Merge "Replace deprecated function wfEscapeShellArg with Shell::escape()"

diff --git a/.phan/config.php b/.phan/config.php
index c754480..12e723d 100644 (file)
--- a/.phan/config.php
+++ b/.phan/config.php
@@ -97,12 +97,8 @@ $cfg['suppress_issue_types'] = array_merge( $cfg['suppress_issue_types'], [
        "PhanTypeArraySuspiciousNullable",
        // approximate error count: 26
        "PhanTypeComparisonFromArray",
-       // approximate error count: 2
-       "PhanTypeComparisonToArray",
        // approximate error count: 63
        "PhanTypeInvalidDimOffset",
-       // approximate error count: 6
-       "PhanTypeInvalidExpressionArrayDestructuring",
        // approximate error count: 7
        "PhanTypeInvalidLeftOperandOfIntegerOp",
        // approximate error count: 2

diff --git a/RELEASE-NOTES-1.33 b/RELEASE-NOTES-1.33
index 9c5081c..419560d 100644 (file)
--- a/RELEASE-NOTES-1.33
+++ b/RELEASE-NOTES-1.33
@@ -436,6 +436,8 @@ because of Phabricator reports.
   insertions into links tables.
 * Category::newFromID( $id )->getID() will now return $id without any
   validation, to avoid a mostly unnecessary DB query.
+* On Special:Version, the name for an extension can no longer be arbitrary
+  html when no link is specified.
 
 == Compatibility ==
 MediaWiki 1.33 requires PHP 7.0.13 or later. Although HHVM 3.18.5 or later is

diff --git a/docs/hooks.txt b/docs/hooks.txt
index 5f2c129..21e535c 100644 (file)
--- a/docs/hooks.txt
+++ b/docs/hooks.txt
@@ -1612,7 +1612,7 @@ $out: OutputPage object
 notifications.
 &$title: Title object of page
 &$url: string value as output (out parameter, can modify)
-$query: query options passed to Title::getCanonicalURL()
+$query: query options as string passed to Title::getCanonicalURL()
 
 'GetContentModels': Add content models to the list of available models.
 &$models: array containing current model list, as strings. Extensions should add to this list.
@@ -1650,7 +1650,7 @@ $single: Only extract the current language; if false, the prop value should
 'GetFullURL': Modify fully-qualified URLs used in redirects/export/offsite data.
 &$title: Title object of page
 &$url: string value as output (out parameter, can modify)
-$query: query options passed to Title::getFullURL()
+$query: query options as string passed to Title::getFullURL()
 
 'GetHumanTimestamp': Pre-emptively override the human-readable timestamp
 generated by MWTimestamp::getHumanTimestamp(). Return false in this hook to use
@@ -1664,7 +1664,7 @@ $lang: Language that will be used to render the timestamp
 'GetInternalURL': Modify fully-qualified URLs used for squid cache purging.
 &$title: Title object of page
 &$url: string value as output (out parameter, can modify)
-$query: query options passed to Title::getInternalURL()
+$query: query options as string passed to Title::getInternalURL()
 
 'GetIP': modify the ip of the current user (called only once).
 &$ip: string holding the ip as determined so far
@@ -1689,7 +1689,7 @@ be buggy for internal urls on render if you do not re-implement the horrible
 hack that Title::getLocalURL uses in your own extension.
 &$title: Title object of page
 &$url: string value as output (out parameter, can modify)
-$query: query options passed to Title::getLocalURL()
+$query: query options as string passed to Title::getLocalURL()
 
 'GetLocalURL::Article': Modify local URLs specifically pointing to article paths
 without any fancy queries or variants.
@@ -1699,7 +1699,7 @@ without any fancy queries or variants.
 'GetLocalURL::Internal': Modify local URLs to internal pages.
 &$title: Title object of page
 &$url: string value as output (out parameter, can modify)
-$query: query options passed to Title::getLocalURL()
+$query: query options as string passed to Title::getLocalURL()
 
 'GetLogTypesOnUser': Add log types where the target is a userpage
 &$types: Array of log types

diff --git a/includes/Title.php b/includes/Title.php
index def561e..3891c82 100644 (file)
--- a/includes/Title.php
+++ b/includes/Title.php
@@ -2065,8 +2065,8 @@ class Title implements LinkTarget, IDBAccessObject {
         * protocol-relative, the URL will be expanded to http://
         *
         * @see self::getLocalURL for the arguments.
-        * @param string $query
-        * @param string|bool $query2
+        * @param string|string[] $query
+        * @param string|bool $query2 Deprecated
         * @return string The URL
         */
        public function getInternalURL( $query = '', $query2 = false ) {
@@ -2088,8 +2088,8 @@ class Title implements LinkTarget, IDBAccessObject {
         * NOTE: Unlike getInternalURL(), the canonical URL includes the fragment
         *
         * @see self::getLocalURL for the arguments.
-        * @param string $query
-        * @param string|bool $query2
+        * @param string|string[] $query
+        * @param string|bool $query2 Deprecated
         * @return string The URL
         * @since 1.18
         */

diff --git a/includes/debug/DeprecationHelper.php b/includes/debug/DeprecationHelper.php
index 91ad67e..dc73ac9 100644 (file)
--- a/includes/debug/DeprecationHelper.php
+++ b/includes/debug/DeprecationHelper.php
@@ -50,7 +50,7 @@ trait DeprecationHelper {
         * the name of the class defining the property, <component> is the MediaWiki component
         * (extension, skin etc.) for use in the deprecation warning) or null if it is MediaWiki.
         * E.g. [ 'mNewRev' => [ '1.32', 'DifferenceEngine', null ]
-        * @var string[]
+        * @var string[][]
         */
        protected $deprecatedPublicProperties = [];
 

diff --git a/includes/libs/objectcache/WinCacheBagOStuff.php b/includes/libs/objectcache/WinCacheBagOStuff.php
index 818f6f1..8c419b2 100644 (file)
--- a/includes/libs/objectcache/WinCacheBagOStuff.php
+++ b/includes/libs/objectcache/WinCacheBagOStuff.php
@@ -70,12 +70,18 @@ class WinCacheBagOStuff extends BagOStuff {
        public function set( $key, $value, $expire = 0, $flags = 0 ) {
                $result = wincache_ucache_set( $key, serialize( $value ), $expire );
 
