| Commit message (Collapse) | Author | Age | Files | Lines |
... | |
|/
|
|
|
|
|
|
|
|
| |
The motivation is to make the code less confusing. I hope this is the
case.
?? is an older PHP 7.0 feature.
??= was added in PHP 7.4, which we can finally use.
Change-Id: Id807affa52bd1151a74c064623b41d950a389560
|
|
|
|
|
|
|
| |
This adds reconfiguring db pools in case a replica gets depooled
Bug: T298485
Change-Id: Id052ce8ed45c51e51b071778858d27b48605bf93
|
|
|
|
|
|
|
|
| |
Introduced in PHP 7.1. Because it's shorter and looks nice.
I used regex replacement.
Change-Id: I0555e199d126cd44501f859cb4589f8bd49694da
|
|
|
|
|
|
|
| |
Various variables are left from ealier refactor are now unused
and can be removed to make the code easier to read
Change-Id: Id51770af1f08e85c7e7a02234a2cd2ab5b47ee7a
|
|
|
|
| |
Change-Id: I31f316c66b3066461b9297c7b6f9845ade99f0df
|
|
|
|
|
|
|
|
|
| |
Make phan stricter about conditional variable declaration
Remaining false positive issues are suppressed.
The suppression and the setting change can only be done together
Bug: T259172
Change-Id: I1f200ac37df7448453688bf464a8250c97313e5d
|
|
|
|
|
|
|
|
|
|
|
| |
Make phan stricter about null types by setting null_casts_as_any_type to
false (the default in mediawiki-phan-config)
Remaining false positive issues are suppressed.
The suppression and the setting change can only be done together
Bug: T242536
Bug: T301991
Change-Id: I0f295382b96fb3be8037a01c10487d9d591e7e01
|
|
|
|
|
|
|
|
|
| |
Make phan stricter about scalar types by setting scalar_implicit_cast to
false (the default in mediawiki-phan-config)
Bug: T242536
Bug: T301991
Change-Id: Ia2fe30b17804186571722e728578121c8b75d455
|
|
|
|
|
|
|
|
|
| |
The function getDB is called with DB_REPLICA and with a string
(cluster), which looks broken.
Found by phan strict checks
Change-Id: Id3af4fec2661902590ace91c2b1631584bf8f8b6
|
|
|
|
| |
Change-Id: Id1a2d0dedd3326083b6a9727f1ab68ddd8f65df8
|
|
|
|
|
| |
Bug: T299471
Change-Id: I5acae5e72de2f85fd6e68e391297895c86ffb10e
|
|
|
|
|
|
|
| |
This defaults to SlotRecord::MAIN, which is what it should be rather than RevisionRecord::RAW
Bug: T294043
Change-Id: Ib035fe4eea778747f47a476c8aa2cfaab44aa7d8
|
|
|
|
| |
Change-Id: Ic07cd955a3a25a70db2a1589a57d19a592813986
|
|
|
|
|
|
|
|
|
|
| |
Fixes checkStorage.php --fix
* importRevision() is required to be public for WikiImporter::setRevisionCallback()
* $revision must not be passed by reference
* $importer is unused, so removed
Change-Id: I53ef3825308af3b6e632cb88b9a3eb2f40ab5239
|
|
|
|
|
|
|
| |
For use in the checkStorage and resolveStubs maintenance scripts, in order to fix them.
Follows-Up: Id1f530c2c8ec1171615f726dc7446431ee7ca8fe
Change-Id: Iade3d1660f2b7db62f829f5e5ca94372614ae7e5
|
|
|
|
|
|
|
| |
Addition and remove of suppression needs to be done with the version
update.
Change-Id: I3288b3cefa744b507eadebb67b8ab08c86517c1c
|
|
|
|
|
| |
Bug: T282894
Change-Id: I6d6361a0b84f7130a27df6a6c75a983c73e5dd95
|
|
|
|
|
|
|
| |
Hard-deprecating immediately as no known users in git outside of mainteance scripts.
Bug: T282894
Change-Id: I072f3d93a9598df719f76f635bfd477737097ad9
|
|
|
|
|
|
|
|
| |
Returning void from execute() is success.
