Gecko [ paroquia-rio-de-mouro.pt ]

Name	Size	Permission	Date
i18n	[ DIR ]	drwxr-xr-x	2016-11-28 20:20
ApiAMCreateAccount.php	4.17 KB	-rw-r--r--	2016-11-28 20:20
ApiAuthManagerHelper.php	12.14 KB	-rw-r--r--	2016-11-28 20:20
ApiBase.php	84.45 KB	-rw-r--r--	2016-11-28 20:20
ApiBlock.php	5.16 KB	-rw-r--r--	2016-11-28 20:20
ApiCSPReport.php	6.34 KB	-rw-r--r--	2016-11-28 20:20
ApiChangeAuthenticationData.php	2.95 KB	-rw-r--r--	2016-11-28 20:20
ApiCheckToken.php	2.24 KB	-rw-r--r--	2016-11-28 20:20
ApiClearHasMsg.php	1.62 KB	-rw-r--r--	2016-11-28 20:20
ApiClientLogin.php	4.39 KB	-rw-r--r--	2016-11-28 20:20
ApiComparePages.php	3.51 KB	-rw-r--r--	2016-11-28 20:20
ApiContinuationManager.php	8.03 KB	-rw-r--r--	2016-11-28 20:20
ApiDelete.php	6.38 KB	-rw-r--r--	2016-11-28 20:20
ApiDisabled.php	1.42 KB	-rw-r--r--	2016-11-28 20:20
ApiEditPage.php	18.94 KB	-rw-r--r--	2016-11-28 20:20
ApiEmailUser.php	2.79 KB	-rw-r--r--	2016-11-28 20:20
ApiErrorFormatter.php	9.31 KB	-rw-r--r--	2016-11-28 20:20
ApiExpandTemplates.php	7.05 KB	-rw-r--r--	2016-11-28 20:20
ApiFeedContributions.php	6.51 KB	-rw-r--r--	2016-11-28 20:20
ApiFeedRecentChanges.php	5.32 KB	-rw-r--r--	2016-11-28 20:20
ApiFeedWatchlist.php	8.96 KB	-rw-r--r--	2016-11-28 20:20
ApiFileRevert.php	3.86 KB	-rw-r--r--	2016-11-28 20:20
ApiFormatBase.php	8.3 KB	-rw-r--r--	2016-11-28 20:20
ApiFormatDbg.php	1.77 KB	-rw-r--r--	2010-12-22 21:52
ApiFormatDump.php	1.79 KB	-rw-r--r--	2011-01-10 23:36
ApiFormatFeedWrapper.php	3.51 KB	-rw-r--r--	2016-11-28 20:20
ApiFormatJson.php	3.86 KB	-rw-r--r--	2016-11-28 20:20
ApiFormatNone.php	1.07 KB	-rw-r--r--	2016-11-28 20:20
ApiFormatPhp.php	2.47 KB	-rw-r--r--	2016-11-28 20:20
ApiFormatRaw.php	3.02 KB	-rw-r--r--	2016-11-28 20:20
ApiFormatTxt.php	1.75 KB	-rw-r--r--	2010-12-22 21:52
ApiFormatWddx.php	4.07 KB	-rw-r--r--	2010-12-22 21:52
ApiFormatXml.php	8.96 KB	-rw-r--r--	2016-11-28 20:20
ApiFormatYaml.php	1.37 KB	-rw-r--r--	2011-04-18 13:42
ApiHelp.php	26.17 KB	-rw-r--r--	2016-11-28 20:20
ApiHelpParamValueMessage.php	1.95 KB	-rw-r--r--	2016-11-28 20:20
ApiImageRotate.php	5.19 KB	-rw-r--r--	2016-11-28 20:20
ApiImport.php	4.95 KB	-rw-r--r--	2016-11-28 20:20
ApiLinkAccount.php	3.83 KB	-rw-r--r--	2016-11-28 20:20
ApiLogin.php	9.22 KB	-rw-r--r--	2016-11-28 20:20
ApiLogout.php	2.04 KB	-rw-r--r--	2016-11-28 20:20
ApiMain.php	55.81 KB	-rw-r--r--	2016-11-28 20:20
ApiManageTags.php	3.24 KB	-rw-r--r--	2016-11-28 20:20
ApiMergeHistory.php	3.75 KB	-rw-r--r--	2016-11-28 20:20
ApiMessage.php	5.64 KB	-rw-r--r--	2016-11-28 20:20
ApiModuleManager.php	8.31 KB	-rw-r--r--	2016-11-28 20:20
ApiMove.php	7.22 KB	-rw-r--r--	2016-11-28 20:20
ApiOpenSearch.php	11.74 KB	-rw-r--r--	2016-11-28 20:20
ApiOptions.php	5.25 KB	-rw-r--r--	2016-11-28 20:20
ApiPageSet.php	44.37 KB	-rw-r--r--	2016-11-28 20:20
ApiParamInfo.php	14.88 KB	-rw-r--r--	2016-11-28 20:20
ApiParse.php	26.07 KB	-rw-r--r--	2016-11-28 20:20
ApiPatrol.php	2.99 KB	-rw-r--r--	2016-11-28 20:20
ApiProtect.php	5.54 KB	-rw-r--r--	2016-11-28 20:20
ApiPurge.php	5.83 KB	-rw-r--r--	2016-11-28 20:20
ApiQuery.php	17.13 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryAllCategories.php	5.79 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryAllDeletedRevisions.php	14.65 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryAllImages.php	11.64 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryAllLinks.php	8.69 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryAllMessages.php	7.26 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryAllPages.php	9.65 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryAllRevisions.php	8.78 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryAllUsers.php	11.5 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryAllimages.php	8.42 KB	-rw-r--r--	2011-11-28 16:52
ApiQueryAllmessages.php	7.59 KB	-rw-r--r--	2011-11-28 16:52
ApiQueryAllpages.php	10.24 KB	-rw-r--r--	2011-11-28 16:52
