Merge "(bug 39180) Set x-frame-options='DENY' for api"

diff --combined includes/DefaultSettings.php
index a24081d,acbcd0a..bc04f08
--- 1/includes/DefaultSettings.php
--- 2/includes/DefaultSettings.php
+++ b/includes/DefaultSettings.php
@@@ -385,9 -385,7 +385,9 @@@ $wgImgAuthPublicTest = true
   *                      some remote repos.
   *   - thumbDir         The base thumbnail directory. Defaults to "<directory>/thumb".
   *   - thumbUrl         The base thumbnail URL. Defaults to "<url>/thumb".
 - *
 + *   - isPrivate        Set this if measures should always be taken to keep the files private.
 + *                      One should not trust this to assure that the files are not web readable;
 + *                      the server configuration should be done manually depending on the backend.
   *
   * These settings describe a foreign MediaWiki installation. They are optional, and will be ignored
   * for local repositories:
@@@ -509,7 -507,7 +509,7 @@@ $wgSharedUploadDBprefix = ''
  $wgCacheSharedUploads = true;
  
  /**
 - * Allow for upload to be copied from an URL. Requires Special:Upload?source=web
 + * Allow for upload to be copied from an URL.
   * The timeout for copy uploads is set by $wgHTTPTimeout.
   * You have to assign the user right 'upload_by_url' to a user group, to use this.
   */
@@@ -1310,10 -1308,6 +1310,10 @@@ $wgDBuser = 'wikiuser'
  $wgDBpassword = '';
  /** Database type */
  $wgDBtype = 'mysql';
 +/** Whether to use SSL in DB connection. */
 +$wgDBssl = false;
 +/** Whether to use compression in DB connection. */
 +$wgDBcompress = false;
  
  /** Separate username for maintenance tasks. Leave as null to use the default. */
  $wgDBadminuser = null;
@@@ -1399,8 -1393,6 +1399,8 @@@ $wgSharedTables = array( 'user', 'user_
   *                  - DBO_IGNORE -- ignore errors (not useful in LocalSettings.php)
   *                  - DBO_NOBUFFER -- turn off buffering (not useful in LocalSettings.php)
   *                  - DBO_PERSISTENT -- enables persistent database connections
 + *                  - DBO_SSL -- uses SSL/TLS encryption in database connections, if available
 + *                  - DBO_COMPRESS -- uses internal compression in database connections, if available
   *
   *   - max lag:     (optional) Maximum replication lag before a slave will taken out of rotation
   *   - max threads: (optional) Maximum number of running threads
@@@ -2325,16 -2317,16 +2325,16 @@@ $wgVariantArticlePath = false
  $wgLoginLanguageSelector = false;
  
  /**
 - * When translating messages with wfMsg(), it is not always clear what should
 - * be considered UI messages and what should be content messages.
 + * When translating messages with wfMessage(), it is not always clear what
 + * should be considered UI messages and what should be content messages.
   *
   * For example, for the English Wikipedia, there should be only one 'mainpage',
   * so when getting the link for 'mainpage', we should treat it as site content
 - * and call wfMsgForContent(), but for rendering the text of the link, we call
 - * wfMsg(). The code behaves this way by default. However, sites like the
 - * Wikimedia Commons do offer different versions of 'mainpage' and the like for
 - * different languages. This array provides a way to override the default
 - * behavior.
 + * and call ->inContentLanguage()->text(), but for rendering the text of the
 + * link, we call ->text(). The code behaves this way by default. However,
 + * sites like the Wikimedia Commons do offer different versions of 'mainpage'
 + * and the like for different languages. This array provides a way to override
 + * the default behavior.
   *
   * @par Example:
   * To allow language-specific main page and community
@@@ -2628,6 -2620,18 +2628,18 @@@ $wgBreakFrames = false
   */
  $wgEditPageFrameOptions = 'DENY';
  
+ /**
+  * Disallow framing of API pages directly, by setting the X-Frame-Options
+  * header. Since the API returns CSRF tokens, allowing the results to be
+  * framed can compromise your user's account security.
+  * Options are:
+  *   - 'DENY': Do not allow framing. This is recommended for most wikis.
+  *   - 'SAMEORIGIN': Allow framing by pages on the same domain.
+  *   - false: Allow all framing.
+  */
+ 
+ $wgApiFrameOptions = 'DENY';
+ 
  /**
   * Disable output compression (enabled by default if zlib is available)
   */
@@@ -2760,7 -2764,7 +2772,7 @@@ $wgShowRollbackEditCount = 10
   *      'scripts' => 'myExtension.js',
   *      'styles' => 'myExtension.css',
   *      'dependencies' => array( 'jquery.cookie', 'jquery.tabIndex' ),
 - *      'localBasePath' => dirname( __FILE__ ),
 + *      'localBasePath' => __DIR__,
   *      'remoteExtPath' => 'MyExtension',
   *   );
   * @endcode
@@@ -5212,7 -5216,7 +5224,7 @@@ $wgExtensionFunctions = array()
   *
   * @par Example:
   * @code
 - *    $wgExtensionMessagesFiles['ConfirmEdit'] = dirname(__FILE__).'/ConfirmEdit.i18n.php';
 + *    $wgExtensionMessagesFiles['ConfirmEdit'] = __DIR__.'/ConfirmEdit.i18n.php';
   * @endcode
   */
  $wgExtensionMessagesFiles = array();
@@@ -5665,7 -5669,6 +5677,7 @@@ $wgSpecialPageGroups = array
        'Mostlinkedtemplates'       => 'highuse',
        'Mostcategories'            => 'highuse',
        'Mostimages'                => 'highuse',
 +      'Mostinterwikis'            => 'highuse',
        'Mostrevisions'             => 'highuse',
  
        'Allpages'                  => 'pages',