Guard against allowing intermediate caching when cookies are present

Output cache-control headers that disable intermediate caching even if
OutputPage->mEnableClientCache is true when the response includes
set-cookie headers as well. This change mirrors logic that has been in
use on the Wikimedia Foundation production cluster's Varnish cache
system for over 2 years to guard against accidentally caching backend
responses which include Set-Cookie headers.

Co-Author: Max Semenik <maxsem.wiki@gmail.com>
Bug: T127993
Change-Id: I1a0d38a5b9dba754b91a7832371b3dc0df51bd5a

diff --git a/includes/OutputPage.php b/includes/OutputPage.php
index 5d1d5d0..dfab03a 100644 (file)
--- a/includes/OutputPage.php
+++ b/includes/OutputPage.php
@@ -2213,8 +2213,12 @@ class OutputPage extends ContextSource {
 
                if ( $this->mEnableClientCache ) {
                        if (
-                               $config->get( 'UseSquid' ) && !SessionManager::getGlobalSession()->isPersistent() &&
-                               !$this->isPrintable() && $this->mCdnMaxage != 0 && !$this->haveCacheVaryCookies()
+                               $config->get( 'UseSquid' ) &&
+                               !$response->hasCookies() &&
+                               !SessionManager::getGlobalSession()->isPersistent() &&
+                               !$this->isPrintable() &&
+                               $this->mCdnMaxage != 0 &&
+                               !$this->haveCacheVaryCookies()
                        ) {
                                if ( $config->get( 'UseESI' ) ) {
                                        # We'll purge the proxy cache explicitly, but require end user agents

diff --git a/includes/WebResponse.php b/includes/WebResponse.php
index c7d0a5b..458c207 100644 (file)
--- a/includes/WebResponse.php
+++ b/includes/WebResponse.php
@@ -179,6 +179,16 @@ class WebResponse {
        public function clearCookie( $name, $options = [] ) {
                $this->setCookie( $name, '', time() - 31536000 /* 1 year */, $options );
        }
+
+       /**
+        * Checks whether this request is performing cookie operations
+        *
+        * @return bool
+        * @since 1.27
+        */
+       public function hasCookies() {
+               return (bool)self::$setCookies;
+       }
 }
 
 /**