Add protection for User: JSON pages in the same manner as JS & CSS ones

[lhc/web/wiklou.git] / includes / actions / RawAction.php

diff --git a/includes/actions/RawAction.php b/includes/actions/RawAction.php
index 625a9bb..812f962 100644 (file)
--- a/includes/actions/RawAction.php
+++ b/includes/actions/RawAction.php
@@ -64,10 +64,14 @@ class RawAction extends FormlessAction {
                $maxage = $request->getInt( 'maxage', $config->get( 'SquidMaxage' ) );
                $smaxage = $request->getIntOrNull( 'smaxage' );
                if ( $smaxage === null ) {
-                       if ( $contentType == 'text/css' || $contentType == 'text/javascript' ) {
-                               // CSS/JS raw content has its own CDN max age configuration.
-                               // Note: Title::getCdnUrls() includes action=raw for css/js pages,
-                               // so if using the canonical url, this will get HTCP purges.
+                       if (
+                               $contentType == 'text/css' ||
+                               $contentType == 'application/json' ||
+                               $contentType == 'text/javascript'
+                       ) {
+                               // CSS/JSON/JS raw content has its own CDN max age configuration.
+                               // Note: Title::getCdnUrls() includes action=raw for css/json/js
+                               // pages, so if using the canonical url, this will get HTCP purges.
                                $smaxage = intval( $config->get( 'ForcedRawSMaxage' ) );
                        } else {
                                // No CDN cache for anything else
@@ -161,7 +165,7 @@ class RawAction extends FormlessAction {
                                        }
 
                                        if ( $content === null || $content === false ) {
-                                               // section not found (or section not supported, e.g. for JS and CSS)
+                                               // section not found (or section not supported, e.g. for JS, JSON, and CSS)
                                                $text = false;
                                        } else {
                                                $text = $content->getNativeData();
@@ -239,6 +243,7 @@ class RawAction extends FormlessAction {
                        'text/x-wiki',
                        'text/javascript',
                        'text/css',
+                       // FIXME: Should we still allow Zope editing? External editing feature was dropped
                        'application/x-zope-edit',
                        'application/json'
                ];