ApiQueryAuthManagerInfo.php	4.11 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryBacklinks.php	17.24 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryBacklinksprop.php	12.31 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryBase.php	17.33 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryBlocks.php	10.29 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryCategories.php	6.53 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryCategoryInfo.php	3.29 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryCategoryMembers.php	11.99 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryContributors.php	7.5 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryDeletedRevisions.php	9.64 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryDeletedrevs.php	16.42 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryDisabled.php	1.4 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryDuplicateFiles.php	5.38 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryExtLinksUsage.php	5.94 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryExternalLinks.php	3.79 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryFileRepoInfo.php	3.2 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryFilearchive.php	9.18 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryGeneratorBase.php	3.27 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryIWBacklinks.php	5.62 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryIWLinks.php	5.12 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryImageInfo.php	25.98 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryImages.php	4.88 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryInfo.php	27.38 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryLangBacklinks.php	5.55 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryLangLinks.php	5.44 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryLinks.php	6.63 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryLogEvents.php	14.02 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryMyStashedFiles.php	4.04 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryPagePropNames.php	2.96 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryPageProps.php	3.13 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryPagesWithProp.php	4.84 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryPrefixSearch.php	3.63 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryProtectedTitles.php	6.83 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryQueryPage.php	4.6 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryRandom.php	6.56 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryRecentChanges.php	21.5 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryRevisions.php	14.46 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryRevisionsBase.php	15.64 KB	-rw-r--r--	2016-11-28 20:20
ApiQuerySearch.php	10.87 KB	-rw-r--r--	2016-11-28 20:20
ApiQuerySiteinfo.php	26.94 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryStashImageInfo.php	4.25 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryTags.php	4.93 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryTokens.php	4 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryUserContributions.php	17.06 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryUserInfo.php	9.93 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryUsers.php	10.21 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryWatchlist.php	15.41 KB	-rw-r--r--	2016-11-28 20:20
ApiQueryWatchlistRaw.php	5.74 KB	-rw-r--r--	2016-11-28 20:20
ApiRemoveAuthenticationData.php	3.29 KB	-rw-r--r--	2016-11-28 20:20
ApiResetPassword.php	3.89 KB	-rw-r--r--	2016-11-28 20:20
ApiResult.php	36.21 KB	-rw-r--r--	2016-11-28 20:20
ApiRevisionDelete.php	6.42 KB	-rw-r--r--	2016-11-28 20:20
ApiRollback.php	6.02 KB	-rw-r--r--	2016-11-28 20:20
ApiRsd.php	4.71 KB	-rw-r--r--	2016-11-28 20:20
ApiSerializable.php	1.55 KB	-rw-r--r--	2016-11-28 20:20
ApiSetNotificationTimestamp.php	7.01 KB	-rw-r--r--	2016-11-28 20:20
ApiStashEdit.php	15.04 KB	-rw-r--r--	2016-11-28 20:20
ApiTag.php	4.6 KB	-rw-r--r--	2016-11-28 20:20
ApiTokens.php	3.11 KB	-rw-r--r--	2016-11-28 20:20
ApiUnblock.php	3.52 KB	-rw-r--r--	2016-11-28 20:20
ApiUndelete.php	3.9 KB	-rw-r--r--	2016-11-28 20:20
ApiUpload.php	30.6 KB	-rw-r--r--	2016-11-28 20:20
ApiUserrights.php	3.92 KB	-rw-r--r--	2016-11-28 20:20
ApiWatch.php	5.3 KB	-rw-r--r--	2016-11-28 20:20
SearchApi.php	6.16 KB	-rw-r--r--	2016-11-28 20:20

