Merge "Disable WebResponse setters for post-send processing"

diff --combined includes/MediaWiki.php
index 72b1090,7fb59d5..bcc3633
--- 1/includes/MediaWiki.php
--- 2/includes/MediaWiki.php
+++ b/includes/MediaWiki.php
@@@ -104,7 -104,7 +104,7 @@@ class MediaWiki 
                if ( $ret === null || !$ret->isSpecialPage() ) {
                        // We can have urls with just ?diff=,?oldid= or even just ?diff=
                        $oldid = $request->getInt( 'oldid' );
 -                      $oldid = $oldid ? $oldid : $request->getInt( 'diff' );
 +                      $oldid = $oldid ?: $request->getInt( 'diff' );
                        // Allow oldid to override a changed or missing title
                        if ( $oldid ) {
                                $rev = Revision::newFromId( $oldid );
@@@ -426,7 -426,7 +426,7 @@@
                        // If $target is set, then a hook wanted to redirect.
                        if ( !$ignoreRedirect && ( $target || $page->isRedirect() ) ) {
                                // Is the target already set by an extension?
 -                              $target = $target ? $target : $page->followRedirect();
 +                              $target = $target ?: $page->followRedirect();
                                if ( is_string( $target ) ) {
                                        if ( !$this->config->get( 'DisableHardRedirects' ) ) {
                                                // we'll need to redirect
@@@ -723,6 -723,9 +723,9 @@@
                        MWExceptionHandler::rollbackMasterChangesAndLog( $e );
                }
  
+               // Disable WebResponse setters for post-send processing (T191537).
+               WebResponse::disableForPostSend();
+ 
                $blocksHttpClient = true;
                // Defer everything else if possible...
                $callback = function () use ( $mode, &$blocksHttpClient ) {

diff --combined includes/WebResponse.php
index 022a49e,82fe99e..0e5999d
--- 1/includes/WebResponse.php
--- 2/includes/WebResponse.php
+++ b/includes/WebResponse.php
@@@ -32,6 -32,22 +32,22 @@@ class WebResponse 
         */
        protected static $setCookies = [];
  
+       /** @var bool Used to disable setters before running jobs post-request (T191537) */
+       protected static $disableForPostSend = false;
+ 
+       /**
+        * Disable setters for post-send processing
+        *
+        * After this call, self::setCookie(), self::header(), and
+        * self::statusHeader() will log a warning and return without
+        * setting cookies or headers.
+        *
+        * @since 1.32
+        */
+       public static function disableForPostSend() {
+               self::$disableForPostSend = true;
+       }
+ 
        /**
         * Output an HTTP header, wrapper for PHP's header()
         * @param string $string Header to output
@@@ -39,6 -55,16 +55,16 @@@
         * @param null|int $http_response_code Forces the HTTP response code to the specified value.
         */
        public function header( $string, $replace = true, $http_response_code = null ) {
+               if ( self::$disableForPostSend ) {
+                       wfDebugLog( 'header', 'ignored post-send header {header}', 'all', [
+                               'header' => $string,
+                               'replace' => $replace,
+                               'http_response_code' => $http_response_code,
+                               'exception' => new RuntimeException( 'Ignored post-send header' ),
+                       ] );
+                       return;
+               }
+ 
                \MediaWiki\HeaderCallback::warnIfHeadersSent();
                if ( $http_response_code ) {
                        header( $string, $replace, $http_response_code );
@@@ -69,6 -95,14 +95,14 @@@
         * @param int $code Status code
         */
        public function statusHeader( $code ) {
+               if ( self::$disableForPostSend ) {
+                       wfDebugLog( 'header', 'ignored post-send status header {code}', 'all', [
+                               'code' => $code,
+                               'exception' => new RuntimeException( 'Ignored post-send status header' ),
+                       ] );
+                       return;
+               }
+ 
                HttpStatus::header( $code );
        }
  
@@@ -117,20 -151,29 +151,29 @@@
                        $expire = time() + $wgCookieExpiration;
                }
  
+               $cookie = $options['prefix'] . $name;
+               $data = [
+                       'name' => (string)$cookie,
+                       'value' => (string)$value,
+                       'expire' => (int)$expire,
+                       'path' => (string)$options['path'],
+                       'domain' => (string)$options['domain'],
+                       'secure' => (bool)$options['secure'],
+                       'httpOnly' => (bool)$options['httpOnly'],
+               ];
+ 
+               if ( self::$disableForPostSend ) {
+                       wfDebugLog( 'cookie', 'ignored post-send cookie {cookie}', 'all', [
+                               'cookie' => $cookie,
+                               'data' => $data,
+                               'exception' => new RuntimeException( 'Ignored post-send cookie' ),
+                       ] );
+                       return;
+               }
+ 
                $func = $options['raw'] ? 'setrawcookie' : 'setcookie';
  
                if ( Hooks::run( 'WebResponseSetCookie', [ &$name, &$value, &$expire, &$options ] ) ) {
-                       $cookie = $options['prefix'] . $name;
-                       $data = [
-                               'name' => (string)$cookie,
-                               'value' => (string)$value,
-                               'expire' => (int)$expire,
-                               'path' => (string)$options['path'],
-                               'domain' => (string)$options['domain'],
-                               'secure' => (bool)$options['secure'],
-                               'httpOnly' => (bool)$options['httpOnly'],
-                       ];
- 
                        // Per RFC 6265, key is name + domain + path
                        $key = "{$data['name']}\n{$data['domain']}\n{$data['path']}";
  
@@@ -234,7 -277,10 +277,7 @@@ class FauxResponse extends WebResponse 
        public function getHeader( $key ) {
                $key = strtoupper( $key );
  
 -              if ( isset( $this->headers[$key] ) ) {
 -                      return $this->headers[$key];
 -              }
 -              return null;
 +              return $this->headers[$key] ?? null;
        }
  
        /**
@@@ -300,7 -346,10 +343,7 @@@
         * @return array|null
         */
        public function getCookieData( $name ) {
 -              if ( isset( $this->cookies[$name] ) ) {
 -                      return $this->cookies[$name];
 -              }
 -              return null;
 +              return $this->cookies[$name] ?? null;
        }
  
        /**