3 * Raw page text accessor
5 * Copyright © 2004 Gabriel Wicke <wicke@wikidev.net>
8 * Based on HistoryAction and SpecialExport
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License as published by
12 * the Free Software Foundation; either version 2 of the License, or
13 * (at your option) any later version.
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
20 * You should have received a copy of the GNU General Public License along
21 * with this program; if not, write to the Free Software Foundation, Inc.,
22 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
23 * http://www.gnu.org/copyleft/gpl.html
25 * @author Gabriel Wicke <wicke@wikidev.net>
29 use MediaWiki\Logger\LoggerFactory
;
32 * A simple method to retrieve the plain source of an article,
33 * using "action=raw" in the GET request string.
37 class RawAction
extends FormlessAction
{
38 public function getName() {
42 public function requiresWrite() {
46 public function requiresUnblock() {
51 $this->getOutput()->disable();
52 $request = $this->getRequest();
53 $response = $request->response();
54 $config = $this->context
->getConfig();
56 if ( !$request->checkUrlExtension() ) {
60 if ( $this->getOutput()->checkLastModified( $this->page
->getTouched() ) ) {
61 return; // Client cache fresh and headers sent, nothing more to do.
64 $contentType = $this->getContentType();
66 $maxage = $request->getInt( 'maxage', $config->get( 'SquidMaxage' ) );
67 $smaxage = $request->getIntOrNull( 'smaxage' );
68 if ( $smaxage === null ) {
70 $contentType == 'text/css' ||
71 $contentType == 'application/json' ||
72 $contentType == 'text/javascript'
74 // CSS/JSON/JS raw content has its own CDN max age configuration.
75 // Note: Title::getCdnUrls() includes action=raw for css/json/js
76 // pages, so if using the canonical url, this will get HTCP purges.
77 $smaxage = intval( $config->get( 'ForcedRawSMaxage' ) );
79 // No CDN cache for anything else
84 // Set standard Vary headers so cache varies on cookies and such (T125283)
85 $response->header( $this->getOutput()->getVaryHeader() );
86 if ( $config->get( 'UseKeyHeader' ) ) {
87 $response->header( $this->getOutput()->getKeyHeader() );
90 // Output may contain user-specific data;
91 // vary generated content for open sessions on private wikis
92 $privateCache = !User
::isEveryoneAllowed( 'read' ) &&
93 ( $smaxage == 0 || MediaWiki\Session\SessionManager
::getGlobalSession()->isPersistent() );
94 // Don't accidentally cache cookies if user is logged in (T55032)
95 $privateCache = $privateCache ||
$this->getUser()->isLoggedIn();
96 $mode = $privateCache ?
'private' : 'public';
98 'Cache-Control: ' . $mode . ', s-maxage=' . $smaxage . ', max-age=' . $maxage
101 // In the event of user JS, don't allow loading a user JS/CSS/Json
102 // subpage that has no registered user associated with, as
103 // someone could register the account and take control of the
105 $title = $this->getTitle();
106 if ( $title->isUserConfigPage() && $contentType !== 'text/x-wiki' ) {
107 // not using getRootText() as we want this to work
108 // even if subpages are disabled.
109 $rootPage = strtok( $title->getText(), '/' );
110 $userFromTitle = User
::newFromName( $rootPage, 'usable' );
111 if ( !$userFromTitle ||
$userFromTitle->getId() === 0 ) {
112 $log = LoggerFactory
::getInstance( "security" );
114 "Unsafe JS/CSS/Json load - {user} loaded {title} with {ctype}",
116 'user' => $this->getUser()->getName(),
117 'title' => $title->getPrefixedDBKey(),
118 'ctype' => $contentType,
121 $msg = wfMessage( 'unregistered-user-config' );
122 throw new HttpError( 403, $msg );
126 // Don't allow loading non-protected pages as javascript.