Rename

<?php
/**
 * Copyright © 2015 Brian Wolff
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License along
 * with this program; if not, write to the Free Software Foundation, Inc.,
 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
 * http://www.gnu.org/copyleft/gpl.html
 *
 * @file
 */

use MediaWiki\Logger\LoggerFactory;

/**
 * Api module to receive and log CSP violation reports
 *
 * @ingroup API
 */
class ApiCSPReport extends ApiBase {

private $log;

/**
	 * These reports should be small. Ignore super big reports out of paranoia
	 */
	const MAX_POST_SIZE = 8192;

/**
	 * Logs a content-security-policy violation report from web browser.
	 */
	public function execute() {
		$reportOnly = $this->getParameter( 'reportonly' );
		$logname = $reportOnly ? 'csp-report-only' : 'csp';
		$this->log = LoggerFactory::getInstance( $logname );
		$userAgent = $this->getRequest()->getHeader( 'user-agent' );

$this->verifyPostBodyOk();
		$report = $this->getReport();
		$flags = $this->getFlags( $report );

$warningText = $this->generateLogLine( $flags, $report );
		$this->logReport( $flags, $warningText, [
			// XXX Is it ok to put untrusted data into log??
			'csp-report' => $report,
			'method' => __METHOD__,
			'user' => $this->getUser()->getName(),
			'user-agent' => $userAgent,
			'source' => $this->getParameter( 'source' ),
		] );
		$this->getResult()->addValue( null, $this->getModuleName(), 'success' );
	}

/**
	 * Log CSP report, with a different severity depending on $flags
	 * @param $flags Array Flags for this report
	 * @param $logLine String text of log entry
	 * @param $context Array logging context
	 */
	private function logReport( $flags, $logLine, $context ) {
		if ( in_array( 'false-positive', $flags ) ) {
			// These reports probably don't matter much
			$this->log->debug( $logLine, $context );
		} else {
			// Normal report.
			$this->log->warning( $logLine, $context );
		}
	}

/**
	 * Get extra notes about the report.
	 *
	 * @param $report Array The CSP report
	 * @return Array
	 */
	private function getFlags( $report ) {
		$reportOnly = $this->getParameter( 'reportonly' );
		$source = $this->getParameter( 'source' );
		$falsePositives = $this->getConfig()->get( 'CSPFalsePositiveUrls' );

