aboutsummaryrefslogtreecommitdiffstats
path: root/tests/phpunit/includes/session/SessionManagerTest.php
Commit message (Collapse)AuthorAgeFilesLines
...
* phpunit: Avoid use of deprecated getMock for PHPUnit 5 compatTimo Tijhof2017-04-061-1/+2
| | | | | | | | | | | | | | | | | | | | | | The default will remain PHPUnit 4.x due to PHP 5.5 support. But, we should allow developers to run tests with newer PHPUnit versions which are noticably faster (especially for code coverage reports). * <https://github.com/sebastianbergmann/phpunit/wiki/Release-Announcement-for-PHPUnit-5.4.0> PHPUnit 5 deprecates the getMock() shortcut for getMockBuilder()->getMock(). It instead introduces the shortcut createMock() which has better defaults than getMockBuilder(). For example, it sets 'disableArgumentCloning' and other things by default. Going forward, code should either use getMockBuilder directly and configure it using the setter methods (instead of the confusing variadic arguments of getMock) or simply use the new minimalistic createMock method. This patch backports the createMock method to MediaWikiTestCase so that we can start using it. Change-Id: I091c0289b21d2b1c876adba89529dc3e72b99af2
* Demote "Unverified user provided and no metadata to auth it" log message to infoGergő Tisza2017-02-171-1/+1
| | | | | Bug: T158367 Change-Id: Ic9a949204d9d4b6d154e5a8d31f6c8501043c657
* Remove unused imports from test classesThiemo Mättig2017-01-101-1/+0
| | | | | | | Validating this should be as simple as it can be: if the tests run, this change should be fine. :-) Change-Id: I8e4a3dfc83fdc9b8c8d7f5bbd067e088ebd2133d
* Use namespaced ScopedCallbackKunal Mehta2016-10-171-1/+1
| | | | | | The un-namespaced \ScopedCallback is deprecated. Change-Id: Ie014d5a775ead66335a24acac9d339915884d1a4
* Remove $wgDisableAuthManagerGergő Tisza2016-08-091-297/+0
| | | | Change-Id: I2b2c9693a275fcc026916bd97f303e7a5c8df341
* Add AuthManagerBrad Jorsch2016-05-161-1/+5
| | | | | | | | | | | | | This implements the AuthManager class and its needed interfaces and subclasses, and integrates them into the backend portion of MediaWiki. Integration with frontend portions of MediaWiki (e.g. ApiLogin, Special:Login) is left for a followup. Bug: T91699 Bug: T71589 Bug: T111299 Co-Authored-By: Gergő Tisza <gtisza@wikimedia.org> Change-Id: If89d24838e326fe25fe867d02181eebcfbb0e196
* Merge "Add SessionInfo force-use flag"jenkins-bot2016-05-111-0/+16
|\
| * Add SessionInfo force-use flagBrad Jorsch2016-05-101-0/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A provider that uses SessionProvider::hashToSessionId() will likely have issues if something such as a call to $user->setToken() causes SessionManager::loadSessionInfoFromStore() to fail, since the provider can't just arbitrarily change the session ID it returns. The two solutions to this problem are: * Somehow include everything that could cause loadSessionInfoFromStore to fail in the data hashed by hashToSessionId. * Flag the SessionInfo so that, if stored data and the SessionInfo conflict, it should delete the stored data instead of discarding the SessionInfo. Since the second is less complexity overall due to the lack of need to define "everything", this patch takes that approach. Change-Id: I8c6fab2ec295e71242bbcb19d0ee5ade6bd655df
* | Add SessionManager::invalidateSessionsForUserBrad Jorsch2016-05-101-0/+29
|/ | | | | | | Most of the time calling User::setToken() is enough, but CentralAuth needs to be able to call CentralAuthUser::resetAuthToken() on command. Change-Id: Iad2ae914a81481f040e047b550f3fd3437277626
* SessionManager: Ignore Session object destruction during global shutdownBrad Jorsch2016-04-201-2/+2
