includes/api/ApiQueryTokens.php

   1 <?php
   2 /**
   3  * Module to fetch tokens via action=query&meta=tokens
   4  *
   5  * Copyright © 2014 Wikimedia Foundation and contributors
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License as published by
   9  * the Free Software Foundation; either version 2 of the License, or
  10  * (at your option) any later version.
  11  *
  12  * This program is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  15  * GNU General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU General Public License along
  18  * with this program; if not, write to the Free Software Foundation, Inc.,
  19  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  20  * http://www.gnu.org/copyleft/gpl.html
  21  *
  22  * @file
  23  * @since 1.24
  24  */
  25
  26 namespace MediaWiki\Api;
  27
  28 use MediaWiki\MediaWikiServices;
  29 use MediaWiki\User\User;
  30 use Wikimedia\ParamValidator\ParamValidator;
  31
  32 /**
  33  * Module to fetch tokens via action=query&meta=tokens
  34  *
  35  * @ingroup API
  36  * @since 1.24
  37  */
  38 class ApiQueryTokens extends ApiQueryBase {
  39
  40         public function execute() {
  41                 $params = $this->extractRequestParams();
  42
  43                 if ( $this->lacksSameOriginSecurity() ) {
  44                         $this->addWarning( [ 'apiwarn-tokens-origin' ] );
  45                         return;
  46                 }
  47
  48                 $user = $this->getUser();
  49                 $session = $this->getRequest()->getSession();
  50                 $salts = self::getTokenTypeSalts();
  51
  52                 $done = [];
  53                 $path = [ 'query', $this->getModuleName() ];
  54                 $this->getResult()->addArrayType( $path, 'assoc' );
  55
  56                 foreach ( $params['type'] as $type ) {
  57                         $token = self::getToken( $user, $session, $salts[$type] )->toString();
  58                         $fit = $this->getResult()->addValue( $path, $type . 'token', $token );
  59
  60                         if ( !$fit ) {
  61                                 // Abuse type as a query-continue parameter and set it to all unprocessed types
  62                                 $this->setContinueEnumParameter( 'type',
  63                                         array_diff( $params['type'], $done ) );
  64                                 break;
  65                         }
  66                         $done[] = $type;
  67                 }
  68         }
  69
  70         /**
  71          * Get the salts for known token types
  72          * @return (string|array)[] Returning a string will use that as the salt
  73          *  for User::getEditTokenObject() to fetch the token, which will give a
  74          *  LoggedOutEditToken (always "+\\") for anonymous users. Returning an
  75          *  array will use it as parameters to MediaWiki\Session\Session::getToken(),
  76          *  which will always return a full token even for anonymous users.
  77          */
  78         public static function getTokenTypeSalts() {
  79                 static $salts = null;
  80                 if ( !$salts ) {
  81                         $salts = [
  82                                 'csrf' => '',
  83                                 'watch' => 'watch',
  84                                 'patrol' => 'patrol',
  85                                 'rollback' => 'rollback',
  86                                 'userrights' => 'userrights',
  87                                 'login' => [ '', 'login' ],
  88                                 'createaccount' => [ '', 'createaccount' ],
  89                         ];
  90                         $hookContainer = MediaWikiServices::getInstance()->getHookContainer();
  91                         $hookRunner = new ApiHookRunner( $hookContainer );
  92                         $hookRunner->onApiQueryTokensRegisterTypes( $salts );
  93                         ksort( $salts );
  94                 }
  95
  96                 return $salts;
  97         }
  98
  99         /**
 100          * Get a token from a salt
 101          * @param User $user
 102          * @param \MediaWiki\Session\Session $session
 103          * @param string|array $salt A string will be used as the salt for
 104          *  User::getEditTokenObject() to fetch the token, which will give a
 105          *  LoggedOutEditToken (always "+\\") for anonymous users. An array will
 106          *  be used as parameters to MediaWiki\Session\Session::getToken(), which
 107          *  will always return a full token even for anonymous users. An array will
 108          *  also persist the session.
 109          * @return \MediaWiki\Session\Token
 110          */
 111         public static function getToken( User $user, \MediaWiki\Session\Session $session, $salt ) {
 112                 if ( is_array( $salt ) ) {
 113                         $session->persist();
 114                         return $session->getToken( ...$salt );
 115                 } else {
 116                         return $user->getEditTokenObject( $salt, $session->getRequest() );
 117                 }
 118         }
 119
 120         public function getAllowedParams() {
 121                 return [
 122                         'type' => [
 123                                 ParamValidator::PARAM_DEFAULT => 'csrf',
 124                                 ParamValidator::PARAM_ISMULTI => true,
 125                                 ParamValidator::PARAM_TYPE => array_keys( self::getTokenTypeSalts() ),
 126                                 ParamValidator::PARAM_ALL => true,
 127                         ],
 128                 ];
 129         }
 130
 131         protected function getExamplesMessages() {
 132                 return [
 133                         'action=query&meta=tokens'
 134                                 => 'apihelp-query+tokens-example-simple',
 135                         'action=query&meta=tokens&type=watch|patrol'
 136                                 => 'apihelp-query+tokens-example-types',
 137                 ];
 138         }
 139
 140         public function isReadMode() {
 141                 // So login tokens can be fetched on private wikis
 142                 return false;
 143         }
 144
 145         public function getHelpUrls() {
 146                 return 'https://www.mediawiki.org/wiki/Special:MyLanguage/API:Tokens';
 147         }
 148 }
 149
 150 /** @deprecated class alias since 1.43 */
 151 class_alias( ApiQueryTokens::class, 'ApiQueryTokens' );