Returning true is success, false is failure with exit(1)
Using fatalError also using exit(1)
Change-Id: I1d40430ad6226e4aab8f0810b03ee1213282d123
|
|\ |
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Queries that query a value "1" are expected to return either
that "1" (possibly as a string), or false. It's safe to simply
cast this to bool and use it as it is.
Queries for COUNT(*) are expected to return that number,
possibly as a string. It's not possible for such a query to
return false. And even if, casting to 0 is fine.
I found an existing code style where the table name and the
"1" are on the same line as the selectField() method name, and
applied it to all similar queries.
Change-Id: I9453196281871c03ef03f653f43762eb9284342f
|
| |
| |
| |
| |
| |
| |
| | |
When the if branch continues the loop,
than the next branch does not need to be an else branch
Change-Id: Ia158709b7fd2ea811f1049cf8f53ed12c89719e3
|
|/
|
|
|
|
| |
Found by sonarqube
Change-Id: I3464d25e94d98aaca55d9209d5175542b335f994
|
|
|
|
|
| |
Bug: T282894
Change-Id: I30a600335af735a13a6ad2d3df56a5f17e05bfab
|
|
|
|
|
|
|
| |
And replace all uses.
Bug: T282894
Change-Id: I5222a8568255ac9fa5e2350e2264b8d2ee5eb968
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
developer's intention
array_fill_keys() was introduced in PHP 5.2.0 and works like
array_flip() except that it does only one thing (copying keys) instead
of two things (copying keys and values). That makes it faster and more
obvious.
When array_flip() calls were paired, I left them as is, because that
pattern is too cute. I couldn't kill something so cute.
Sometimes it was hard to figure out whether the values in array_flip()
result were used. That's the point of this change. If you use
array_fill_keys(), the intention is obvious.
Change-Id: If8d340a8bc816a15afec37e64f00106ae45e10ed
|
|
|
|
|
|
|
|
| |
This patch injects services into WikiImporter. It also adds
a WikiImporterFactory service for creating WikiImporter
instances.
Change-Id: I2966297e5728fca1ae8280361f1008cef6c6041b
|
|
|
|
|
|
| |
Just an auto-replace from codesniffer for now.
Change-Id: I5240dc9ac5929d291b0ef1c743ea2bfd3f428266
|
|
|
|
|
|
|
|
|
| |
This is micro-optimization of closure code to avoid binding the closure
to $this where it is not needed.
Created by I25a17fb22b6b669e817317a0f45051ae9c608208
Change-Id: I0ffc6200f6c6693d78a3151cb8cea7dce7c21653
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Many files were in the autoloader despite having potentially harmful
file-scope code.
* Exclude all CommandLineInc maintenance scripts from the autoloader.
* Introduce "NO_AUTOLOAD" tag which excludes the file containing it
from the autoloader. Use it on CommandLineInc.php and a few
suspicious-looking files without classes in case they are refactored
to add classes in the future.
* Add a test which parses all non-PSR4 class files and confirms that
they do not contain dangerous file-scope code. It's slow (15s) but
its results were enlightening.
* Several maintenance scripts define constants in the file scope,
intending to modify the behaviour of MediaWiki. Either move the
define() to a later setup function, or protect with NO_AUTOLOAD.
* Use require_once consistently with Maintenance.php and
doMaintenance.php, per the original convention which is supposed to
allow one maintenance script to use the class of another maintenance
script. Using require breaks autoloading of these maintenance class
files.
* When Maintenance.php is included, check if MediaWiki has already
started, and if so, return early. Revert the fix for T250003 which
is incompatible with this safety measure. Hopefully it was superseded
by splitting out the class file.
* In runScript.php add a redundant PHP_SAPI check since it does some
things in file-scope code before any other check will be run.
* Change the if(false) class_alias(...) to something more hackish and
more compatible with the new test.
* Some site-related scripts found Maintenance.php in a non-standard way.
Use the standard way.
* fileOpPerfTest.php called error_reporting(). Probably debugging code
left in; removed.
* Moved mediawiki.compress.7z registration from the class file to the
caller.
Change-Id: I1b1be90343a5ab678df6f1b1bdd03319dcf6537f
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Taint check checks for possible security issues by tracking html
escaping and more by using phan.