+               // false positive, wincache_ucache_set returns an empty array
+               // in some circumstances.
+               // @phan-suppress-next-line PhanTypeComparisonToArray
                return ( $result === [] || $result === true );
        }
 
        public function add( $key, $value, $exptime = 0, $flags = 0 ) {
                $result = wincache_ucache_add( $key, serialize( $value ), $exptime );
 
+               // false positive, wincache_ucache_add returns an empty array
+               // in some circumstances.
+               // @phan-suppress-next-line PhanTypeComparisonToArray
                return ( $result === [] || $result === true );
        }
 

diff --git a/includes/resourceloader/ResourceLoader.php b/includes/resourceloader/ResourceLoader.php
index 4cf8735..f5b7bdd 100644 (file)
--- a/includes/resourceloader/ResourceLoader.php
+++ b/includes/resourceloader/ResourceLoader.php
@@ -1173,7 +1173,7 @@ MESSAGE;
         */
        private function ensureNewline( $str ) {
                $end = substr( $str, -1 );
-               if ( $end === false || $end === "\n" ) {
+               if ( $end === false || $end === '' || $end === "\n" ) {
                        return $str;
                }
                return $str . "\n";
@@ -1445,7 +1445,7 @@ MESSAGE;
                        }
                }
 
-               array_walk( $modules, [ 'self', 'trimArray' ] );
+               array_walk( $modules, [ self::class, 'trimArray' ] );
 
                return Xml::encodeJsCall(
                        'mw.loader.register',

diff --git a/includes/specials/SpecialEmailuser.php b/includes/specials/SpecialEmailuser.php
index ded0891..5f80215 100644 (file)
--- a/includes/specials/SpecialEmailuser.php
+++ b/includes/specials/SpecialEmailuser.php
@@ -248,7 +248,8 @@ class SpecialEmailUser extends UnlistedSpecialPage {
         * @param User $user
         * @param string $editToken Edit token
         * @param Config|null $config optional for backwards compatibility
-        * @return string|null Null on success or string on error
+        * @return null|string|array Null on success, string on error, or array on
+        *  hook error
         */
        public static function getPermissionsError( $user, $editToken, Config $config = null ) {
                if ( $config === null ) {

diff --git a/includes/specials/SpecialVersion.php b/includes/specials/SpecialVersion.php
index 2ad0def..391d9ab 100644 (file)
--- a/includes/specials/SpecialVersion.php
+++ b/includes/specials/SpecialVersion.php
@@ -703,7 +703,7 @@ class SpecialVersion extends SpecialPage {
                                [ 'class' => 'mw-version-ext-name' ]
                        );
                } else {
-                       $extensionNameLink = $extensionName;
+                       $extensionNameLink = htmlspecialchars( $extensionName );
                }
 
                // ... and the version information

diff --git a/includes/user/User.php b/includes/user/User.php
index 58ea17b..d2edbdf 100644 (file)
--- a/includes/user/User.php
+++ b/includes/user/User.php
@@ -2205,6 +2205,9 @@ class User implements IDBAccessObject, UserIdentity {
 
                // Set the user limit key
                if ( $userLimit !== false ) {
+                       // phan is confused because &can-bypass's value is a bool, so it assumes
+                       // that $userLimit is also a bool here.
+                       // @phan-suppress-next-line PhanTypeInvalidExpressionArrayDestructuring
                        list( $max, $period ) = $userLimit;
                        wfDebug( __METHOD__ . ": effective user limit: $max in {$period}s\n" );
                        $keys[$cache->makeKey( 'limiter', $action, 'user', $id )] = $userLimit;
@@ -2236,6 +2239,9 @@ class User implements IDBAccessObject, UserIdentity {
 
                $triggered = false;
                foreach ( $keys as $key => $limit ) {
+                       // phan is confused because &can-bypass's value is a bool, so it assumes
+                       // that $userLimit is also a bool here.
+                       // @phan-suppress-next-line PhanTypeInvalidExpressionArrayDestructuring
                        list( $max, $period ) = $limit;
                        $summary = "(limit $max in {$period}s)";
                        $count = $cache->get( $key );

diff --git a/languages/Language.php b/languages/Language.php
index f72ac1a..52cb231 100644 (file)
--- a/languages/Language.php
+++ b/languages/Language.php
@@ -3697,6 +3697,7 @@ class Language {
                                        }
                                } elseif ( $dispLen > $length && $dispLen > strlen( $ellipsis ) ) {
                                        # String in fact does need truncation, the truncation point was OK.
+                                       // @phan-suppress-next-line PhanTypeInvalidExpressionArrayDestructuring
                                        list( $ret, $openTags ) = $maybeState; // reload state
                                        $ret = $this->removeBadCharLast( $ret ); // multi-byte char fix
                                        $ret .= $ellipsis; // add ellipsis