API: Fix fetching login token from action=query&meta=tokens on private wikis

[lhc/web/wiklou.git] / includes / api / ApiQuery.php

diff --git a/includes/api/ApiQuery.php b/includes/api/ApiQuery.php
index eeb0cf7..9e937f5 100644 (file)
--- a/includes/api/ApiQuery.php
+++ b/includes/api/ApiQuery.php
@@ -20,6 +20,7 @@
  * @file
  */
 
+use MediaWiki\MediaWikiServices;
 use Wikimedia\Rdbms\IDatabase;
 
 /**
@@ -134,7 +135,10 @@ class ApiQuery extends ApiBase {
        public function __construct( ApiMain $main, $action ) {
                parent::__construct( $main, $action );
 
-               $this->mModuleMgr = new ApiModuleManager( $this );
+               $this->mModuleMgr = new ApiModuleManager(
+                       $this,
+                       MediaWikiServices::getInstance()->getObjectFactory()
+               );
 
                // Allow custom modules to be added in LocalSettings.php
                $config = $this->getConfig();
@@ -223,7 +227,9 @@ class ApiQuery extends ApiBase {
                // Filter modules based on continue parameter
                $continuationManager = new ApiContinuationManager( $this, $allModules, $propModules );
                $this->setContinuationManager( $continuationManager );
+               /** @var ApiQueryBase[] $modules */
                $modules = $continuationManager->getRunModules();
+               '@phan-var ApiQueryBase[] $modules';
 
                if ( !$continuationManager->isGeneratorDone() ) {
                        // Query modules may optimize data requests through the $this->getPageSet()
@@ -242,7 +248,6 @@ class ApiQuery extends ApiBase {
                $cacheMode = $this->mPageSet->getCacheMode();
 
                // Execute all unfinished modules
-               /** @var ApiQueryBase $module */
                foreach ( $modules as $module ) {
                        $params = $module->extractRequestParams();
                        $cacheMode = $this->mergeCacheMode(
@@ -441,6 +446,7 @@ class ApiQuery extends ApiBase {
                $exporter = new WikiExporter( $this->getDB() );
                $sink = new DumpStringOutput;
                $exporter->setOutputSink( $sink );
+               $exporter->setSchemaVersion( $this->mParams['exportschema'] );
                $exporter->openStream();
                foreach ( $exportTitles as $title ) {
                        $exporter->pageByTitle( $title );
@@ -479,6 +485,10 @@ class ApiQuery extends ApiBase {
                        'indexpageids' => false,
                        'export' => false,
                        'exportnowrap' => false,
+                       'exportschema' => [
+                               ApiBase::PARAM_DFLT => WikiExporter::schemaVersion(),
+                               ApiBase::PARAM_TYPE => XmlDumpWriter::$supportedSchemas,
+                       ],
                        'iwurl' => false,
                        'continue' => [
                                ApiBase::PARAM_HELP_MSG => 'api-help-param-continue',
@@ -499,15 +509,14 @@ class ApiQuery extends ApiBase {
                // parameters either. We do allow the 'rawcontinue' and 'indexpageids'
                // parameters since frameworks might add these unconditionally and they
                // can't expose anything here.
+               $allowedParams = [ 'rawcontinue' => 1, 'indexpageids' => 1 ];
                $this->mParams = $this->extractRequestParams();
-               $params = array_filter(
-                       array_diff_key(
-                               $this->mParams + $this->getPageSet()->extractRequestParams(),
-                               [ 'rawcontinue' => 1, 'indexpageids' => 1 ]
-                       )
-               );
-               if ( array_keys( $params ) !== [ 'meta' ] ) {
-                       return true;
+               $request = $this->getRequest();
+               foreach ( $this->mParams + $this->getPageSet()->extractRequestParams() as $param => $value ) {
+                       $needed = $param === 'meta';
+                       if ( !isset( $allowedParams[$param] ) && $request->getCheck( $param ) !== $needed ) {
+                               return true;
+                       }
                }
 
                // Ask each module if it requires read mode. Any true => this returns