| | | | | | | | | | | | | | We already save all open SessionBackends when shutdown handlers are run, which *should* make the Session object destructors that run during global shutdown not have anything to save. But it can get fooled if the Session data contains other objects that have already gotten destroyed during the global shutdown, leading to spurious warnings and errors as it tries to access partically-destroyed objects. The solution is to set a flag when we do the shutdown handlers and just ignore the last gasps from Session::__destruct() that might come after. Change-Id: Ic3eb0bac2d29a30488c84b6525ad796a7f1c9ce9
* Use ::class in place of string constantsBrad Jorsch2016-03-281-17/+17
| | | | | | | This takes advantage of namespacing, and avoids having double-backslashes all over the place. Change-Id: I450fe4e9b1c4cf4e24fced3932fe796cbbadf3a3
* SessionManager: Use existing backend for the ID if one is loadedBrad Jorsch2016-03-221-0/+34
| | | | | | | | | | This fixes a bug where SessionBackend::resetId() of the PHP session will fail to properly load $_SESSION because the new session ID hasn't been saved to the store yet. It's also a reasonable performance improvement, no need to call loadSessionInfoFromStore() when we already have the session loaded. Change-Id: I30f159ef1267442a6325aabbbdfaf69defc10ed6
* Many more function case mismatchesReedy2016-03-191-1/+1
| | | | Change-Id: I5d3a5eb8adea1ecbf136415bb9fd7a162633ccca
* Fix numerous class/function casingReedy2016-03-181-1/+1
| | | | Change-Id: I23982bfa0548c9ea3bdb432be7982f1563930715
* Unpersist the session on session load failureBrad Jorsch2016-02-291-1/+48
| | | | | | | There's no point in keeping broken cookies around, it just means all future requests will continue to flood the logs. Change-Id: Ib10c9ed9049b71ed434950fc731ea77960ceca0c
* Revert "Log multiple IPs using the same session or the same user account"Ori Livneh2016-02-231-71/+0
| | | | | | | | This reverts commit f22549a60539c9aa5c5390c8417c984ba8eef5b2. Per T125455#2054194. Bug: T125455 Change-Id: Ic2049381e98586e91974fc5b47d9e857a73414a4
* Convert all array() syntax to []Kunal Mehta2016-02-171-408/+408
| | | | | | | | | | Per wikitech-l consensus: https://lists.wikimedia.org/pipermail/wikitech-l/2016-February/084821.html Notes: * Disabled CallTimePassByReference due to false positives (T127163) Change-Id: I2c8ce713ce6600a0bb7bf67537c87044c7a45c4b
* Merge "Log multiple IPs using the same session or the same user account"jenkins-bot2016-02-121-0/+70
|\
| * Log multiple IPs using the same session or the same user accountGergő Tisza2016-02-111-0/+70
| | | | | | | | | | | | | | | | | | As an attempt to detect SessionManager errors that log people into the wrong account, log multiple IPs using the same session, or the same user account. Bug: T125455 Change-Id: I27468a3f6d582d9b46984227b9307dc71190fd6a
* | SessionProvider::mergeMetadata: Log additional dataBryan Davis2016-02-111-1/+1
|/ | | | | | | | | Add the data values and types to the exception raised when mismatched session data is processed. This is done by passing the old and new values on via a new MetadataMergeException class. The attached data is added to the debug logging context info when caught. Change-Id: If8a7174399289bc284ca1b36052ba515c8857c50
* Remove "$that" from SessionManagerBrad Jorsch2016-02-101-14/+11
| | | | | | | Also "function () use ( &$ref )" that was being done for similar reasons. Change-Id: If4ec263a9a9c02c1c6a414b26a0e77ba144437f1
* Merge "Update session log messages"jenkins-bot2016-02-081-32/+43
|\
| * Update session log messagesBryan Davis2016-02-061-32/+43