$flags = [];
		if ( $source !== 'internal' ) {
			$flags[] = 'source=' . $source;
		}
		if ( $reportOnly ) {
			$flags[] = 'report-only';
		}

if (
			( isset( $report['blocked-uri'] ) &&
			isset( $falsePositives[$report['blocked-uri']] ) )
			|| ( isset( $report['source-file'] ) &&
			isset( $falsePositives[$report['source-file']] ) )
		) {
			// Report caused by Ad-Ware
			$flags[] = 'false-positive';
		}
		return $flags;
	}

/**
	 * Output an api error if post body is obviously not OK.
	 */
	private function verifyPostBodyOk() {
		$req = $this->getRequest();
		$contentType = $req->getHeader( 'content-type' );
		if ( $contentType !== 'application/json'
			&& $contentType !=='application/csp-report'
		) {
			$this->error( 'wrongformat', __METHOD__ );
		}
		if ( $req->getHeader( 'content-length' ) > self::MAX_POST_SIZE ) {
			$this->error( 'toobig', __METHOD__ );
		}
	}

/**
	 * Get the report from post body and turn into associative array.
	 *
	 * @return Array
	 */
	private function getReport() {
		$postBody = $this->getRequest()->getRawInput();
		if ( strlen( $postBody ) > self::MAX_POST_SIZE ) {
			// paranoia, already checked content-length earlier.
			$this->error( 'toobig', __METHOD__ );
		}
		$status = FormatJson::parse( $postBody, FormatJson::FORCE_ASSOC );
		if ( !$status->isGood() ) {
			list( $code, ) = $this->getErrorFromStatus( $status );
			$this->error( $code, __METHOD__ );
		}

$report = $status->getValue();

if ( !isset( $report['csp-report'] ) ) {
			$this->error( 'missingkey', __METHOD__ );
		}
		return $report['csp-report'];
	}

/**
	 * Get text of log line.
	 *
	 * @param $flags Array of additional markers for this report
	 * @param $report Array the csp report
	 * @return String Text to put in log
	 */
	private function generateLogLine( $flags, $report ) {
		$flagText = '';
		if ( $flags ) {
			$flagText = '[' . implode( $flags, ', ' ) . ']';
		}

$blockedFile = isset( $report['blocked-uri'] ) ? $report['blocked-uri'] : 'n/a';
		$page = isset( $report['document-uri'] ) ? $report['document-uri'] : 'n/a';
		$line = isset( $report['line-number'] ) ? ':' . $report['line-number'] : '';
		$warningText = $flagText .
			' Received CSP report: <' . $blockedFile .
			'> blocked from being loaded on <' . $page . '>' . $line;
		return $warningText;
	}

/**
	 * Stop processing the request, and output/log an error
	 *
	 * @param $code String error code
	 * @param $method String method that made error
	 * @throws UsageException Always
	 */
	private function error( $code, $method ) {
		$this->log->info( 'Error reading CSP report: ' . $code, [
			'method' => $method,
			'user-agent' => $this->getRequest()->getHeader( 'user-agent' )
		] );
		// 500 so it shows up in browser's developer console.
		$this->dieUsage( "Error processing CSP report: $code", 'cspreport-' . $code, 500 );
	}

public function getAllowedParams() {
		return [
			'reportonly' => [
				ApiBase::PARAM_TYPE => 'boolean',
				ApiBase::PARAM_DFLT => false
			],
			'source' => [
				ApiBase::PARAM_TYPE => 'string',
				ApiBase::PARAM_DFLT => 'internal',
				ApiBase::PARAM_REQUIRED => false
			]
		];
	}

public function mustBePosted() {
		return true;
	}

public function isWriteMode() {
		return false;
	}

/**
	 * Mark as internal. This isn't meant to be used by normal api users
	 */
	public function isInternal() {
		return true;
	}

/**
	 * Even if you don't have read rights, we still want your report.
	 */
	public function isReadMode() {
		return false;
	}

/**
	 * Doesn't touch db, so max lag should be rather irrelavent.
	 *
	 * Also, this makes sure that reports aren't lost during lag events.
	 */
	public function shouldCheckMaxLag() {
		return false;
	}
}