127 // In future we may further restrict this to only CONTENT_MODEL_JAVASCRIPT
128 // in NS_MEDIAWIKI or NS_USER, as well as including other config types,
129 // but for now be more permissive. Allowing protected pages outside of
130 // NS_USER and NS_MEDIAWIKI in particular should be considered a temporary
133 $contentType === 'text/javascript' &&
134 !$title->isUserJsConfigPage() &&
135 !$title->inNamespace( NS_MEDIAWIKI
) &&
136 !in_array( 'sysop', $title->getRestrictions( 'edit' ) ) &&
137 !in_array( 'editprotected', $title->getRestrictions( 'edit' ) )
140 $log = LoggerFactory
::getInstance( "security" );
141 $log->info( "Blocked loading unprotected JS {title} for {user}",
143 'user' => $this->getUser()->getName(),
144 'title' => $title->getPrefixedDBKey(),
147 throw new HttpError( 403, wfMessage( 'unprotected-js' ) );
150 $response->header( 'Content-type: ' . $contentType . '; charset=UTF-8' );
152 $text = $this->getRawText();
154 // Don't return a 404 response for CSS or JavaScript;
155 // 404s aren't generally cached and it would create
156 // extra hits when user CSS/JS are on and the user doesn't
158 if ( $text === false && $contentType == 'text/x-wiki' ) {
159 $response->statusHeader( 404 );
162 // Avoid PHP 7.1 warning of passing $this by reference
164 if ( !Hooks
::run( 'RawPageViewBeforeOutput', [ &$rawAction, &$text ] ) ) {
165 wfDebug( __METHOD__
. ": RawPageViewBeforeOutput hook broke raw page output.\n" );
172 * Get the text that should be returned, or false if the page or revision
175 * @return string|bool
177 public function getRawText() {
181 $title = $this->getTitle();
182 $request = $this->getRequest();
184 // If it's a MediaWiki message we can just hit the message cache
185 if ( $request->getBool( 'usemsgcache' ) && $title->getNamespace() == NS_MEDIAWIKI
) {
186 // The first "true" is to use the database, the second is to use
187 // the content langue and the last one is to specify the message
188 // key already contains the language in it ("/de", etc.).
189 $text = MessageCache
::singleton()->get( $title->getDBkey(), true, true, true );
190 // If the message doesn't exist, return a blank
191 if ( $text === false ) {
195 // Get it from the DB
196 $rev = Revision
::newFromTitle( $title, $this->getOldId() );
198 $lastmod = wfTimestamp( TS_RFC2822
, $rev->getTimestamp() );
199 $request->response()->header( "Last-modified: $lastmod" );
201 // Public-only due to cache headers
202 $content = $rev->getContent();
204 if ( $content === null ) {
205 // revision not found (or suppressed)
207 } elseif ( !$content instanceof TextContent
) {
209 wfHttpError( 415, "Unsupported Media Type", "The requested page uses the content model `"
210 . $content->getModel() . "` which is not supported via this interface." );
214 $section = $request->getIntOrNull( 'section' );
215 if ( $section !== null ) {
216 $content = $content->getSection( $section );
219 if ( $content === null ||
$content === false ) {
220 // section not found (or section not supported, e.g. for JS, JSON, and CSS)
223 $text = $content->getNativeData();
229 if ( $text !== false && $text !== '' && $request->getRawVal( 'templates' ) === 'expand' ) {
230 $text = $wgParser->preprocess(
233 ParserOptions
::newFromContext( $this->getContext() )
241 * Get the ID of the revision that should used to get the text.
245 public function getOldId() {
246 $oldid = $this->getRequest()->getInt( 'oldid' );
247 switch ( $this->getRequest()->getText( 'direction' ) ) {
249 # output next revision, or nothing if there isn't one
252 $nextid = $this->getTitle()->getNextRevisionID( $oldid );
254 $oldid = $nextid ?
: -1;
257 # output previous revision, or nothing if there isn't one
259 # get the current revision so we can get the penultimate one
260 $oldid = $this->page
->getLatest();
262 $previd = $this->getTitle()->getPreviousRevisionID( $oldid );
263 $oldid = $previd ?
: -1;
274 * Get the content type to use for the response
278 public function getContentType() {
279 // Use getRawVal instead of getVal because we only
280 // need to match against known strings, there is no
281 // storing of localised content or other user input.
282 $ctype = $this->getRequest()->getRawVal( 'ctype' );
284 if ( $ctype == '' ) {
285 // Legacy compatibilty
286 $gen = $this->getRequest()->getRawVal( 'gen' );
287 if ( $gen == 'js' ) {
288 $ctype = 'text/javascript';
289 } elseif ( $gen == 'css' ) {
298 // FIXME: Should we still allow Zope editing? External editing feature was dropped
299 'application/x-zope-edit',
302 if ( $ctype == '' ||
!in_array( $ctype, $allowedCTypes ) ) {
303 $ctype = 'text/x-wiki';