| | | | | | | | | | | | | | | | * Use PSR-3 templates and context where applicable * Add log coverage for exceptional events Bug: T125452 Change-Id: I8f96fa1c5766c739a21219abcae2dbb76de53e2a
* | Merge "Introduce User::INVALID_TOKEN"jenkins-bot2016-02-081-4/+0
|\ \
| * | Introduce User::INVALID_TOKENBrad Jorsch2016-02-031-4/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | To avoid having to have SessionManager try to reset sessions on every request, we set the user_token to a special value. When that value is present, User::getToken() returns a different value every time (so existing checks will fail) and User::setToken() refuses to alter it. Bug: T124414 Change-Id: Ie4c84ce993e40a081288cf5a543f8ba99f98806a
* | | Remove duplicate array keys from testsReedy2016-02-071-1/+0
| |/ |/| | | | | Change-Id: I437b87151be6589a8d5c984b90cd249c2d0ecd3c
* | Clean up after Ie161e0fBrad Jorsch2016-02-031-10/+3
|/ | | | | | | | | | | | | | | Ie161e0f was done in a hurry, and so didn't do things in the best ways. This introduces a new "CachedBagOStuff" that transparently handles all the logic that had been copy-pasted all over in Ie161e0f. The differences between CachedBagOStuff and MultiWriteBagOStuff are: * CachedBagOStuff supports only one "backend". * There's a flag for writes to only go to the in-memory cache. * The in-memory cache is always updated. * Locks go to the backend cache (with MultiWriteBagOStuff, it would wind up going to the HashBagOStuff used for the in-memory cache). Change-Id: Iea494729bd2e8c6c5ab8facf4c241232e31e8215
* Revert "Remove SessionManager, temporarily"Brad Jorsch2016-02-031-0/+1684
| | | | | | This reverts commit 823db5d63dd5200d04c63da50ba6bf16f928e70b. Change-Id: Ibb3e023e4eb6715295586dea87d0725c344a8271
* Remove SessionManager, temporarilyBrad Jorsch2016-02-011-1684/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The plan here is to take it out of 1.27.0-wmf.12 and put it back in 1.27.0-wmf.13. Since BotPasswords depends on SessionManager, that's getting temporarily removed too. This reverts the following commits: * 6acd424e0dbc322e8b9a141bd2625453c1b9b6f1 SessionManager: Notify AuthPlugin before calling hooks * 4d1ad32d8acbd443346253d2f6a95024c833295c Close a loophole in CookieSessionProvider * fcdd643a46d87b677f6cdcc3ba9440e1472d8df7 SessionManager: Don't save non-persisted sessions to backend storage * 058aec4c76129b7ee8541692a8a48f8046e15bb6 MessageCache: Don't get a ParserOptions for $wgUser before the end of Setup.php * b5c0c03bb708f8dad6e404969df8addc123984db SessionManager: Save user name to metadata even if the user doesn't exist locally * 13f2f09a193215aa7a061d10a1955e172d06fa0a SECURITY: Fix User::setToken() call on User::newSystemUser * 305bc75b27903237a9683ec1f329bcbec0ecd266 SessionManager: Don't generate user tokens when checking the tokens * 7c4bd85d2152fd9fa975ea0fb5ffb1a0b804f99b RequestContext::exportSession() should only export persisted session IDs * 296ccfd4a9a6ad3ae412db7e2408c923aaa61f64 SessionManager: Save 'persisted' flag in session metadata * 94ba53f67731b0553a6178841d9506e384f74496 Move CSRF token handling into MediaWiki\Session\Session * 46a565d6b00174e631d2022b47677e1a78e73897 Avoid false "added in both Session and $_SESSION" when value is null * c00d0b5d94c946b8883dd7062bf7160a199aa5c2 Log backtrace for "User::loadFromSession called before the end of Setup.php" * 4eeff5b559e2ae7b8fa1f45572968ba28573a421 Use $wgSecureCookie to decide whether to actually mark secure cookies as 'secure' * 7491b52f700e220814a8190781fd794b4dd88a20 Call session_cache_limiter() before starting a session * 2c34aeea72471f9a598e67bdbf34bc5f9fb3f0c5 SessionManager: Abstract forceHTTPS cookie setting * 9aa53627a53aabec0273cecf45a86e77927ef406 Ignore auth cookies with value 'deleted' * 43f904b51a746d7f71ea2ab9951c5c98d269765b SessionManager: Kill getPersistedSessionId() * 50c52563528ba3d765c3762211f98d6f3c0e39fd SessionManager: Add SessionBackend::setProviderMetadata() * f640d403154bc0a2b4f6d399582797a9e3bc6fcb SessionManager: Notify AuthPlugin when auto-creating accounts * 70b05d1ac1e859bac2185b246e9b93ec9051e4d8 Add checks of $wgEnableBotPasswords in more places * bfed32eb78b6c720b16bc7ed60153fd2fe257a9e Do not raise a PHP warning when session write fails * 722a7331ad8d98228511f8da38adc7a3c64dd617 Only check LoggedOut timestamp on the user loaded from session * 4f5057b84b36eccd16627a6b29831dfdb4483b02 SessionManager: Change behavior of getSessionById() * 66e82e614e157e39b03d813e71ddf23f53cf640b Fix typo in [[MediaWiki:Botpasswords-editexisting/en]] * f9fd9516d922d36291037baca7205a2b0ac9f15f Add "bot passwords" * d7716f1df0b692902571bf415a0984071e3e9a60 Add missing argument for wfDebugLog * a73c5b7395a07d490f7052fd3b2491ebd656b190 Add SessionManager Change-Id: I2389a8133e25ab929e9f27f41fa9a05df8147a50
* SessionManager: Don't save non-persisted sessions to backend storageBrad Jorsch2016-01-301-2/+8
| | | | | | | | | This introduces an in-process cache (using a HashBagOStuff) for session data, and only saves to the external cache when the session is persisted. Bug: T125267 Change-Id: Ie161e0f7522cd68515b060ad8cf8c151b7198b0b
* SessionManager: Save 'persisted' flag in session metadataBrad Jorsch2016-01-271-0/+32
| | | | | | | | This allows SessionManager::getSessionById()->isPersisted() to be reliably set. Otherwise it depends on whether the SessionBackend is still loaded or not. Change-Id: I17733559ac5d8fff13881664333f61d36f610b6d
* SessionManager: Kill getPersistedSessionId()Brad Jorsch2016-01-221-26/+0
| | | | | | | | | | | | | | It's not guaranteed that loadSessionFromStore() will succeed after whatever alterations the SessionProvider might have made later in the request. So instead, let's make a new global object that stores the SessionId of the persistent session that was loaded during Setup.php, if any. Then we can check that when we need to know whether the session was persisted. Bug: T124468 Change-Id: I1e8e616c83b16aadd86b0a0a40826d40f6e8abe4
* SessionManager: Change behavior of getSessionById()Brad Jorsch2016-01-201-21/+10
| | | | | | | | | | | | | | | | | | It's easily possible for SessionManager::getSessionById() to not be able to load the specified session and to not be able to create an empty one by that ID, for example if the user's token changed. So change this from an exceptional condition to an expected one, and adjust callers to deal with it appropriately. Let's also make the checks for invalid data structure when loading the session from the store delete the bogus data entirely. At the same time, let's change the silly "$noEmpty" parameter to "$create" and make the default behavior be not to create an empty session. Bug: T124126 Change-Id: I085d2026d1b366b1af9fd0e8ca3d815fd8288030
* Add SessionManagerBrad Jorsch2016-01-121-0/+1683
SessionManager is a general-purpose session management framework, rather than the cookie-based sessions that PHP wants to provide us. While fallback is provided for using $_SESSION and other PHP session management functions, they should be avoided in favor of using SessionManager directly. For proof-of-concept extensions, see OAuth change Ib40b221 and CentralAuth change I27ccabdb. Bug: T111296 Change-Id: Ic1ffea74f3ccc8f93c8a23b795ecab6f06abca72
generated by cgit v1.2.3 (git 2.25.1) at 2025-04-30 07:59:14 +0000