This slows done the phan-job a bit and requires more ram
Keep the DoubleEscaped issues out to make reviewer easier
Adds suppression for false positives
Adds taint-annotation to help taint-check
Removes suppression for code phan now understand better by the tracking
of keys in taint-check
Fix some small issues by adding int cast or htmlspecialchars calls
Bug: T216348
Bug: T268920
Change-Id: I849ac4f120fd15b483e8939d4db45c98dc351259
|
|
|
|
| |
Change-Id: I73eaadb7a78a4ce84a5bbff2d48665da807fde9f
|
|
|
|
|
|
|
|
| |
all places detected as SecurityCheck-XSS by
mediawiki/phan-taint-check-plugin 3.1.0
Bug: T216348
Change-Id: Ib4c8295ad95c2c605fd2f0791e73322f747a00af
|
|
|
|
|
|
|
|
| |
all places detected as SecurityCheck-SQLInjection by
mediawiki/phan-taint-check-plugin 3.1.0
Bug: T216348
Change-Id: Ifd9589e8da996a0017b4361c62830e597c41f10e
|
|
|
|
|
|
|
| |
… and fix the name to match the class.
Bug: T184782
Change-Id: Id3d0d0a6b3f2da6316d18eb57804c5a2b697108b
|
|
|
|
|
| |
Bug: T261059
Change-Id: I56ac5d2f8d010f1116e9ef9801c31622a8278ca7
|
|
|
|
|
|
| |
It is easier to read.
Change-Id: Ia3965b80153d64f95b415c6c30f526efa252f554
|
|
|
|
|
|
|
|
| |
Remove duplicate casts
Suppress false positives
Bug: T248438
Change-Id: I2f89664a4bcd3b39b15e7cf850adda2f0c90ae6f
|
|
|
|
|
|
| |
Useful for logging
Change-Id: I79fe037abcd74f56c935abc118d706bef0198124
|
|
|
|
|
| |
Bug: T246284
Change-Id: I4649a0f30cf8638856f2e66d454b83a397e3e3d4
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
A terminating line break has not been required in wfDebug() since 2014,
however no migration was done. Some of these line breaks found their way
into LoggerInterface::debug() calls, where they mess up the formatting
of the debug log.
So, remove terminating line breaks from wfDebug() and
LoggerInterface::debug() calls.
Also:
* Fix the stripping of leading line breaks from the log header emitted
by Setup.php. This feature, accidentally broken in 2014, allows
requests to be distinguished in the log file.
* Avoid using the global variable $self.
* Move the logging of the client IP back to Setup.php. It was moved to
WebRequest in the hopes that it would not always be needed, however
$wgRequest->getIP() is now called unconditionally a few lines up in
Setup.php. This means that it is put in its proper place after the
"start request" message.
* Wrap the log header code in a closure so that variables like $name do
not leak into global scope.
* In Linker.php, remove a few instances of an unnecessary second
parameter to wfDebug().
Change-Id: I96651d3044a95b9d210b51cb8368edc76bebbb9e
|
|
|
|
| |
Change-Id: I50c7c93f1534e966224f98a835ca01f93eb9416d
|
|
|
|
| |
Change-Id: Ib0f081f7b278fdd3f4083fc5020bcac97f6015b4
|
|
|
|
| |
Change-Id: I337147d61e2ec686a8672d0340dff4b6783f78cd
|
|
|
|
|
| |
Bug: T246284
Change-Id: I49ac11b4f952b2494349cc49360501dd3bfc2c90
|
|
|
|
|
| |
Bug: T246284
Change-Id: I708f265aac3016e34d02936cf5dff98a3036ef0f
|
|
|
|
|
|
|
|
| |
NOTE: This was manually tested to ensure it does not
break updates, see T242764.
Bug: T198557
Change-Id: I1d9f5465018bae10124514bc38169e23e0e613e6
|
|
|
|
| |
Change-Id: Ie225ebfc37c824e3167742137bbbc9f64aca5f5e
|
|
|
|
|
|
|
|
|
|
| |
Released just now.
Many old suppressions can now be removed. Enabling the issue for
undeclared variables is left to do later, given that there are
roughly 200 warning.
Change-Id: I99462a1e9232d6e75022912e2df82bc2038476ef
|
|
|
|
|
|
| |
Column names or other sql fragments are strings, not integer
Change-Id: I7950b6e7ce4fa3b97c8b8ed55c8d7d0119eaac7e
|