsch2016-01-121-0/+8
| | | | | | | This also adds code to User to allow SessionProviders to apply the grant restrictions without needing to hook UserGetRights. Change-Id: Ida2b686157aab7c8240d6a7a5a5046374ef86d52
generated by cgit v1.2.3 (git 2.25.1) at 2025-04-21 21:12:07 +0000