Merge "Allow closures as HTMLInfoField values"

[lhc/web/wiklou.git] / includes / GlobalFunctions.php

diff --git a/includes/GlobalFunctions.php b/includes/GlobalFunctions.php
index 618fa4c..7117f4c 100644 (file)
--- a/includes/GlobalFunctions.php
+++ b/includes/GlobalFunctions.php
@@ -30,7 +30,6 @@ use MediaWiki\Session\SessionManager;
 
 // Hide compatibility functions from Doxygen
 /// @cond
-
 /**
  * Compatibility functions
  *
@@ -223,17 +222,17 @@ function wfAppendToArrayIfNotDefault( $key, $value, $default, &$changed ) {
  * Merge arrays in the style of getUserPermissionsErrors, with duplicate removal
  * e.g.
  *     wfMergeErrorArrays(
- *             array( array( 'x' ) ),
- *             array( array( 'x', '2' ) ),
- *             array( array( 'x' ) ),
- *             array( array( 'y' ) )
+ *             [ [ 'x' ] ],
+ *             [ [ 'x', '2' ] ],
+ *             [ [ 'x' ] ],
+ *             [ [ 'y' ] ]
  *     );
  * returns:
- *             array(
- *             array( 'x', '2' ),
- *             array( 'x' ),
- *             array( 'y' )
- *     )
+ *             [
+ *             [ 'x', '2' ],
+ *             [ 'x' ],
+ *             [ 'y' ]
+ *     ]
  *
  * @param array $array1,...
  * @return array
@@ -828,7 +827,7 @@ function wfParseUrl( $url ) {
        $bits = parse_url( $url );
        MediaWiki\restoreWarnings();
        // parse_url() returns an array without scheme for some invalid URLs, e.g.
-       // parse_url("%0Ahttp://example.com") == array( 'host' => '%0Ahttp', 'path' => 'example.com' )
+       // parse_url("%0Ahttp://example.com") == [ 'host' => '%0Ahttp', 'path' => 'example.com' ]
        if ( !$bits || !isset( $bits['scheme'] ) ) {
                return false;
        }
@@ -2457,6 +2456,15 @@ function wfShellExec( $cmd, &$retval = null, $environ = [],
        }
        wfDebug( "wfShellExec: $cmd\n" );
 
+       // Don't try to execute commands that exceed Linux's MAX_ARG_STRLEN.
+       // Other platforms may be more accomodating, but we don't want to be
+       // accomodating, because very long commands probably include user
+       // input. See T129506.
+       if ( strlen( $cmd ) > SHELL_MAX_ARG_STRLEN ) {
+               throw new Exception( __METHOD__ .
+                       '(): total length of $cmd must not exceed SHELL_MAX_ARG_STRLEN' );
+       }
+
        $desc = [
                0 => [ 'file', 'php://stdin', 'r' ],
                1 => [ 'pipe', 'w' ],
@@ -2491,14 +2499,6 @@ function wfShellExec( $cmd, &$retval = null, $environ = [],
        $eintr = defined( 'SOCKET_EINTR' ) ? SOCKET_EINTR : 4;
        $eintrMessage = "stream_select(): unable to select [$eintr]";
 
-       // Build a table mapping resource IDs to pipe FDs to work around a
-       // PHP 5.3 issue in which stream_select() does not preserve array keys
-       // <https://bugs.php.net/bug.php?id=53427>.
-       $fds = [];
-       foreach ( $pipes as $fd => $pipe ) {
-               $fds[(int)$pipe] = $fd;
-       }
-
        $running = true;
        $timeout = null;
        $numReadyPipes = 0;
@@ -2531,9 +2531,8 @@ function wfShellExec( $cmd, &$retval = null, $environ = [],
                                break;
                        }
                }
-               foreach ( $readyPipes as $pipe ) {
+               foreach ( $readyPipes as $fd => $pipe ) {
                        $block = fread( $pipe, 65536 );
-                       $fd = $fds[(int)$pipe];
                        if ( $block === '' ) {
                                // End of file
                                fclose( $pipes[$fd] );
@@ -2951,7 +2950,7 @@ function wfRelativePath( $path, $from ) {
  * Supports base 2 through 36; digit values 10-36 are represented
  * as lowercase letters a-z. Input is case-insensitive.
  *
- * @deprecated 1.27 Use Wikimedia\base_convert() directly
+ * @deprecated since 1.27 Use Wikimedia\base_convert() directly
  *
  * @param string $input Input number
  * @param int $sourceBase Base of the input number
@@ -3351,9 +3350,9 @@ function wfCountDown( $seconds ) {
 }
 
 /**
- * Replace all invalid characters with -
- * Additional characters can be defined in $wgIllegalFileChars (see bug 20489)
- * By default, $wgIllegalFileChars = ':'
+ * Replace all invalid characters with '-'.
+ * Additional characters can be defined in $wgIllegalFileChars (see T22489).
+ * By default, $wgIllegalFileChars includes ':', '/', '\'.
  *
  * @param string $name Filename to process
  * @return string
@@ -3361,12 +3360,13 @@ function wfCountDown( $seconds ) {
 function wfStripIllegalFilenameChars( $name ) {
        global $wgIllegalFileChars;
        $illegalFileChars = $wgIllegalFileChars ? "|[" . $wgIllegalFileChars . "]" : '';
-       $name = wfBaseName( $name );
        $name = preg_replace(
                "/[^" . Title::legalChars() . "]" . $illegalFileChars . "/",
                '-',
                $name
        );
+       // $wgIllegalFileChars may not include '/' and '\', so we still need to do this
+       $name = wfBaseName( $name );
        return $name;
 }
 
@@ -3525,7 +3525,7 @@ function wfGetParserCacheStorage() {
  * @param string|null $deprecatedVersion Optionally mark hook as deprecated with version number
  *
  * @return bool True if no handler aborted the hook
- * @deprecated 1.25 - use Hooks::run
+ * @deprecated since 1.25 - use Hooks::run
  */
 function wfRunHooks( $event, array $args = [], $deprecatedVersion = null ) {
        return Hooks::run( $event, $args, $deprecatedVersion );